diff --git a/modules/artifact-registry/README.md b/modules/artifact-registry/README.md
index 96638798f..fcadbe8df 100644
--- a/modules/artifact-registry/README.md
+++ b/modules/artifact-registry/README.md
@@ -313,6 +313,7 @@ module "additive_iam" {
| [iam_bindings_additive](variables-iam.tf#L58) | Individual additive IAM bindings. Keys are arbitrary. | map(object({…})) | | {} |
| [iam_by_principals](variables-iam.tf#L73) | Authoritative IAM binding in {PRINCIPAL => [ROLES]} format. Principals need to be statically defined to avoid cycle errors. Merged internally with the `iam` variable. | map(list(string)) | | {} |
| [labels](variables.tf#L206) | Labels to be attached to the registry. | map(string) | | {} |
+| [tag_bindings](variables.tf#L227) | Tag bindings for this repository, in key => tag value id format. | map(string) | | {} |
## Outputs
diff --git a/modules/artifact-registry/main.tf b/modules/artifact-registry/main.tf
index aa47cbbbe..7a3d31d28 100644
--- a/modules/artifact-registry/main.tf
+++ b/modules/artifact-registry/main.tf
@@ -1,5 +1,5 @@
/**
- * Copyright 2024 Google LLC
+ * Copyright 2025 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -217,3 +217,10 @@ resource "google_artifact_registry_repository" "registry" {
}
}
+
+resource "google_tags_location_tag_binding" "binding" {
+ for_each = var.tag_bindings
+ parent = "//artifactregistry.googleapis.com/${google_artifact_registry_repository.registry.id}"
+ location = var.location
+ tag_value = each.value
+}
diff --git a/modules/artifact-registry/variables.tf b/modules/artifact-registry/variables.tf
index 102b8374a..2d979eee1 100644
--- a/modules/artifact-registry/variables.tf
+++ b/modules/artifact-registry/variables.tf
@@ -223,3 +223,10 @@ variable "project_id" {
description = "Registry project id."
type = string
}
+
+variable "tag_bindings" {
+ description = "Tag bindings for this repository, in key => tag value id format."
+ type = map(string)
+ nullable = false
+ default = {}
+}
diff --git a/modules/compute-vm/README.md b/modules/compute-vm/README.md
index 610f6713b..bd15894fc 100644
--- a/modules/compute-vm/README.md
+++ b/modules/compute-vm/README.md
@@ -991,7 +991,7 @@ module "sole-tenancy" {
| [service_account_email](outputs.tf#L73) | Service account email. | |
| [service_account_iam_email](outputs.tf#L78) | Service account email. | |
| [template](outputs.tf#L87) | Template resource. | |
-| [template_name](outputs.tf#L92) | Template name. | |
+| [template_name](outputs.tf#L96) | Template name. | |
## Fixtures
diff --git a/modules/compute-vm/outputs.tf b/modules/compute-vm/outputs.tf
index dc5a80266..79551b84a 100644
--- a/modules/compute-vm/outputs.tf
+++ b/modules/compute-vm/outputs.tf
@@ -86,10 +86,18 @@ output "service_account_iam_email" {
output "template" {
description = "Template resource."
- value = try(google_compute_instance_template.default[0], null)
+ value = (
+ local.template_regional
+ ? try(google_compute_region_instance_template.default[0], null)
+ : try(google_compute_instance_template.default[0], null)
+ )
}
output "template_name" {
description = "Template name."
