A Published Service that Decides Who May Connect
ACCEPT_AUTOMATIC admits any project on Google Cloud that knows the attachment URI, which is not a secret and appears in logs. Manual by default with a per-consumer connection limit; an empty accept list is refused too. PROXY protocol is on so backends see the consumer rather than the NAT range, removed consumers are disconnected, and the NAT subnet is created with the attachment.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-14 · how we verify
Use it from the registry
terraform · opentofumodule "private_service_connect" {
source = "www.iac-bazaar.com/iac-bazaar/gcp-private-service-connect/gcp"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
gcp-private-service-connect
A Private Service Connect producer that decides who may connect. Works with
Terraform and OpenTofu (>= 1.6), google provider >= 6.0, < 7.0.
ACCEPT_AUTOMATIC accepts any project on Google Cloud. A service
attachment publishes an internal load balancer to consumers in other VPCs,
and connection_preference decides who: manual admits the projects and
networks on the accept list, each with a connection limit; automatic admits
every consumer that knows the attachment's URI - which is not a secret and
appears in logs. Manual by default here; automatic needs
accept_any_consumer, and manual with an empty list is refused too.
Without PROXY protocol the backend sees the NAT address. Consumer traffic
arrives from the NAT subnet, so backends see nothing about who sent it. On
by default; off needs accept_no_client_address and backends that were not
told to expect the header.
The NAT subnet is part of the product. Its size is the concurrent consumer budget and it cannot be resized in place. Created here as a /24 unless existing PSC subnets are given.
reconcile_connections is on, so removing a project from the accept list
disconnects its existing endpoints rather than leaving them attached.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
gcp-network-connectivity-center
A hub with no spokes connects nothing; a VPC spoke advertises every subnet to every other spoke unless told otherwise, which is how a sandbox learns the production database range; and site-to-site data transfer routes branches through Google at its rates. Spokes come with the hub, each VPC spoke narrows its exports or says why not, and branch transit is off unless accepted.
gcp-cloud-nat
A regional Cloud Router and Cloud NAT gateway giving private, external-IP-less instances outbound internet access, with auto-allocated NAT IPs, all-subnet coverage, and logging on by default.
gcp-vpc
Production VPC with subnets, secondary ranges, firewall rules, Cloud Router and Cloud NAT - the network base every GCP workload sits on.
gcp-ha-vpn
99.99% SLA HA VPN gateway pair with BGP-dynamic routing - GCP-to-on-prem or GCP-to-AWS/Azure.
gcp-interconnect
An interconnect is a private path, not a private conversation: traffic crosses the colocation facility and the partner in clear unless the attachment carries HA VPN. One attachment is no SLA, and a partner attachment is created disabled until somebody flips it. A redundant pair across two edge availability domains, IPsec by default with clear text accepted by name, and enabled unless told.
gcp-shared-vpc
Attaching a service project is the visible half: its instances land in a shared subnet only when the creating principal holds networkUser on that subnet, and for GKE, Cloud Run or Dataflow that principal is the service agent, not a person. Takes the per-subnet grants with the attachments, refuses a project attached with none, and adds the host-level grant GKE needs.