Simple Terraform codes on laptop is alright for learning. But, at some point, things gotten more complex and infrastructure changes need a more controlled workflow.
For my second Terraform x Google Cloud portfolio artifact, I had already built a production like web platform with:
VPC
app and DB subnets
Cloud NAT
private backend VMs
regional Managed Instance Group
HTTP/HTTPS Load Balancer
Cloud Armor security policy
remote Terraform state
modular Terraform structure
In this version, I added the next operational layer:
Terraform CI/CD
The goal was simple:
Pull Request -> Terraform Plan
Manual Approval -> Terraform Apply
No service account JSON key
This became:
v2.0 — Terraform CI/CD with GitHub Actions and Workload Identity Federation
Checkout my github!
The Terraform Plan workflow succeeded on pull request.
It completed:
authentication to Google Cloud
terraform fmt check
terraform init
terraform validate
terraform plan
plan artifact upload
PR plan comment
This proves the review workflow works.
Terraform Apply Workflow
The Terraform Apply workflow also succeeded.
It was manually triggered from main, required environment approval, then executed:
Terraform Plan Before Apply
Terraform Apply
The deployment protection section shows that the terraform-apply environment was approved before apply continued.
This proves the execution workflow works.
One Warning I Noticed
The workflow showed a warning related to Node.js 20 actions being deprecated.
This did not break the workflow.
The run still succeeded.
What This Version Does Not Solve Yet
v2.0 is intentionally focused.
It does not yet include:
policy-as-code
cost estimation
drift detection automation
custom least-privilege Terraform IAM role
multi-environment promotion
automatic rollback
scheduled plan
Those are future improvements.
For this version, the objective was:
reviewable plan
manual approved apply
keyless authentication
Final Architecture After v2.0
The infrastructure platform now has two layers:
Runtime platform
HTTPS Load Balancer
Cloud Armor
Backend Service
Regional MIG
Private backend VMs
Cloud NAT
Delivery platform
GitHub Pull Request
Terraform Plan workflow
GitHub Environment Approval
Terraform Apply workflow
Workload Identity Federation
No service account JSON key
That is the main improvement.
The project moved from:
I can provision infrastructure.
to:
I can manage infrastructure changes through a controlled delivery workflow.
Version Timeline
v1.0 — Production-Lite HTTP Platform
v1.1 — HTTPS and Custom Domain
v1.2 — Security Hardening with Cloud Armor
v2.0 — Terraform CI/CD with GitHub Actions and WIF
Next, I may continue with:
v2.1 — Drift Detection and Recovery
Because after CI/CD, the next important Terraform question is:
What happens when someone changes infrastructure outside Terraform?
SOCIAL SHARE CARD GENERATOR