Skip to content

Commit 6bc008f

Browse files
pandirigoogniharika-98
pandirigoog
authored and
niharika-98
committed
docs: Custom SAN examples (terraform-google-modules#850)
* Custom SAN examples * docs: Custom SAN examples * Fix fmt issues * Add DB engine specific tests * Use unique tags and add comments * Make tags unique
1 parent 1bf53d5 commit 6bc008f

File tree

3 files changed

+324
-0
lines changed
  • cloud_sql
    • mysql_instance_custom_subject_alternative_names
    • postgres_instance_custom_subject_alternative_names
    • sqlserver_instance_custom_subject_alternative_names

3 files changed

+324
-0
lines changed

‎cloud_sql/mysql_instance_custom_subject_alternative_names/main.tf‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
/**
2+
* Copyright 2025 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
# [START cloud_sql_mysql_instance_service_identity]
17+
resource "google_project_service_identity" "default" {
18+
provider = google-beta
19+
service = "sqladmin.googleapis.com"
20+
}
21+
# [END cloud_sql_mysql_instance_service_identity]
22+
23+
# [START cloud_sql_mysql_privateca_ca_pool_suffix]
24+
resource "random_string" "default" {
25+
length = 10
26+
special = false
27+
upper = false
28+
}
29+
# [END cloud_sql_mysql_privateca_ca_pool_suffix]
30+
31+
# [START cloud_sql_mysql_instance_ca_pool]
32+
resource "google_privateca_ca_pool" "default" {
33+
name = "customer-ca-pool-${random_string.default.result}"
34+
location = "asia-northeast1"
35+
tier = "DEVOPS"
36+
publishing_options {
37+
publish_ca_cert = false
38+
publish_crl = false
39+
}
40+
}
41+
# [END cloud_sql_mysql_instance_ca_pool]
42+
43+
# [START cloud_sql_mysql_instance_ca]
44+
# This is required for setting up customer managed CAS (Certificate Authority Service) instances.
45+
resource "google_privateca_certificate_authority" "default" {
46+
pool = google_privateca_ca_pool.default.name
47+
certificate_authority_id = "my-certificate-authority"
48+
location = "asia-northeast1"
49+
lifetime = "86400s"
50+
type = "SELF_SIGNED"
51+
deletion_protection = false # set to "true" in production
52+
skip_grace_period = true
53+
ignore_active_certificates_on_deletion = true
54+
config {
55+
subject_config {
56+
subject {
57+
organization = "my organization"
58+
common_name = "my certificate authority name"
59+
}
60+
}
61+
x509_config {
62+
ca_options {
63+
is_ca = true
64+
}
65+
key_usage {
66+
base_key_usage {
67+
cert_sign = true
68+
crl_sign = true
69+
}
70+
extended_key_usage {
71+
server_auth = false
72+
}
73+
}
74+
}
75+
}
76+
key_spec {
77+
algorithm = "RSA_PKCS1_4096_SHA256"
78+
}
79+
}
80+
# [END cloud_sql_mysql_instance_ca]
81+
82+
# [START cloud_sql_mysql_instance_iam_granting]
83+
resource "google_privateca_ca_pool_iam_member" "default" {
84+
ca_pool = google_privateca_ca_pool.default.id
85+
role = "roles/privateca.certificateRequester"
86+
87+
member = "serviceAccount:${google_project_service_identity.default.email}"
88+
}
89+
# [END cloud_sql_mysql_instance_iam_granting]
90+
91+
# [START cloud_sql_mysql_instance_custom_subject_alternative_names]
92+
resource "google_sql_database_instance" "default" {
93+
name = "mysql-instance"
94+
region = "asia-northeast1"
95+
database_version = "MYSQL_8_4"
96+
settings {
97+
edition = "ENTERPRISE"
98+
tier = "db-f1-micro"
99+
ip_configuration {
100+
# The following server CA mode lets the instance use customer-managed CAS CA to issue server certificates.
101+
# https://cloud.google.com/sql/docs/mysql/admin-api/rest/v1beta4/instances#ipconfiguration
102+
server_ca_mode = "CUSTOMER_MANAGED_CAS_CA"
103+
server_ca_pool = google_privateca_ca_pool.default.id
104+
custom_subject_alternative_names = ["customSan.test.com"]
105+
}
106+
}
107+
}
108+
# [END cloud_sql_mysql_instance_custom_subject_alternative_names]

