Automate with Terraform

You can automate the Workload Identity Federation setup using Terraform instead of configuring it manually through the GCP Console and New Relic UI.

For the manual setup, see Manually integrate your Google Cloud Platform.

Before you begin

Terraform v1.0 or later installed
The New Relic Terraform provider configured
The Google Cloud Terraform provider configured
A GCP project with the required APIs enabled (see Requirements)

What Terraform configures

The Terraform configuration creates:

A GCP service account with Viewer, Service Usage Consumer, Cloud Asset Viewer, Folder Viewer (required only for integrations configured at the folder level).
A Workload Identity Pool with an OIDC provider pointing to New Relic
IAM bindings allowing New Relic to impersonate the service account
The New Relic cloud link connecting the GCP project

Example configuration

팁

This is a reference example. Adapt the values to your project, region, and New Relic account. A full working Terraform module is available in the Terraform Registry.

# Variables
variable "gcp_project_id" {}
variable "gcp_folder_id"  {}  # Required only for folder-level integrations
variable "nr_account_id" {}

# Service account
resource "google_service_account" "newrelic" {
  account_id   = "newrelic-gcp-integration"
  display_name = "New Relic GCP Integration"
  project      = var.gcp_project_id
}

resource "google_project_iam_member" "viewer" {
  project = var.gcp_project_id
  role    = "roles/viewer"
  member  = "serviceAccount:${google_service_account.newrelic.email}"
}

resource "google_project_iam_member" "service_usage" {
  project = var.gcp_project_id
  role    = "roles/serviceusage.serviceUsageConsumer"
  member  = "serviceAccount:${google_service_account.newrelic.email}"
}

resource "google_project_iam_member" "cloud_asset_viewer" {
  project = var.gcp_project_id
  role    = "roles/cloudasset.viewer"
  member  = "serviceAccount:${google_service_account.newrelic.email}"
}

# Required only for integrations configured at the folder level
resource "google_folder_iam_member" "folder_viewer" {
  folder = var.gcp_folder_id
  role   = "roles/resourcemanager.folderViewer"
  member = "serviceAccount:${google_service_account.newrelic.email}"
}

# Workload Identity Pool
resource "google_iam_workload_identity_pool" "newrelic" {
  workload_identity_pool_id = "newrelic-pool"
  display_name              = "New Relic Pool"
  project                   = var.gcp_project_id
}

# OIDC Provider
resource "google_iam_workload_identity_pool_provider" "newrelic" {
  workload_identity_pool_id          = google_iam_workload_identity_pool.newrelic.workload_identity_pool_id
  workload_identity_pool_provider_id = "newrelic-provider"
  display_name                       = "New Relic OIDC Provider"
  project                            = var.gcp_project_id

  attribute_mapping = {
    "google.subject"          = "assertion.sub"
    "attribute.nr_account_id" = "assertion.nr_account_id"
  }

  attribute_condition = "assertion.nr_account_id == '${var.nr_account_id}'"

  oidc {
    issuer_uri        = "https://oidc.newrelic.com/r/gcp-cmp"
    allowed_audiences = ["newrelic-gcp-integrations"]
  }
}

# Allow impersonation
resource "google_service_account_iam_member" "wif_binding" {
  service_account_id = google_service_account.newrelic.name
  role               = "roles/iam.workloadIdentityUser"
  member             = "principal://iam.googleapis.com/${google_iam_workload_identity_pool.newrelic.name}/attribute.nr_account_id/${var.nr_account_id}"
}

중요

Use the URL that matches your account region:

US: https://oidc.newrelic.com/r/gcp-cmp
EU: https://oidc.eu.newrelic.com/r/gcp-cmp
JP: https://oidc.jp.newrelic.com/r/gcp-cmp

See the Terraform official documentation for the full New Relic provider resources for cloud integrations.

Before you begin .css-21sua1{background:none;border:none;width:0;padding:0;}

What Terraform configures

Example configuration

팁

중요

Before you begin