Imperva For Google Cloud Platform Terraform Module

Provisions Imperva For Google Cloud Platform resources for a given Application Load Balancer.

• Terraform 0.13+
• Google Cloud Platform account and project ID.
• Service account with the necessary permissions
• Pre-existing Forwarding Rules and VPC/Subnet setup.

Requirements

Name	Version
terraform	>= 1.3.0
google	~> 6.45

Providers

Name	Version
google	~> 6.45

Modules

No modules.

Resources

Name	Type
google_compute_backend_service.imperva_connector_backend_global	resource
google_compute_region_backend_service.imperva_connector_backend	resource
google_compute_region_network_endpoint_group.imperva_connector_neg	resource
google_network_services_lb_traffic_extension.imperva_traffic_extension_global	resource
google_network_services_lb_traffic_extension.imperva_traffic_extension_regional	resource
google_compute_forwarding_rule.forwarding_rule	data source
google_compute_global_forwarding_rule.forwarding_rule	data source

Inputs

Name	Description	Type	Default	Required
project_id	project id to create resources in	any	n/a	yes
global_backend_service_name	Custom name for the global Backend Service. If not set, the name is generated automatically based on prefix, key, and optional suffix.	string	null	no
global_network_services_lb_traffic_extension_name	Custom name for the global Network Services LB Traffic Extension. If not set, the name is generated automatically and truncated to meet GCP length requirements.	string	null	no
global_resources	List of regional traffic extensions	list(object({ load_balancing_scheme = optional(string, "EXTERNAL_MANAGED") authority_header = string forwarding_rules = list(string) load_balancer_name = string cel_expression = optional(string, "true") timeout = optional(string, "1.0s") fail_open = optional(bool, false) imperva_backends = list(object({ region = string network = string subnet = string psc_target_service = optional(string) suffix_name = optional(string) })) supported_events = optional(list(string), [ "REQUEST_HEADERS", "REQUEST_BODY", "REQUEST_TRAILERS", "RESPONSE_HEADERS", "RESPONSE_BODY", "RESPONSE_TRAILERS" ]) labels = optional(map(string), { created_by = "terraform" }) extention_metadata = optional(map(string), {}) }))	[]	no
network_endpoint_group_name	Custom name for the regional Network Endpoint Group (NEG). If not set, the name is generated automatically based on prefix, region, and optional suffix.	string	null	no
network_services_lb_traffic_extension_name	Custom name for the regional Network Services LB Traffic Extension. If not set, the name is generated automatically and truncated to meet GCP length requirements.	string	null	no
prefix	Default prefix for all resources.	string	"imperva"	no
region_backend_service_name	Custom name for the regional Backend Service. If not set, the name is generated automatically based on prefix, region, and optional suffix.	string	null	no
regional_resources	List of regional traffic extensions	list(object({ region = string network = string subnet = string psc_target_service = optional(string) load_balancing_scheme = optional(string, "EXTERNAL_MANAGED") authority_header = string forwarding_rules = list(string) load_balancer_name = string cel_expression = optional(string, "true") timeout = optional(string, "1.0s") fail_open = optional(bool, false) suffix_name = optional(string) supported_events = optional(list(string), [ "REQUEST_HEADERS", "REQUEST_BODY", "REQUEST_TRAILERS", "RESPONSE_HEADERS", "RESPONSE_BODY", "RESPONSE_TRAILERS" ]) labels = optional(map(string), { created_by = "terraform" }) extention_metadata = optional(map(string), {}) }))	[]	no

Outputs

Name	Description
imperva_global_backend_services	Imperva For Google Cloud Platform Regional Backend Services
imperva_network_endpoint_groups	Imperva For Google Cloud Platform Network Endpoint Groups
imperva_regional_backend_services	Imperva For Google Cloud Platform Regional Backend Services
protected_forwarding_rules	Forwarding rules protected by Imperva For Google Cloud Platform

Parameters - Explained

Key	Type	Description
load_balancer_name	string	Name of the Traffic Extension.
traffic_extension_description	string	Optional description for the Traffic Extension.
cel_expression	string	CEL expression to match requests. CEL Reference
timeout	string	Timeout duration (e.g., 1.0s).
fail_open	bool	Whether to allow requests to continue if the extension call fails.
supported_events	list(string)	Events the extension should process. Valid values: REQUEST_HEADERS, REQUEST_BODY, RESPONSE_HEADERS, RESPONSE_BODY, REQUEST_TRAILERS, RESPONSE_TRAILERS.
labels	map(string)	Key-value labels to apply to created resources.
region	string	Region of the Load Balancer and extension resources.
network	string	VPC network of the Load Balancer.
subnet	string	Subnet used by the Load Balancer and extension resources.
psc_target_service	string	Fully qualified name of the Private Service Connect attachment target (provided by Imperva).
load_balancing_scheme	string	Load balancing scheme: EXTERNAL_MANAGED, INTERNAL_MANAGED.
authority_header	string	The authority header used for the extension. Provided by Imperva.
forwarding_rules	list(string)	Names of the forwarding rules to attach this extension to.
prefix	string	Default prefix for all resources.
For global resources region, network, subnet and psc_target_service are provided via imperva_backends map, so multiple regions can be attached to the global resource.

Traffic Extension Metadata (extention_metadata)

The extention_metadata field allows you to pass custom key-value pairs as metadata to the traffic extension. This metadata is merged with system-defined values (lb-id and project-id) and sent via HTTP2 to the Imperva extension processor. Example usage:

regional_resources = [
  {
    load_balancer_name    = "unique-load-balancer-name"
    region                = "us-west2"
    network               = "vpc-network"
    subnet                = "subnet"
    authority_header      = "imperva-authority-header.cplcloud.com"
    forwarding_rules      = ["your-regional-forwarding-rule"]
    extention_metadata    = {
      custom_key1 = "custom_value1"
      custom_key2 = "custom_value2"
    }
  }
]

If not specified, extention_metadata defaults to an empty map.

Usage - Example

module "imperva_for_google_cloud_platform" {
  source = "./imperva-for-google-cloud-platform"

  project_id = "your-gcp-project-id"

  regional_resources = [
    {
      load_balancer_name    = "unique-load-balancer-name"
      region                = "us-west2"
      network               = "vpc-network"
      subnet                = "subnet"
      authority_header      = "imperva-authority-header.cplcloud.com"
      forwarding_rules      = ["your-regional-forwarding-rule"]
    }
  ]

  global_resources = [
    {
      load_balancer_name     = "unique-global-load-balancer-name"
      authority_header       = "imperva-authority-header.cplcloud.com"
      forwarding_rules       = ["your-global-forwarding-rule1"]
      imperva_backends       = [
        {
          region             = "us-west2"
          network            = "vpc-network"
          subnet             = "subnet-uwe2"
        },
        {
          region             = "us-east1"
          network            = "vpc-network"
          subnet             = "subnet-uea1"
        }
      ]
    }
  ]