Memorystore Redis/Valkey

gcp-memorystore

A private Memorystore cache on your VPC — Valkey (the 2026-current google_memorystore_instance path), classic Redis (google_redis_instance), or a sharded Redis cluster (google_redis_cluster) — selected by a single flavor variable. One module call gives you a cache that is private, TLS-encrypted, auth-protected and deletion-protected by default. Works with Terraform and OpenTofu (>= 1.6), Google provider >= 7.0, < 8.0.

Status: static-validated, live-test pending. Validated with tofu validate + tflint + checkov against the hashicorp/google provider. Not yet applied against a live GCP project (no cloud sandbox; a real instance takes 5–10 min to provision), so it ships under live-test quarantine.

Design & secure defaults

• Private connectivity only. Valkey and Redis-cluster attach to your VPC via PSC auto-connection; classic Redis defaults to connect_mode = PRIVATE_SERVICE_ACCESS. No public endpoint is ever exposed.
• TLS in transit on (transit_encryption_enabled = true) → SERVER_AUTHENTICATION. The per-flavor enum spelling is handled for you.
• Auth on (iam_auth_enabled = true): IAM auth for Valkey / Redis-cluster, OSS Redis AUTH (auth_string) for classic Redis, which has no IAM-auth mode.
• Resilient placement: MULTI_ZONE distribution and replica_count = 1 by default.
• Durable: RDB persistence on by default so data survives a restart.
• Deletion protection on by default.

The flavor switch is exactly one resource — the module never creates more than one cache.

Requirements

Requirement	Version
Terraform / OpenTofu	>= 1.6
hashicorp/google	>= 7.0, < 8.0

License

Commercial — LicenseRef-IaCBazaar-Commercial. See the IaC Bazaar terms.