AlloyDB for PostgreSQL Cluster

Name: AlloyDB for PostgreSQL Cluster
Brand: IaC Bazaar
SKU: gcp-alloydb
Price: 179.00 USD
Availability: InStock

AlloyDB cluster with primary + read-pool instances, PSC connectivity, automated backups and columnar/vector engine flags.

terraformGoogle Cloud#gcp

Compare Managed Relational Database across clouds →

gcp-alloydbterraform v1.7

Verification

Live-tested

Really deployed to a cloud sandbox, verified against its outputs and assertions, then destroyed - with the teardown confirmed.

Conformance

Static validation (fmt · validate · tflint)
Security scan clean (Checkov)
Plan test superseded by live test

Provenance

SHA-256 checksum
Cosign signature

Functional

Live-tested - applied, verified, destroyed

Last verified 2026-06-30 · how we verify

Verify this download

cosign · sha-256

Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.

# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub

# 2. This module's Sigstore bundle
curl -o gcp-alloydb-1.0.0.sigstore.json \
  https://www.iac-bazaar.com/api/artifacts/gcp-alloydb/signature

# 3. Verify the tarball you downloaded
cosign verify-blob \
  --key cosign.pub \
  --bundle gcp-alloydb-1.0.0.sigstore.json \
  gcp-alloydb-1.0.0.tar.gz
# → Verified OK

# 4. (optional) confirm the checksum too
echo "1d00360266cd5c4e3a2690d8a966a7040cc149b3c6a95b40968ee1d098ca78c3  gcp-alloydb-1.0.0.tar.gz" | sha256sum -c

Signature bundle Public key Machine-readable receipt How we verify

Use it from the registry

terraform · opentofu

module "alloydb" {
  source  = "www.iac-bazaar.com/iac-bazaar/gcp-alloydb/gcp"
  version = "1.0.0"
}

Paid module — needs a purchase (or a subscription that covers it) plus a registry token from /account/tokens. Full setup: registry docs.

Inputs & outputs

Create a free account to read this module's contract

The declared contract — every input name, type, default and description, plus every output — is shown to signed-in accounts, not to anonymous visitors.

A free account sees the contract of every Free module. This one is Premium, so its contract unlocks when you buy it.

Create a free account →Sign in

Documentation

gcp-alloydb

An AlloyDB for PostgreSQL cluster — HA primary instance plus optional read-pool instances — with private connectivity (Private Service Access or Private Service Connect), automated weekly backups and continuous backup / PITR, optional CMEK, and the columnar engine flag on by default for analytical and vector/AI workloads. One module call gives you a cluster that is private, encrypted, backed up and deletion-protected by default. Works with Terraform and OpenTofu (>= 1.6), Google provider >= 7.0, < 8.0.

Status: static-validated, live-test pending. Validated with tofu validate + tflint + checkov against the hashicorp/google provider. Not yet applied against a live GCP project (no cloud sandbox; AlloyDB has no free tier and a cluster takes ~10 min to provision), so it ships under live-test quarantine.

Design & secure defaults

Private-only connectivity. Choose Private Service Access (psa, the default — the cluster gets a private IP in your VPC) or Private Service Connect (psc). There is no public-IP option in this module. For PSA the module can create the global address + service networking peering for you.
Encryption at rest is always on; supply kms_key_name to use CMEK for the cluster, automated backups and continuous backups.
Backups on by default: a weekly automated policy (quantity-based retention, 14 backups) plus continuous backup for point-in-time recovery (14-day window). Both are independently toggleable.
HA by default: the primary is REGIONAL (multi-zone) unless you opt into ZONAL.
Columnar / vector engine on: google_columnar_engine.enabled = on by default — AlloyDB's headline accelerator for analytics and vector similarity search. Extend database_flags (e.g. for pgvector tuning) as needed.
Deletion policy DEFAULT: the cluster cannot be deleted while instances exist. Set FORCE only in disposable environments.
Secrets stay out of the config: the initial user's password is a separate sensitive variable, sourced from your secret manager — never hardcoded.
Cross-field invariants enforced with precondition: PSA requires a network; setting initial_user_name requires initial_user_password.

Requirements

Requirement	Version
Terraform / OpenTofu	`>= 1.6`
`hashicorp/google`	`>= 7.0, < 8.0`

License

Commercial — LicenseRef-IaCBazaar-Commercial. See the IaC Bazaar terms.

Usage code & full reference unlock after purchase

The complete copy-paste usage, the full input/output reference, and operational notes ship with your licence - shown here and bundled in the download.

Usage
Inputs
Outputs

Related modules

Google Cloud✓ live-tested

BigQuery Dataset & Tables

Datasets with partitioned/clustered tables, authorized views, CMEK and dataset-level access controls.

$179.00v1.0.0

Google Cloud✓ live-tested

Cloud Bigtable Instance & Table

A single-cluster Cloud Bigtable instance (one 1-node SSD cluster, the smallest footprint) plus a table with column families, IAM-only access, optional CMEK, and deletion protection on.

$179.00v1.0.0

Google Cloud✓ live-tested

Cloud SQL (PostgreSQL/MySQL) HA Instance

Regional-HA Cloud SQL with private IP (PSA/PSC), automated backups, PITR, read replicas and IAM database auth.

$179.00v1.0.0

Google Cloud✓ live-tested

Cloud Spanner Instance & Database

A regional Cloud Spanner instance at the smallest billable size (100 processing units) plus a database with optional starter schema, drop protection, and Terraform deletion protection on.

$179.00v1.0.0

Google Cloud✓ live-tested

Memorystore Redis/Valkey

Private Memorystore instance or cluster (Redis or Valkey) with auth, TLS and maintenance policy on your VPC.

$179.00v1.0.0

AWS✓ live-tested

Aurora Cluster (Serverless v2 ready)

Aurora PostgreSQL/MySQL cluster with instances, parameter groups, Serverless v2 scaling, and enhanced monitoring.

$179.00v1.0.0