---
title: Automate with Terraform
source: https://docs.newrelic.com/docs/infrastructure/google-cloud-platform-integrations/get-started/install-and-configure/connect-gcp-workload-identity-federation-terraform
---

You can automate the Workload Identity Federation setup using Terraform instead of configuring it manually through the GCP Console and New Relic UI.

For the manual setup, see [Manually integrate your Google Cloud Platform](https://docs.newrelic.com/docs/infrastructure/google-cloud-platform-integrations/get-started/install-and-configure/connect-gcp-workload-identity-federation).

## Before you begin [#before-you-begin]

-   Terraform v1.0 or later installed
-   The New Relic Terraform provider configured
-   The Google Cloud Terraform provider configured
-   A GCP project with the required APIs enabled (see [Requirements](https://docs.newrelic.com/docs/infrastructure/google-cloud-platform-integrations/get-started/install-and-configure/connect-gcp-workload-identity-federation#requirements))

## What Terraform configures [#what-terraform-configures]

The Terraform configuration creates:

-   A GCP service account with **Viewer**, **Service Usage Consumer**, **Cloud Asset Viewer**, **Folder Viewer** (required only for integrations configured at the folder level).
-   A Workload Identity Pool with an OIDC provider pointing to New Relic
-   IAM bindings allowing New Relic to impersonate the service account
-   The New Relic cloud link connecting the GCP project

## Example configuration [#example]

> #### 💡 TIP
>
> This is a reference example. Adapt the values to your project, region, and New Relic account. A full working Terraform module is available in the Terraform Registry.

```hcl
# Variables
variable "gcp_project_id" {}
variable "gcp_folder_id"  {}  # Required only for folder-level integrations
variable "nr_account_id" {}

# Service account
resource "google_service_account" "newrelic" {
  account_id   = "newrelic-gcp-integration"
  display_name = "New Relic GCP Integration"
  project      = var.gcp_project_id
}

resource "google_project_iam_member" "viewer" {
  project = var.gcp_project_id
  role    = "roles/viewer"
  member  = "serviceAccount:${google_service_account.newrelic.email}"
}

resource "google_project_iam_member" "service_usage" {
  project = var.gcp_project_id
  role    = "roles/serviceusage.serviceUsageConsumer"
  member  = "serviceAccount:${google_service_account.newrelic.email}"
}

resource "google_project_iam_member" "cloud_asset_viewer" {
  project = var.gcp_project_id
  role    = "roles/cloudasset.viewer"
  member  = "serviceAccount:${google_service_account.newrelic.email}"
}

# Required only for integrations configured at the folder level
resource "google_folder_iam_member" "folder_viewer" {
  folder = var.gcp_folder_id
  role   = "roles/resourcemanager.folderViewer"
  member = "serviceAccount:${google_service_account.newrelic.email}"
}

# Workload Identity Pool
resource "google_iam_workload_identity_pool" "newrelic" {
  workload_identity_pool_id = "newrelic-pool"
  display_name              = "New Relic Pool"
  project                   = var.gcp_project_id
}

# OIDC Provider
resource "google_iam_workload_identity_pool_provider" "newrelic" {
  workload_identity_pool_id          = google_iam_workload_identity_pool.newrelic.workload_identity_pool_id
  workload_identity_pool_provider_id = "newrelic-provider"
  display_name                       = "New Relic OIDC Provider"
  project                            = var.gcp_project_id

  attribute_mapping = {
    "google.subject"          = "assertion.sub"
    "attribute.nr_account_id" = "assertion.nr_account_id"
  }

  attribute_condition = "assertion.nr_account_id == '${var.nr_account_id}'"

  oidc {
    issuer_uri        = "https://oidc.newrelic.com/r/gcp-cmp"
    allowed_audiences = ["newrelic-gcp-integrations"]
  }
}

# Allow impersonation
resource "google_service_account_iam_member" "wif_binding" {
  service_account_id = google_service_account.newrelic.name
  role               = "roles/iam.workloadIdentityUser"
  member             = "principal://iam.googleapis.com/${google_iam_workload_identity_pool.newrelic.name}/attribute.nr_account_id/${var.nr_account_id}"
}
```

> #### ⚠️ IMPORTANT
>
> Use the URL that matches your account region:
>
> -   US: `https://oidc.newrelic.com/r/gcp-cmp`
> -   EU: `https://oidc.eu.newrelic.com/r/gcp-cmp`
> -   JP: `https://oidc.jp.newrelic.com/r/gcp-cmp`

/\*
\## After applying \[#after-applying]

After \`terraform apply\` completes, you still need to:

1\. Download the WIF configuration JSON from GCP (the \*\*Connected Service Accounts\*\* section in the pool).
2\. Upload the JSON file in New Relic to complete the link, or use the NerdGraph API to link the account programmatically.

\*/

See the [Terraform official documentation](https://registry.terraform.io/providers/newrelic/newrelic/latest/docs/guides/cloud_integrations_guide) for the full New Relic provider resources for cloud integrations.