Terraform 및 Firebase 시작하기

이 구성 파일 예시의 주석이 달린 버전 보기

리소스로써의 프로젝트 및 앱 인프라에 관해 잘 모른다면 다음 문서를 검토하세요.

• Firebase 프로젝트 이해
• Firebase 프로젝트 관리를 위한 참조 문서

# Terraform configuration to set up providers by version.
...

# Configures the provider to use the resource block's specified project for quota checks.
...

# Configures the provider to not use the resource block's specified project for quota checks.
...

# Creates a new Google Cloud project.
resource "google_project" "default" {
  # Use the provider that enables the setup of quota checks for a new project
  provider   = google-beta.no_user_project_override

  name            = "Project Display Name"        // learn more about the project name
  project_id      = "project-id-for-new-project"  // learn more about the project ID
  # Required for any service that requires the Blaze pricing plan
  # (like Firebase Authentication with GCIP)
  billing_account = "000000-000000-000000"

  # Required for the project to display in any list of Firebase projects.
  labels = {
    "firebase" = "enabled"  // learn more about the Firebase-enabled label
  }
}

# Enables required APIs.
resource "google_project_service" "default" {
  # Use the provider without quota checks for enabling APIS
  provider = google-beta.no_user_project_override
  project  = google_project.default.project_id
  for_each = toset([
    "cloudbilling.googleapis.com",
    "cloudresourcemanager.googleapis.com",
    "firebase.googleapis.com",
    # Enabling the ServiceUsage API allows the new project to be quota checked from now on.
    "serviceusage.googleapis.com",
  ])
  service = each.key

  # Don't disable the service if the resource block is removed by accident.
  disable_on_destroy = false
}

# Enables Firebase services for the new project created above.
# This action essentially "creates a Firebase project" and allows the project to use
# Firebase services (like Firebase Authentication) and
# Firebase tooling (like the Firebase console).
# Learn more about the relationship between Firebase projects and Google Cloud.
resource "google_firebase_project" "default" {
  # Use the provider that performs quota checks from now on
  provider = google-beta

  project  = google_project.default.project_id

  # Waits for the required APIs to be enabled.
  depends_on = [
    google_project_service.default
  ]
}

# Creates a Firebase Android App in the new project created above.
# Learn more about the relationship between Firebase Apps and Firebase projects.
resource "google_firebase_android_app" "default" {
  provider = google-beta

  project      = google_project.default.project_id
  display_name = "My Awesome Android app"  # learn more about an app's display name
  package_name = "awesome.package.name"    # learn more about an app's package name

  # Wait for Firebase to be enabled in the Google Cloud project before creating this App.
  depends_on = [
    google_firebase_project.default,
  ]
}

GCIP로 Firebase 인증 설정

이 구성은 새 Google Cloud 프로젝트를 만들고, 프로젝트를 Cloud Billing 계정에 연결하고(GCIP를 사용한 Firebase 인증에 Blaze 요금제를 사용해야 함), 프로젝트에 Firebase 서비스를 사용 설정하며, GCIP를 통해 Firebase 인증을 설정하고 프로젝트에 세 가지 앱 유형을 등록합니다.

Terraform을 통해 Firebase 인증을 설정하려면 GCIP를 사용 설정해야 합니다.

# Creates a new Google Cloud project.
resource "google_project" "auth" {
  provider  = google-beta.no_user_project_override
  folder_id = "folder-id-for-new-project"
  name            = "Project Display Name"
  project_id      = "project-id-for-new-project"

  # Associates the project with a Cloud Billing account
  # (required for Firebase Authentication with GCIP).
  billing_account = "000000-000000-000000"

  # Required for the project to display in a list of Firebase projects.
  labels = {
    "firebase" = "enabled"
  }
}

# Enables required APIs.
resource "google_project_service" "auth" {
  provider = google-beta.no_user_project_override
  project  = google_project.auth.project_id
  for_each = toset([
    "cloudbilling.googleapis.com",
    "cloudresourcemanager.googleapis.com",
    "serviceusage.googleapis.com",
    "identitytoolkit.googleapis.com",
  ])
  service = each.key

