An IDS Endpoint that Is Actually Looking at Traffic
Creating the endpoint creates no packet mirroring policy, so an endpoint with nothing mirrored is provisioned, billed by the hour, shown with a green check and has never seen a packet. The mirroring policy is created with it and refused when it mirrors nothing. Cloud IDS detects and never blocks; blocks_traffic is an output that is always false.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-14 · how we verify
Use it from the registry
terraform · opentofumodule "cloud_ids" {
source = "www.iac-bazaar.com/iac-bazaar/gcp-cloud-ids/gcp"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads static-verified because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/gcp-cloud-ids?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Terraform module 1.0.0, static-verified on IaC Bazaar: [An IDS Endpoint that Is Actually Looking at Traffic](https://www.iac-bazaar.com/catalog/gcp-cloud-ids?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```hcl
module "cloud_ids" {
source = "www.iac-bazaar.com/iac-bazaar/gcp-cloud-ids/gcp"
version = "1.0.0"
}
```Preview:
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
gcp-cloud-ids
A Cloud IDS endpoint that is actually looking at traffic. Works with
Terraform and OpenTofu (>= 1.6), google provider >= 6.0, < 7.0.
The endpoint inspects only what is mirrored to it. Cloud IDS is a Palo Alto inspection engine that Google runs for you behind an internal load balancer. Traffic reaches it through a Packet Mirroring policy, and creating the endpoint creates no policy. An endpoint with no mirroring is fully provisioned, billed by the hour, shown in the console with a green check, and has never seen a packet. This module creates the mirroring policy alongside the endpoint and refuses one that mirrors nothing.
It detects. It does not block. There is no prevention mode: a threat is
written to Cloud Logging as a finding and the connection carries on.
Enforcement is a separate design - Cloud Armor in front, firewall rules, a
response pipeline reading the findings log. blocks_traffic is an output that
is always false, so nobody has to infer it from the product name.
severity is the floor, not a filter on what is inspected. Everything
mirrored is inspected; severity sets the lowest level that becomes a finding.
INFORMATIONAL turns every scan into a log line, which is how a findings feed
becomes something nobody reads. Default MEDIUM.
The VPC needs private services access. Once per VPC. Any VPC already
running Cloud SQL has it; create_private_service_access = true builds it for
one that does not.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
gcp-firewall-policy
A global network firewall policy exists independently of any network; an association puts it in the path, and a policy with a hundred rules and none governs nobody while rendering as fully configured. enable_logging defaults to false on every rule, so a deny that fires leaves no evidence. Refuses a policy with no network, logs every rule unless told not to, and counts the disabled ones.
gcp-service-perimeter
spec is the dry-run configuration and status is the enforced one - two blocks of the same shape, and a perimeter with only a spec is evaluated on every request, logs violations, and blocks nothing. Empty restricted_services is the other way to have none: the perimeter exists, covers the projects, and governs no API.
gcp-dlp
Sensitive Data Protection on a schedule: an inspection template naming the detectors and a weekly trigger over a bucket or a BigQuery table, sampling ten percent of each file, scanning only what changed since the last run, with findings written to your dataset without the matched values and a summary sent to Security Command Center. A full scan, billed per byte, is accepted by name.
gcp-recaptcha
A key with a testing score returns that score for every assessment, bots included - right for staging and, on a production key, a filter that filters nothing; allow_all_domains lets any site consume your assessments against your quota. Testing mode refused without acceptance, domains required on web keys, invisible scoring by default; only a backend assessment call turns a token into a decision.
gcp-secure-web-proxy
A gateway with no rules allows nothing, and a session matcher of true is an open proxy to the internet; the gateway needs a proxy-only subnet in the region that is yours to make; and without TLS inspection the proxy sees the SNI hostname and nothing inside. Rules built from a URL list of your hosts, allow-all accepted by name only, outputs that say what is allowed and that TLS is not inspected.
gcp-cloud-armor
A global Cloud Armor WAF policy with preconfigured OWASP SQLi and XSS rules enforcing by default, an optional per-client rate limit, and custom IP allow/deny rules - attachable to many backends.