‎cloud_sql/postgres_instance_custom_subject_alternative_names/main.tf‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
/**
2+
* Copyright 2025 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
# [START cloud_sql_postgres_instance_service_identity]
17+
resource "google_project_service_identity" "default" {
18+
provider = google-beta
19+
service = "sqladmin.googleapis.com"
20+
}
21+
# [END cloud_sql_postgres_instance_service_identity]
22+
23+
# [START cloud_sql_postgres_privateca_ca_pool_suffix]
24+
resource "random_string" "default" {
25+
length = 10
26+
special = false
27+
upper = false
28+
}
29+
# [END cloud_sql_postgres_privateca_ca_pool_suffix]
30+
31+
# [START cloud_sql_postgres_instance_ca_pool]
32+
resource "google_privateca_ca_pool" "default" {
33+
name = "customer-ca-pool-${random_string.default.result}"
34+
location = "asia-northeast1"
35+
tier = "DEVOPS"
36+
publishing_options {
37+
publish_ca_cert = false
38+
publish_crl = false
39+
}
40+
}
41+
# [END cloud_sql_postgres_instance_ca_pool]
42+
43+
# [START cloud_sql_postgres_instance_ca]
44+
# This is required for setting up customer managed CAS (Certificate Authority Service) instances.
45+
resource "google_privateca_certificate_authority" "default" {
46+
pool = google_privateca_ca_pool.default.name
47+
certificate_authority_id = "my-certificate-authority"
48+
location = "asia-northeast1"
49+
lifetime = "86400s"
50+
type = "SELF_SIGNED"
51+
deletion_protection = false # set to "true" in production
52+
skip_grace_period = true
53+
ignore_active_certificates_on_deletion = true
54+
config {
55+
subject_config {
56+
subject {
57+
organization = "my organization"
58+
common_name = "my certificate authority name"
59+
}
60+
}
61+
x509_config {
62+
ca_options {
63+
is_ca = true
64+
}
65+
key_usage {
66+
base_key_usage {
67+
cert_sign = true
68+
crl_sign = true
69+
}
70+
extended_key_usage {
71+
server_auth = false
72+
}
73+
}
74+
}
75+
}
76+
key_spec {
77+
algorithm = "RSA_PKCS1_4096_SHA256"
78+
}
79+
}
80+
# [END cloud_sql_postgres_instance_ca]
81+
82+
# [START cloud_sql_postgres_instance_iam_granting]
83+
resource "google_privateca_ca_pool_iam_member" "default" {
84+
ca_pool = google_privateca_ca_pool.default.id
85+
role = "roles/privateca.certificateRequester"
86+
87+
member = "serviceAccount:${google_project_service_identity.default.email}"
88+
}
89+
# [END cloud_sql_postgres_instance_iam_granting]
90+
91+
# [START cloud_sql_postgres_instance_custom_subject_alternative_names]
92+
resource "google_sql_database_instance" "default" {
93+
name = "postgres-instance"
94+
region = "asia-northeast1"
95+
database_version = "POSTGRES_17"
96+
settings {
97+
edition = "ENTERPRISE"
98+
tier = "db-f1-micro"
99+
ip_configuration {
100+
# The following server CA mode lets the instance use customer-managed CAS CA to issue server certificates.
101+
# https://cloud.google.com/sql/docs/postgres/admin-api/rest/v1beta4/instances#ipconfiguration
102+
server_ca_mode = "CUSTOMER_MANAGED_CAS_CA"
103+
server_ca_pool = google_privateca_ca_pool.default.id
104+
custom_subject_alternative_names = ["customSan.test.com"]
105+
}
106+
}
107+
}
108+
# [END cloud_sql_postgres_instance_custom_subject_alternative_names]