  # Don't disable the service if the resource block is removed by accident.
  disable_on_destroy = false
}

# Enables Firebase services for the new project created above.
resource "google_firebase_project" "auth" {
  provider = google-beta
  project  = google_project.auth.project_id

  depends_on = [
    google_project_service.auth,
  ]
}

# Creates an Identity Platform config.
# Also enables Firebase Authentication with Identity Platform in the project if not.
resource "google_identity_platform_config" "auth" {
  provider = google-beta
  project  = google_project.auth.project_id

  # For example, you can configure to auto-delete Anonymous users.
  autodelete_anonymous_users = true

  # Wait for identitytoolkit.googleapis.com to be enabled before initializing Authentication.
  depends_on = [
    google_project_service.auth,
  ]
}

# Adds more configurations, like for the email/password sign-in provider.
resource "google_identity_platform_project_default_config" "auth" {
  provider = google-beta
  project  = google_project.auth.project_id
  sign_in {
    allow_duplicate_emails = false

    anonymous {
      enabled = true
    }

    email {
      enabled           = true
      password_required = false
    }
  }

  # Wait for Authentication to be initialized before enabling email/password.
  depends_on = [
    google_identity_platform_config.auth
  ]
}

# Creates a Firebase Android App in the new project created above.
resource "google_firebase_android_app" "auth" {
  provider     = google-beta
  project      = google_project.auth.project_id
  display_name = "My Android app"
  package_name = "android.package.name"

  # Wait for Firebase to be enabled in the Google Cloud project before creating this App.
  depends_on = [
    google_firebase_project.auth,
  ]
}

# Creates a Firebase Apple-platforms App in the new project created above.
resource "google_firebase_apple_app" "auth" {
  provider     = google-beta
  project      = google_project.auth.project_id
  display_name = "My Apple app"
  bundle_id    = "apple.app.12345"

  # Wait for Firebase to be enabled in the Google Cloud project before creating this App.
  depends_on = [
    google_firebase_project.auth,
  ]
}

# Creates a Firebase Web App in the new project created above.
resource "google_firebase_web_app" "auth" {
  provider     = google-beta
  project      = google_project.auth.project_id
  display_name = "My Web app"

  # The other App types (Android and Apple) use "DELETE" by default.
  # Web apps don't use "DELETE" by default due to backward-compatibility.
  deletion_policy = "DELETE"

  # Wait for Firebase to be enabled in the Google Cloud project before creating this App.
  depends_on = [
    google_firebase_project.auth,
  ]
}

기본 Firebase 실시간 데이터베이스 인스턴스 프로비저닝

이 구성은 새 Google Cloud 프로젝트를 만들고, 프로젝트에 Firebase 서비스를 사용 설정하고, 프로젝트의 기본 실시간 데이터베이스 인스턴스를 프로비저닝하며, 프로젝트에 세 가지 앱 유형을 등록합니다.

# Creates a new Google Cloud project.
resource "google_project" "rtdb" {
  provider   = google-beta.no_user_project_override
  folder_id  = "folder-id-for-new-project"
  name       = "Project Display Name"
  project_id = "project-id-for-new-project"

  # Required for the project to display in a list of Firebase projects.
  labels = {
    "firebase" = "enabled"
  }
}

# Enables required APIs.
resource "google_project_service" "rtdb" {
  provider = google-beta.no_user_project_override
  project  = google_project.rtdb.project_id
  for_each = toset([
    "serviceusage.googleapis.com",
    "cloudresourcemanager.googleapis.com",
    "firebasedatabase.googleapis.com",
  ])
  service = each.key

  # Don't disable the service if the resource block is removed by accident.
  disable_on_destroy = false
}

# Enables Firebase services for the new project created above.
resource "google_firebase_project" "rtdb" {
  provider = google-beta
  project  = google_project.rtdb.project_id
}

