Terraform CI/CD with Google Cloud: Plan on Pull Request and Apply with Approval

A new technical guide outlines a comprehensive CI/CD strategy for managing Google Cloud infrastructure using Terraform, focusing on automation, security, and controlled deployments. The core of the solution revolves around integrating GitHub Actions with Google Cloud's Workload Identity Federation, a key security feature that allows GitHub Actions to authenticate to Google Cloud without relying on long-lived service account JSON keys. This significantly reduces the attack surface and simplifies credential management. The proposed workflow is structured around two main phases. The first phase automatically triggers a Terraform plan operation whenever a pull request is opened against the main branch. This allows development teams to review the exact infrastructure changes that would occur before they are merged, fostering collaboration and early detection of potential issues. The output of the `terraform plan` is posted directly to the pull request, providing immediate visibility into the impact of the proposed code. The second phase, the `terraform apply` operation, is designed with a critical manual approval gate. After a pull request is merged and the plan has been reviewed, the actual application of changes to the Google Cloud environment requires explicit manual approval within GitHub. This ensures that no infrastructure modifications are deployed without human oversight, providing a crucial safety net for production environments. This manual approval mechanism is particularly vital for preventing accidental or unauthorized deployments. The article also highlights the importance of remote Terraform state management and modular Terraform structures, which are foundational for scalable and maintainable infrastructure-as-code practices. By adopting this CI/CD pattern, organizations can achieve a more secure, auditable, and efficient way to manage their Google Cloud resources with Terraform, moving away from local `terraform apply` commands to a fully automated and controlled pipeline.