The Terraform Registry, CFT & CFF

Exam guide§2.4

Once you know what a module is, the next question is where to get them. You rarely author every module from scratch: three resources let you discover and reuse pre-built, tested modules for Google Cloud.

The Terraform Registry

The Terraform Registry is an interactive resource for discovering a wide selection of integrations and configuration packages, otherwise known as providers and modules. Its contents come from HashiCorp, third-party vendors, and the Terraform community.

Providers - plugins to manage any infrastructure API (Google, AWS, and so on).
Modules - pre-made packages that quickly configure common infrastructure components.
Examples - reference code showing how to write quality Terraform.

Because it surfaces modules for all providers, the Registry is the general-purpose catalog; the two collections below are the Google-specific ones.

Cloud Foundation Toolkit (CFT)

The Cloud Foundation Toolkit (CFT) is a series of reference modules for Terraform that reflect Google Cloud best practices. They can be used without modification to quickly build a repeatable, enterprise-ready foundation in Google Cloud. CFT modules are built and maintained by Googlers and published to the Terraform Registry.

On the exam, Terraform blueprints and CFT modules are the same thing - reference modules encoding Google Cloud best practices. If a question asks for the fastest way to stand up a best-practice foundation, the answer is a CFT / Terraform blueprint, not building the resources by hand.

Cloud Foundation Fabric (CFF)

Cloud Foundation Fabric (CFF) is a collection of Terraform modules and end-to-end examples meant to be cloned as a single unit for fast prototyping, or decomposed and modified for use inside organizations. The GitHub repository provides end-to-end blueprints plus a suite of modules supporting different use cases.

Resource	What it is	Scope	Use it for
Terraform Registry	Catalog of providers, modules, and examples	All providers (Google, AWS, ...)	Discovering any provider or community module
Cloud Foundation Toolkit (CFT)	Reference modules / blueprints, Googler-maintained, published to the Registry	Google Cloud	A best-practice, repeatable foundation used as-is
Cloud Foundation Fabric (CFF)	Modules + end-to-end examples, cloned whole or decomposed	Google Cloud	Fast prototyping, or a starting point to modify for your org

CFT module vs standard Terraform

The value of a CFT module is de-duplication. A CFT module lets you maintain the IAM roles for multiple projects within the same module, as opposed to updating roles for each project individually. One projects_iam module below replaces nine separate google_project_iam_member resources.

One CFT projects_iam module manages the network and App Engine role bindings across both projects. Standard Terraform needs a separate google_project_iam_member resource for every role x member x project combination.

The CFT projects_iam module - one block, a list of projects, and a map of role bindings:

module "project-iam-bindings" {
  source   =
  "terraform-google-modules/iam/google//modules/projects_iam"
  projects = ["my-project-one", "my-project-two"]
  mode     = "additive"
 
  bindings = {
    "roles/compute.networkAdmin" = [
      "group:my-group@my-org.com",
      "user:my-user@my-org.com",
    ]
    "roles/appengine.appAdmin" = [
      "group:my-group@my-org.com",
      "user:my-user@my-org.com",
    ]
  }
}

The standard-Terraform equivalent - one google_project_iam_member resource per role x member x project, repeated for every combination:

resource "google_project_iam_member" "project1-net-grp" {
  project = "my-project-one"
  role    = "roles/compute.networkAdmin"
  member  = "group:my-group@my-org.com"
}
 
resource "google_project_iam_member" "project1-net-user" {...}
resource "google_project_iam_member" "project2-net-grp"  {...}
resource "google_project_iam_member" "project2-net-user" {...}
resource "google_project_iam_member" "project1-app-grp"  {...}
resource "google_project_iam_member" "project1-app-user" {...}
resource "google_project_iam_member" "project2-app-grp"  {...}
resource "google_project_iam_member" "project2-app-user" {...}