# Provisions the default Realtime Database default instance.
resource "google_firebase_database_instance" "database" {
  provider    = google-beta
  project     = google_project.rtdb.project_id
  # See available locations: https://firebase.google.com/docs/projects/locations#rtdb-locations
  region      = "name-of-region"
  # This value will become the first segment of the database's URL.
  instance_id = "${google_project.rtdb.project_id}-default-rtdb"
  type        = "DEFAULT_DATABASE"

  # Wait for Firebase to be enabled in the Google Cloud project before initializing Realtime Database.
  depends_on = [
    google_firebase_project.rtdb,
  ]
}

# Creates a Firebase Android App in the new project created above.
resource "google_firebase_android_app" "rtdb" {
  provider     = google-beta
  project      = google_project.rtdb.project_id
  display_name = "My Android app"
  package_name = "android.package.name"

  # Wait for Firebase to be enabled in the Google Cloud project before creating this App.
  depends_on = [
    google_firebase_project.rtdb,
  ]
}

# Creates a Firebase Apple-platforms App in the new project created above.
resource "google_firebase_apple_app" "rtdb" {
  provider     = google-beta
  project      = google_project.rtdb.project_id
  display_name = "My Apple app"
  bundle_id    = "apple.app.12345"

  # Wait for Firebase to be enabled in the Google Cloud project before creating this App.
  depends_on = [
    google_firebase_project.rtdb,
  ]
}

# Creates a Firebase Web App in the new project created above.
resource "google_firebase_web_app" "rtdb" {
  provider     = google-beta
  project      = google_project.rtdb.project_id
  display_name = "My Web app"

  # The other App types (Android and Apple) use "DELETE" by default.
  # Web apps don't use "DELETE" by default due to backward-compatibility.
  deletion_policy = "DELETE"

  # Wait for Firebase to be enabled in the Google Cloud project before creating this App.
  depends_on = [
    google_firebase_project.rtdb,
  ]
}

여러 Firebase 실시간 데이터베이스 인스턴스 프로비저닝

이 구성은 새 Google Cloud 프로젝트를 만들고, 프로젝트를 Cloud Billing 계정에 연결하고(여러 개의 실시간 데이터베이스 인스턴스에 Blaze 요금제를 사용해야 함), 프로젝트에 Firebase 서비스를 사용 설정하며, 여러 개의 실시간 데이터베이스 인스턴스(프로젝트의 기본 실시간 데이터베이스 인스턴스 포함)를 프로비저닝하고 프로젝트에 세 가지 앱 유형을 등록합니다.

# Creates a new Google Cloud project.
resource "google_project" "rtdb-multi" {
  provider   = google-beta.no_user_project_override
  folder_id  = "folder-id-for-new-project"
  name       = "Project Display Name"
  project_id = "project-id-for-new-project"

  # Associate the project with a Cloud Billing account
  # (required for multiple Realtime Database instances).
  billing_account = "000000-000000-000000"

  # Required for the project to display in a list of Firebase projects.
  labels = {
    "firebase" = "enabled"
  }
}

# Enables required APIs.
resource "google_project_service" "rtdb-multi" {
  provider = google-beta.no_user_project_override
  project  = google_project.rtdb-multi.project_id
  for_each = toset([
    "cloudbilling.googleapis.com",
    "serviceusage.googleapis.com",
    "cloudresourcemanager.googleapis.com",
    "firebasedatabase.googleapis.com",
  ])
  service = each.key

  # Don't disable the service if the resource block is removed by accident.
  disable_on_destroy = false
}

# Enables Firebase services for the new project created above.
resource "google_firebase_project" "rtdb-multi" {
  provider = google-beta
  project  = google_project.rtdb-multi.project_id
}

# Provisions the default Realtime Database default instance.
resource "google_firebase_database_instance" "database-default" {
  provider    = google-beta
  project     = google_project.rtdb-multi.project_id
  # See available locations: https://firebase.google.com/docs/projects/locations#rtdb-locations
  region      = "name-of-region"
  # This value will become the first segment of the database's URL.
  instance_id = "${google_project.rtdb-multi.project_id}-default-rtdb"
  type        = "DEFAULT_DATABASE"

