/

Console

• English
• Deutsch
• Español – América Latina
• Français
• Português – Brasil
• 中文 – 简体
• 日本語
• 한국어

Sign in

• Apigee

Start free

Provision API hub using Terraform

This page explains how to provision API hub using Terraform for Google Cloud in Cloud Shell.

Terraform is an infrastructure-as-code tool that enables you to predictably create, change, and improve your cloud infrastructure by using code. For more information about using Terraform to provision infrastructure on Google Cloud, see Terraform on Google Cloud.

If you prefer to provision API hub using Google Cloud console, see Provision API hub in the Cloud console .

Before you begin

1. Prepare your development environment, either Cloud Shell or a local shell:

   Cloud Shell

   To use an online terminal with the gcloud CLI and Terraform already set up, activate Cloud Shell.

   At the bottom of this page, a Cloud Shell session starts and displays a command-line prompt. It can take a few seconds for the session to initialize.

   Note that Cloud Shell has Terraform already integrated.

   Local shell

   To use a local development environment, follow these steps:

   1. Install the Google Cloud CLI.

   2. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

   3. To initialize the gcloud CLI, run the following command:

      gcloud init

   4. Install Terraform.

2. Verify that billing is enabled for your Google Cloud project.

3. Enable the Cloud Resource Manager and Identity, Access Management (IAM) APIs:

   Roles required to enable APIs

   To enable APIs, you need the Service Usage Admin IAM role (roles/serviceusage.serviceUsageAdmin), which contains the serviceusage.services.enable permission. Learn how to grant roles.

   gcloud services enable cloudresourcemanager.googleapis.com  iam.googleapis.com

4. Ensure that your Google Cloud project doesn't have the Google Cloud Platform - Resource Location Restriction organization policy constraint added.
5. Optional: Configure VPC Service Controls.

Provision API hub using Terraform

To provision API hub using Terraform, complete the following steps:

1. Create a Terraform configuration file using the API hub resources.
2. Deploy the Terraform configuration.

Create a Terraform configuration file

To create a Terraform configuration file and define the API hub resources, do the following:

mkdir terraform && cd terraform && cat > main.tf

resource "google_project" "project" {
  name       = "PROJECT_NAME"
  project_id = "PROJECT_ID"
  org_id     = "ORG_ID"
  billing_account = "BILLING_ACCOUNT"
  deletion_policy = "DELETE"
}
resource "time_sleep" "wait_60_seconds" {
  create_duration = "60s"
  depends_on = [google_project.project]
}
          

resource "google_project_service" "apihub_service" {
  project = google_project.project.PROJECT_ID
  service = "apihub.googleapis.com"
  depends_on = [time_sleep.wait_60_seconds]
}
          

resource "google_apihub_host_project_registration" "apihub_host_project"{
  project = google_project.project.PROJECT_ID
  location = "HOST_PROJECT_LOCATION"
  host_project_registration_id = google_project.project.PROJECT_ID
  gcp_project = "projects/${google_project.project.PROJECT_ID}"
          
  depends_on = [google_project_service.apihub_service]
}
          

resource "google_project_service_identity" "apihub_service_identity" {
  project  = google_project.project.PROJECT_ID
  service  = "apihub.googleapis.com"
}
          

resource "google_project_iam_member" "apihub_service_identity_permission" {
  for_each = toset([
    "roles/apihub.admin",
    "roles/apihub.runtimeProjectServiceAgent"
  ])
  role    = each.key
  member  = "serviceAccount:${google_project_service_identity.apihub_service_identity.email}"
  depends_on = [google_project_service_identity.apihub_service_identity]
}
          

resource "google_project_service" "kms_service" {
  project = google_project.project.PROJECT_ID
  service = "cloudkms.googleapis.com"
  depends_on = [time_sleep.wait_60_seconds]
}
          

resource "google_project_iam_member" "apihub_service_identity_cmek_permission" {
  project    = google_project.project.PROJECT_ID
  role       = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
  member     = "serviceAccount:${google_project_service_identity.apihub_service_identity.email}"
  depends_on = [google_project_service_identity.apihub_service_identity]
}
        

resource "google_apihub_api_hub_instance" "apihub-instance-without-search"{
  location = "HUB_LOCATION"
  config {
      disable_search = SEMANTIC_SEARCH_BOOLEAN
  }
}
              

resource "google_apihub_api_hub_instance" "apihub-instance-search"{
  project = "PROJECT_ID"
  api_hub_instance_id = "API_HUB_INSTANCE_ID"
  description = "DESCRIPTION"
  location = "LOCATION"
  config {
      encryption_type = "CMEK"
      cmek_key_name = "projects/PROJECT_ID/locations/HUB_LOCATION/keyRings/KEY_RING_ID/cryptoKeys/KEY_ID"
      disable_search = SEMANTIC_SEARCH_BOOLEAN
      vertex_location = "VERTEX_AI_LOCATION"
  }
}