- value = try(google_compute_instance_template.default[0].name, null)
+ value = (
+ local.template_regional
+ ? try(google_compute_region_instance_template.default[0].name, null)
+ : try(google_compute_instance_template.default[0].name, null)
+ )
}
diff --git a/modules/compute-vm/template.tf b/modules/compute-vm/template.tf
index 5e5bc2fc5..c1f548c19 100644
--- a/modules/compute-vm/template.tf
+++ b/modules/compute-vm/template.tf
@@ -332,13 +332,6 @@ resource "google_compute_region_instance_template" "default" {
}
}
- dynamic "network_interface" {
- for_each = var.network_attached_interfaces
- content {
- network_attachment = network_interface.value
- }
- }
-
scheduling {
automatic_restart = !var.options.spot
instance_termination_action = local.termination_action
diff --git a/modules/secret-manager/README.md b/modules/secret-manager/README.md
index 59806f3d4..489517ad8 100644
--- a/modules/secret-manager/README.md
+++ b/modules/secret-manager/README.md
@@ -192,8 +192,9 @@ module "secret-manager" {
| [project_id](variables.tf#L29) | Project id where the keyring will be created. | string | ✓ | |
| [iam](variables.tf#L17) | IAM bindings in {SECRET => {ROLE => [MEMBERS]}} format. | map(map(list(string))) | | {} |
| [labels](variables.tf#L23) | Optional labels for each secret. | map(map(string)) | | {} |
-| [secrets](variables.tf#L34) | Map of secrets to manage, their optional expire time, version destroy ttl, locations and KMS keys in {LOCATION => KEY} format. {GLOBAL => KEY} format enables CMEK for automatic managed secrets. If locations is null, automatic management will be set. | map(object({…})) | | {} |
-| [versions](variables.tf#L45) | Optional versions to manage for each secret. Version names are only used internally to track individual versions. | map(map(object({…}))) | | {} |
+| [project_number](variables.tf#L34) | Project number of var.project_id. Set this to avoid permadiffs when creating tag bindings. | string | | null |
+| [secrets](variables.tf#L40) | Map of secrets to manage, their optional expire time, version destroy ttl, locations and KMS keys in {LOCATION => KEY} format. {GLOBAL => KEY} format enables CMEK for automatic managed secrets. If locations is null, automatic management will be set. | map(object({…})) | | {} |
+| [versions](variables.tf#L52) | Optional versions to manage for each secret. Version names are only used internally to track individual versions. | map(map(object({…}))) | | {} |
## Outputs
diff --git a/modules/secret-manager/main.tf b/modules/secret-manager/main.tf
index ecd96808c..a81d9ba53 100644
--- a/modules/secret-manager/main.tf
+++ b/modules/secret-manager/main.tf
@@ -1,5 +1,5 @@
/**
- * Copyright 2023 Google LLC
+ * Copyright 2025 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -25,6 +25,15 @@ locals {
}
]
])
+ tag_bindings = merge([
+ for k, v in var.secrets : {
+ for kk, vv in v.tag_bindings : "${k}/${kk}" => {
+ parent = "//secretmanager.googleapis.com/projects/${coalesce(var.project_number, var.project_id)}/secrets/${google_secret_manager_secret.default[k].secret_id}"
+ tag_value = vv
+ }
+ }
+ if v.tag_bindings != null
+ ]...)
version_pairs = flatten([
for secret, versions in var.versions : [
for name, attrs in versions : merge(attrs, { name = name, secret = secret })
@@ -96,3 +105,9 @@ resource "google_secret_manager_secret_iam_binding" "default" {
secret_id = google_secret_manager_secret.default[each.value.secret].id
members = each.value.members
}
+
+resource "google_tags_tag_binding" "binding" {
+ for_each = local.tag_bindings
+ parent = each.value.parent
+ tag_value = each.value.tag_value
+}
diff --git a/modules/secret-manager/variables.tf b/modules/secret-manager/variables.tf
index 8008809eb..3ed8d5761 100644
--- a/modules/secret-manager/variables.tf
+++ b/modules/secret-manager/variables.tf
@@ -1,5 +1,5 @@
/**
- * Copyright 2023 Google LLC
+ * Copyright 2025 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -31,12 +31,19 @@ variable "project_id" {
type = string
}
+variable "project_number" {
+ description = "Project number of var.project_id. Set this to avoid permadiffs when creating tag bindings."
+ type = string
+ default = null
+}
+
variable "secrets" {
description = "Map of secrets to manage, their optional expire time, version destroy ttl, locations and KMS keys in {LOCATION => KEY} format. {GLOBAL => KEY} format enables CMEK for automatic managed secrets. If locations is null, automatic management will be set."
type = map(object({
expire_time = optional(string)
locations = optional(list(string))
keys = optional(map(string))
+ tag_bindings = optional(map(string))
version_destroy_ttl = optional(string)
}))
default = {}