HA VPN (Site-to-Site)

Name: HA VPN (Site-to-Site)
Brand: IaC Bazaar
SKU: gcp-ha-vpn
Price: 59.00 USD
Availability: InStock

99.99% SLA HA VPN gateway pair with BGP-dynamic routing - GCP-to-on-prem or GCP-to-AWS/Azure.

terraformGoogle Cloud#gcp

gcp-ha-vpnterraform v1.7

Verification

Live-tested

Really deployed to a cloud sandbox, verified against its outputs and assertions, then destroyed - with the teardown confirmed.

Conformance

Static validation (fmt · validate · tflint)
Security scan clean (Checkov)
Plan tests (mocked: validation rules · outputs)

Provenance

SHA-256 checksum
Cosign signature

Functional

Live-tested - applied, verified, destroyed

Last verified 2026-08-03 · how we verify

Verify this download

cosign · sha-256

Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.

# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub

# 2. This module's Sigstore bundle
curl -o gcp-ha-vpn-1.0.0.sigstore.json \
  https://www.iac-bazaar.com/api/artifacts/gcp-ha-vpn/signature

# 3. Verify the tarball you downloaded
cosign verify-blob \
  --key cosign.pub \
  --bundle gcp-ha-vpn-1.0.0.sigstore.json \
  gcp-ha-vpn-1.0.0.tar.gz
# → Verified OK

# 4. (optional) confirm the checksum too
echo "089bf88b49c3bec4143d0ce1657cdcbac2e56622e32503c531e868715ba2408f  gcp-ha-vpn-1.0.0.tar.gz" | sha256sum -c

Signature bundle Public key Machine-readable receipt How we verify

Use it from the registry

terraform · opentofu

module "ha_vpn" {
  source  = "www.iac-bazaar.com/iac-bazaar/gcp-ha-vpn/gcp"
  version = "1.0.0"
}

Paid module — needs a purchase (or a subscription that covers it) plus a registry token from /account/tokens. Full setup: registry docs.

Inputs & outputs

Create a free account to read this module's contract

The declared contract — every input name, type, default and description, plus every output — is shown to signed-in accounts, not to anonymous visitors.

A free account sees the contract of every Free module. This one is Professional, so its contract unlocks when you buy it.

Create a free account →Sign in

Documentation

gcp-ha-vpn

A 99.99%-SLA HA VPN gateway pair with BGP-dynamic routing — connect a GCP VPC to on-prem, AWS or Azure (peer_type = "external"), or to a second GCP VPC (peer_type = "gcp"). One module call builds the HA VPN gateway (two interfaces, two Google-assigned external IPs), a Cloud Router for BGP, the peer gateway, the redundant tunnels, the Cloud Router interfaces and the BGP sessions — with the BGP wiring (the buyer's main pain point) made explicit and validated. Works with Terraform and OpenTofu (>= 1.6), Google provider >= 7.0, < 8.0.

Status: static-validated, live-test pending. Validated with tofu validate + tflint + checkov against the hashicorp/google provider. Not yet applied against a live GCP project (no cloud sandbox), so it ships under live-test quarantine. The intended live test is GCP-to-GCP across two VPCs in one project (see examples/basic).

Design & secure defaults

HA topology by construction. The HA VPN gateway always exposes two interfaces; the tunnels map is intended to carry two tunnels (one per interface) so a single tunnel or interface failure does not drop the connection — the requirement for the 99.99% SLA.
BGP-dynamic routing. A Cloud Router runs BGP on the Google side. The local ASN is validated to be a private RFC6996 ASN. Per-session advertised_route_priority (MED) lets you make one tunnel active and one standby.
No BFD, by API design — GCP rejects BFD on VPN tunnel interfaces (BFD cannot be enabled on VPN Tunnel interfaces), so this module exposes no BFD knob; failover relies on BGP keepalives across the HA gateway pair.
IKEv2 only by default (ike_version = 2).
Secrets stay out of the topology. Pre-shared keys live in a separate tunnel_shared_secrets map marked sensitive; the non-sensitive tunnels map drives for_each, and secrets are looked up by key (Terraform cannot iterate a sensitive collection). Nothing is hardcoded.
Cross-field invariants enforced with precondition: an external peer requires a peer_external_gateway_interface on every tunnel; a GCP peer requires peer_gcp_gateway.

This module describes the Google side plus the peer-gateway object. On the remote side (on-prem / AWS / Azure, or the second GCP module) you configure the mirror-image tunnels, ASNs and link-local /30s.

Requirements

Requirement	Version
Terraform / OpenTofu	`>= 1.6`
`hashicorp/google`	`>= 7.0, < 8.0`

License

Commercial — LicenseRef-IaCBazaar-Commercial. See the IaC Bazaar terms.

Usage code & full reference unlock after purchase

The complete copy-paste usage, the full input/output reference, and operational notes ship with your licence - shown here and bundled in the download.

Usage
Inputs
Outputs

Related modules

Google Cloud✓ live-tested

Cloud NAT Gateway

A regional Cloud Router and Cloud NAT gateway giving private, external-IP-less instances outbound internet access, with auto-allocated NAT IPs, all-subnet coverage, and logging on by default.

$29.00v1.0.0

Google Cloud✓ live-tested

GCP VPC Network Foundation

Production VPC with subnets, secondary ranges, firewall rules, Cloud Router and Cloud NAT - the network base every GCP workload sits on.

$59.00v1.0.0