  # Wait for Firebase to be enabled in the Google Cloud project before initializing Realtime Database.
  depends_on = [
    google_firebase_project.rtdb-multi,
  ]
}

# Provisions an additional Realtime Database instance.
resource "google_firebase_database_instance" "database-additional" {
  provider    = google-beta
  project     = google_project.rtdb-multi.project_id
  # See available locations: https://firebase.google.com/docs/projects/locations#rtdb-locations
  # This location doesn't need to be the same as the default database instance.
  region      = "name-of-region"
  # This value will become the first segment of the database's URL.
  instance_id = "name-of-additional-database-instance"
  type        = "USER_DATABASE"

  # Wait for Firebase to be enabled in the Google Cloud project before initializing Realtime Database.
  depends_on = [
    google_firebase_project.rtdb-multi,
  ]
}

# Creates a Firebase Android App in the new project created above.
resource "google_firebase_android_app" "rtdb-multi" {
  provider     = google-beta
  project      = google_project.rtdb-multi.project_id
  display_name = "My Android app"
  package_name = "android.package.name"

  # Wait for Firebase to be enabled in the Google Cloud project before creating this App.
  depends_on = [
    google_firebase_project.rtdb-multi,
  ]
}

# Creates a Firebase Apple-platforms App in the new project created above.
resource "google_firebase_apple_app" "rtdb-multi" {
  provider     = google-beta
  project      = google_project.rtdb-multi.project_id
  display_name = "My Apple app"
  bundle_id    = "apple.app.12345"

  # Wait for Firebase to be enabled in the Google Cloud project before creating this App.
  depends_on = [
    google_firebase_project.rtdb-multi,
  ]
}

# Creates a Firebase Web App in the new project created above.
resource "google_firebase_web_app" "rtdb-multi" {
  provider     = google-beta
  project      = google_project.rtdb-multi.project_id
  display_name = "My Web app"

  # The other App types (Android and Apple) use "DELETE" by default.
  # Web apps don't use "DELETE" by default due to backward-compatibility.
  deletion_policy = "DELETE"

  # Wait for Firebase to be enabled in the Google Cloud project before creating this App.
  depends_on = [
    google_firebase_project.rtdb-multi,
  ]
}

Cloud Firestore 인스턴스 프로비저닝

이 구성은 새 Google Cloud 프로젝트를 만들고, 프로젝트에 Firebase 서비스를 사용 설정하고, 프로젝트의 Cloud Firestore 인스턴스를 프로비저닝하며, 프로젝트에 세 가지 앱 유형을 등록합니다.

또한 Cloud Firestore 인스턴스에 대한 Firebase 보안 규칙을 프로비저닝하고, Cloud Firestore 색인을 만들며, 시드 데이터가 있는 Cloud Firestore 문서를 추가합니다.

# Creates a new Google Cloud project.
resource "google_project" "firestore" {
  provider   = google-beta.no_user_project_override
  folder_id  = "folder-id-for-new-project"
  name       = "Project Display Name"
  project_id = "project-id-for-new-project"

  # Required for the project to display in a list of Firebase projects.
  labels = {
    "firebase" = "enabled"
  }
}

# Enables required APIs.
resource "google_project_service" "firestore" {
  provider = google-beta.no_user_project_override
  project  = google_project.firestore.project_id
  for_each = toset([
    "cloudresourcemanager.googleapis.com",
    "serviceusage.googleapis.com",
    "firestore.googleapis.com",
    "firebaserules.googleapis.com",
  ])
  service = each.key

  # Don't disable the service if the resource block is removed by accident.
  disable_on_destroy = false
}

# Enables Firebase services for the new project created above.
resource "google_firebase_project" "firestore" {
  provider = google-beta
  project  = google_project.firestore.project_id
}

