diff --git a/modules/net-lb-app-ext/README.md b/modules/net-lb-app-ext/README.md
index 9d800b481..46afaec9b 100644
--- a/modules/net-lb-app-ext/README.md
+++ b/modules/net-lb-app-ext/README.md
@@ -1050,7 +1050,7 @@ After provisioning this change, and verifying that the new certificate is provis
| [project_id](variables.tf#L195) | Project id. | string | ✓ | |
| [address](variables.tf#L17) | Optional IP address used for the forwarding rule. | string | | null |
| [backend_buckets_config](variables.tf#L23) | Backend buckets configuration. | map(object({…})) | | {} |
-| [backend_service_configs](variables-backend-service.tf#L19) | Backend service level configuration. | map(object({…})) | | {} |
+| [backend_service_configs](variables-backend-service.tf#L19) | Backend service level configuration. | map(object({…})) })) | | {} |
| [description](variables.tf#L56) | Optional description used for resources. | string | | "Terraform managed." |
| [group_configs](variables.tf#L62) | Optional unmanaged groups to create. Can be referenced in backends via key or outputs. | map(object({…})) | | {} |
| [health_check_configs](variables-health-check.tf#L19) | Optional auto-created health check configurations, use the output self-link to set it in the auto healing policy. Refer to examples for usage. | map(object({…})) | | {…} |
diff --git a/modules/net-lb-app-ext/backend-service.tf b/modules/net-lb-app-ext/backend-service.tf
index acadda3bd..d736d26a4 100644
--- a/modules/net-lb-app-ext/backend-service.tf
+++ b/modules/net-lb-app-ext/backend-service.tf
@@ -257,6 +257,17 @@ resource "google_compute_backend_service" "default" {
content {
client_tls_policy = ss.value.client_tls_policy
subject_alt_names = ss.value.subject_alt_names
+
+ dynamic "aws_v4_authentication" {
+ for_each = ss.value.aws_v4_authentication == null ? [] : [""]
+
+ content {
+ access_key_id = ss.value.aws_v4_authentication.access_key_id
+ access_key = ss.value.aws_v4_authentication.access_key
+ access_key_version = ss.value.aws_v4_authentication.access_key_version
+ origin_region = ss.value.aws_v4_authentication.origin_region
+ }
+ }
}
}
}
diff --git a/modules/net-lb-app-ext/variables-backend-service.tf b/modules/net-lb-app-ext/variables-backend-service.tf
index e7290e5f5..7a431e10a 100644
--- a/modules/net-lb-app-ext/variables-backend-service.tf
+++ b/modules/net-lb-app-ext/variables-backend-service.tf
@@ -123,8 +123,13 @@ variable "backend_service_configs" {
security_settings = optional(object({
client_tls_policy = string
subject_alt_names = list(string)
- }))
- }))
+ aws_v4_authentication = optional(object({
+ access_key_id = optional(string)
+ access_key = optional(string)
+ access_key_version = optional(string)
+ origin_region = optional(string)
+ }))
+ })) }))
default = {}
nullable = false
validation {