IaC Bazaar
Browse modules
Menu
Google CloudLive-testedattested

AlloyDB for PostgreSQL Cluster

AlloyDB cluster with primary + read-pool instances, PSC connectivity, automated backups and columnar/vector engine flags.

terraformGoogle Cloudgcp

Compare Managed Relational Database across clouds →

gcp-alloydbvizier v1.2.0

Verification

Live-tested

Really deployed to a cloud sandbox, verified against its outputs and assertions, then destroyed - with the teardown confirmed.

Conformance

  • Static validation (fmt · validate · tflint)
  • Security scan clean (Checkov)
  • Plan test superseded by live test

Provenance

Functional

  • Live-tested - applied, verified, destroyed

Last verified 2026-06-30 · how we verify

Verify this download

cosign · sha-256

Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.

# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub

# 2. This module's Sigstore bundle
curl -o gcp-alloydb-1.0.0.sigstore.json \
  https://www.iac-bazaar.com/api/artifacts/gcp-alloydb/signature

# 3. Verify the tarball you downloaded
cosign verify-blob \
  --key cosign.pub \
  --bundle gcp-alloydb-1.0.0.sigstore.json \
  gcp-alloydb-1.0.0.tar.gz
# → Verified OK

# 4. (optional) confirm the checksum too
echo "1d00360266cd5c4e3a2690d8a966a7040cc149b3c6a95b40968ee1d098ca78c3  gcp-alloydb-1.0.0.tar.gz" | sha256sum -c
Signature bundlePublic keyMachine-readable receiptHow we verify

Use it from the registry

terraform · opentofu
module "alloydb" {
  source  = "www.iac-bazaar.com/iac-bazaar/gcp-alloydb/gcp"
  version = "1.0.0"
}

Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.

Cite it in your README

badge · attribution

Paste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads live-tested because the record says so, and the link lands on this page.

README.md, GitLab, Gitea
[![IaC Bazaar: live-tested](https://www.iac-bazaar.com/api/artifacts/gcp-alloydb/badge)](https://www.iac-bazaar.com/catalog/gcp-alloydb?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)

Terraform module 1.0.0, live-tested on IaC Bazaar: [AlloyDB for PostgreSQL Cluster](https://www.iac-bazaar.com/catalog/gcp-alloydb?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)

```hcl
module "alloydb" {
  source  = "www.iac-bazaar.com/iac-bazaar/gcp-alloydb/gcp"
  version = "1.0.0"
}
```

Preview:IaC Bazaar: live-tested

Inputs & outputs

Create a free account to read this module's contract

The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.

A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.

Create a free account →Sign in

Documentation

gcp-alloydb

An AlloyDB for PostgreSQL cluster — HA primary instance plus optional read-pool instances — with private connectivity (Private Service Access or Private Service Connect), automated weekly backups and continuous backup / PITR, optional CMEK, and the columnar engine flag on by default for analytical and vector/AI workloads. One module call gives you a cluster that is private, encrypted, backed up and deletion-protected by default. Works with Terraform and OpenTofu (>= 1.6), Google provider >= 7.0, < 8.0.

Cost and timing: AlloyDB has no free tier, and a cluster takes about ten minutes to provision. Plan for that in any pipeline that creates one on demand.

Design & secure defaults

  • Private-only connectivity. Choose Private Service Access (psa, the default — the cluster gets a private IP in your VPC) or Private Service Connect (psc). There is no public-IP option in this module. For PSA the module can create the global address + service networking peering for you.
  • Encryption at rest is always on; supply kms_key_name to use CMEK for the cluster, automated backups and continuous backups.
  • Backups on by default: a weekly automated policy (quantity-based retention, 14 backups) plus continuous backup for point-in-time recovery (14-day window). Both are independently toggleable.
  • HA by default: the primary is REGIONAL (multi-zone) unless you opt into ZONAL.
  • Columnar / vector engine on: google_columnar_engine.enabled = on by default — AlloyDB's headline accelerator for analytics and vector similarity search. Extend database_flags (e.g. for pgvector tuning) as needed.
  • Deletion policy DEFAULT: the cluster cannot be deleted while instances exist. Set FORCE only in disposable environments.
  • Secrets stay out of the config: the initial user's password is a separate sensitive variable, sourced from your secret manager — never hardcoded.
  • Cross-field invariants enforced with precondition: PSA requires a network; setting initial_user_name requires initial_user_password.

Requirements

RequirementVersion
Terraform / OpenTofu>= 1.6
hashicorp/google>= 7.0, < 8.0

License

Commercial — LicenseRef-IaCBazaar-Commercial. See the IaC Bazaar terms.

Usage code & full reference need an account

The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.

  • Usage
  • Inputs
  • Outputs
Create a free accountSign in

Related modules

Static validatedLive test pending

gcp-datastream

A stream is created NOT_STARTED and replicates nothing until somebody starts it; the source password is a literal in state unless it is a Secret Manager reference; public connectivity means the database admits Google's published ranges; and backfill_none is change capture with no history. Running from apply, private connection peered into your VPC, secret required, backfill on.

View module
Static validatedLive test pending

gcp-firestore

Type, location and CMEK cannot be changed after creation - getting one wrong means exporting every document into a new database and repointing every client. delete_protection defaults OFF, and Firestore has no snapshots: point-in-time recovery is the only way back and only covers incidents after it was enabled.

View module
Static validatedLive test pending

gcp-looker

A Looker (Google Cloud core) instance reachable over Private Service Connect from the VPCs you allow, no public address, sign-in limited to your email domains, encrypted with your Cloud KMS key, in a maintenance window you chose. The OAuth client secret is sensitive and never output; the edition has no default because the annual editions commit for a year.

View module
Live-tested

gcp-bigquery-dataset

Datasets with partitioned/clustered tables, authorized views, CMEK and dataset-level access controls.

View module
Live-tested

gcp-bigtable

A single-cluster Cloud Bigtable instance (one 1-node SSD cluster, the smallest footprint) plus a table with column families, IAM-only access, optional CMEK, and deletion protection on.

View module
Live-tested

gcp-cloud-sql

Regional-HA Cloud SQL with private IP (PSA/PSC), automated backups, PITR, read replicas and IAM database auth.

View module