Issue a certificate using Terraform

Learn how to use Terraform with Certificate Authority Service to do the following:

  • Create a CA pool and a root CA in the new CA pool.
  • Create a CA pool and a subordinate CA within it which is signed by the root CA
  • Generate a new Certificate Signing Request (CSR).
  • Use the generated CSR to request a certificate from the CA pool that contains the subordinate CA.

Terraform is an open-source software that lets you create and manage your CA Service resources using its infrastructure-as-code paradigm. This quickstart uses the Google Cloud Terraform Provider for Terraform.

To follow step-by-step guidance for this task directly in the Google Cloud console, click Guide me:

Guide me

Before you begin

Make sure that you have the CA Service Admin (roles/privateca.admin) IAM role. If you don't have this IAM role, read Grant a single role for information about granting this role.

Create a Google Cloud project

  1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  3. Verify that billing is enabled for your Google Cloud project.

  4. Enable the CA Service API.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the API

  5. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  6. Verify that billing is enabled for your Google Cloud project.

  7. Enable the CA Service API.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the API

    8.

Install the Google Cloud CLI

If you haven't already, install the Google Cloud CLI. When prompted, choose the project that you selected or created earlier.

If you already have the Google Cloud CLI installed, update it by running the gcloud components update command:

gcloud components update

Terraform configuration sample

provider "google" {}
provider