‎cloud_sql/sqlserver_instance_custom_subject_alternative_names/main.tf‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
/**
2+
* Copyright 2025 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
# [START cloud_sql_sqlserver_instance_service_identity]
17+
resource "google_project_service_identity" "default" {
18+
provider = google-beta
19+
service = "sqladmin.googleapis.com"
20+
}
21+
# [END cloud_sql_sqlserver_instance_service_identity]
22+
23+
# [START cloud_sql_sqlserver_privateca_ca_pool_suffix]
24+
resource "random_string" "default" {
25+
length = 10
26+
special = false
27+
upper = false
28+
}
29+
# [END cloud_sql_sqlserver_privateca_ca_pool_suffix]
30+
31+
# [START cloud_sql_sqlserver_instance_ca_pool]
32+
resource "google_privateca_ca_pool" "default" {
33+
name = "customer-ca-pool-${random_string.default.result}"
34+
location = "asia-northeast1"
35+
tier = "DEVOPS"
36+
publishing_options {
37+
publish_ca_cert = false
38+
publish_crl = false
39+
}
40+
}
41+
# [END cloud_sql_sqlserver_instance_ca_pool]
42+
43+
# [START cloud_sql_sqlserver_instance_ca]
44+
# This is required for setting up customer managed CAS (Certificate Authority Service) instances.
45+
resource "google_privateca_certificate_authority" "default" {
46+
pool = google_privateca_ca_pool.default.name
47+
certificate_authority_id = "my-certificate-authority"
48+
location = "asia-northeast1"
49+
lifetime = "86400s"
50+
type = "SELF_SIGNED"
51+
deletion_protection = false # set to "true" in production
52+
skip_grace_period = true
53+
ignore_active_certificates_on_deletion = true
54+
config {
55+
subject_config {
56+
subject {
57+
organization = "my organization"
58+
common_name = "my certificate authority name"
59+
}
60+
}
61+
x509_config {
62+
ca_options {
63+
is_ca = true
64+
}
65+
key_usage {
66+
base_key_usage {
67+
cert_sign = true
68+
crl_sign = true
69+
}
70+
extended_key_usage {
71+
server_auth = false
72+
}
73+
}
74+
}
75+
}
76+
key_spec {
77+
algorithm = "RSA_PKCS1_4096_SHA256"
78+
}
79+
}
80+
# [END cloud_sql_sqlserver_instance_ca]
81+
82+
# [START cloud_sql_sqlserver_instance_iam_granting]
83+
resource "google_privateca_ca_pool_iam_member" "default" {
84+
ca_pool = google_privateca_ca_pool.default.id
85+
role = "roles/privateca.certificateRequester"
86+
87+
member = "serviceAccount:${google_project_service_identity.default.email}"
88+
}
89+
# [END cloud_sql_sqlserver_instance_iam_granting]
90+
91+
# [START cloud_sql_sqlserver_instance_custom_subject_alternative_names]
92+
resource "google_sql_database_instance" "default" {
93+
name = "sqlserver-instance"
94+
region = "asia-northeast1"
95+
database_version = "SQLSERVER_2022_STANDARD"
96+
root_password = "INSERT-PASSWORD-HERE"
97+
settings {
98+
tier = "db-custom-2-7680"
99+
ip_configuration {
100+
# The following server CA mode lets the instance use customer-managed CAS CA to issue server certificates.
101+
# https://cloud.google.com/sql/docs/sqlserver/admin-api/rest/v1beta4/instances#ipconfiguration
102+
server_ca_mode = "CUSTOMER_MANAGED_CAS_CA"
103+
server_ca_pool = google_privateca_ca_pool.default.id
104+
custom_subject_alternative_names = ["customSan.test.com"]
105+
}
106+
}
107+
}
108+
# [END cloud_sql_sqlserver_instance_custom_subject_alternative_names]

0 commit comments

Comments
 (0)