gcp-demo-tf-template

A zero-configuration Terraform project that verifies whether the GCP credentials present in the environment are valid — using nothing but terraform plan and read-only permissions.

No variables need to be supplied. No state is written. Nothing is created.

terraform init
terraform plan

Exit code 0 means the credentials are valid. Exit code 1 means they are not, and the error says why.

Why data sources and not resources

terraform plan never calls a create API, so a resource block proves nothing about a credential — a plan over managed resources succeeds even with no credentials at all. Data sources are the opposite: Terraform reads them during plan, so each one is a live, authenticated API call. That is why this project declares only data sources.

What gets checked

#	Check	Data source	Needs
1	A credential exists and its key material can mint an OAuth2 access token	google_client_config	nothing beyond a credential
2	That token is accepted by Google and maps to a live principal	google_client_openid_userinfo	the userinfo.email scope, which the provider requests by default
3	The principal can read the target project	google_project	resourcemanager.projects.get (covered by roles/viewer)
4	The principal can read a service API beyond Resource Manager (opt-in)	google_compute_zones	compute.zones.list and the Compute Engine API enabled

Checks 1 and 2 always run. Check 3 runs only when a project is resolvable — if none is, the plan still succeeds but emits a warning saying project access was not verified, so a partial check never reads as a clean pass. Check 4 is off by default because it depends on API enablement, which is a project setting rather than a credential problem, and would otherwise report a false negative.

Every check is a read. The plan succeeds against a credential holding nothing but roles/viewer.

Credential resolution

Credentials are intentionally not set in the config. The provider resolves them from the environment in its normal order:

1. GOOGLE_CREDENTIALS or GOOGLE_APPLICATION_CREDENTIALS — path to a key file, or inline JSON
2. gcloud application-default credentials (gcloud auth application-default login)
3. The metadata server, on GCE / GKE / Cloud Run / Cloud Build

The project is resolved from var.project_id if set, otherwise from GOOGLE_PROJECT, GOOGLE_CLOUD_PROJECT, GCLOUD_PROJECT or CLOUDSDK_CORE_PROJECT. Note that the provider does not read gcloud config set project; export GOOGLE_PROJECT instead.

Variables

All have defaults — none are required.

Variable	Default	Purpose
project_id	""	Project to check. Empty falls back to the environment.
region	us-central1	Provider region, and the region for check 4.
zone	us-central1-a	Provider zone.
enable_compute_check	false	Turns on check 4.

Outputs

Output	Description
identity	The principal the credentials resolve to
project_id	The project the provider resolved, or empty
project_number	Project number read from Resource Manager, or null
checks_run	Which checks actually ran — anything absent was skipped, not passed

Because there are no resources, terraform plan prints these values directly.

Use in CI

terraform init -input=false
terraform plan -input=false -detailed-exitcode

With -detailed-exitcode, 0 and 2 both mean the credentials are valid (2 simply means the outputs are new); 1 means credential failure.

To fail the build when project access could not be checked, treat the check-block warning as fatal:

terraform plan -input=false -json | grep -q '"@level":"warn"' && exit 1

Requirements

• Terraform >= 1.5.7 (verified against 1.5.7; uses check blocks, added in 1.5)
• hashicorp/google ~> 7.0

.terraform.lock.hcl is committed so provider selection is reproducible.