# Provisions the Firestore database instance.
resource "google_firestore_database" "firestore" {
  provider                    = google-beta
  project                     = google_project.firestore.project_id
  name                        = "(default)"
  # See available locations: https://firebase.google.com/docs/projects/locations#default-cloud-location
  location_id                 = "name-of-region"
  # "FIRESTORE_NATIVE" is required to use Firestore with Firebase SDKs, authentication, and Firebase Security Rules.
  type                        = "FIRESTORE_NATIVE"
  concurrency_mode            = "OPTIMISTIC"

  # Wait for Firebase to be enabled in the Google Cloud project before initializing Firestore.
  depends_on = [
    google_firebase_project.firestore,
  ]
}

# Creates a ruleset of Firestore Security Rules from a local file.
resource "google_firebaserules_ruleset" "firestore" {
  provider = google-beta
  project  = google_project.firestore.project_id
  source {
    files {
      name = "firestore.rules"
      # Write security rules in a local file named "firestore.rules".
      # Learn more: https://firebase.google.com/docs/firestore/security/get-started
      content = file("firestore.rules")
    }
  }

  # Wait for Firestore to be provisioned before creating this ruleset.
  depends_on = [
    google_firestore_database.firestore,
  ]
}

# Releases the ruleset for the Firestore instance.
resource "google_firebaserules_release" "firestore" {
  provider     = google-beta
  name         = "cloud.firestore"  # must be cloud.firestore
  ruleset_name = google_firebaserules_ruleset.firestore.name
  project      = google_project.firestore.project_id

  # Wait for Firestore to be provisioned before releasing the ruleset.
  depends_on = [
    google_firestore_database.firestore,
  ]
}

# Adds a new Firestore index.
resource "google_firestore_index" "indexes" {
  provider = google-beta
  project  = google_project.firestore.project_id

  collection  = "quiz"
  query_scope = "COLLECTION"

  fields {
    field_path = "question"
    order      = "ASCENDING"
  }

  fields {
    field_path = "answer"
    order      = "ASCENDING"
  }

  # Wait for Firestore to be provisioned before adding this index.
  depends_on = [
    google_firestore_database.firestore,
  ]
}

# Adds a new Firestore document with seed data.
# Don't use real end-user or production data in this seed document.
resource "google_firestore_document" "doc" {
  provider    = google-beta
  project     = google_project.firestore.project_id
  collection  = "quiz"
  document_id = "question-1"
  fields      = "{\"question\":{\"stringValue\":\"Favorite Database\"},\"answer\":{\"stringValue\":\"Firestore\"}}"

  # Wait for Firestore to be provisioned before adding this document.
  depends_on = [
    google_firestore_database.firestore,
  ]
}

# Creates a Firebase Android App in the new project created above.
resource "google_firebase_android_app" "firestore" {
  provider     = google-beta
  project      = google_project.firestore.project_id
  display_name = "My Android app"
  package_name = "android.package.name"

  # Wait for Firebase to be enabled in the Google Cloud project before creating this App.
  depends_on = [
    google_firebase_project.firestore,
  ]
}

# Creates a Firebase Apple-platforms App in the new project created above.
resource "google_firebase_apple_app" "firestore" {
  provider     = google-beta
  project      = google_project.firestore.project_id
  display_name = "My Apple app"
  bundle_id    = "apple.app.12345"

  # Wait for Firebase to be enabled in the Google Cloud project before creating this App.
  depends_on = [
    google_firebase_project.firestore,
  ]
}

# Creates a Firebase Web App in the new project created above.
resource "google_firebase_web_app" "firestore" {
  provider     = google-beta
  project      = google_project.firestore.project_id
  display_name = "My Web app"

  # The other App types (Android and Apple) use "DELETE" by default.
  # Web apps don't use "DELETE" by default due to backward-compatibility.
  deletion_policy = "DELETE"

  # Wait for Firebase to be enabled in the Google Cloud project before creating this App.
  depends_on = [
    google_firebase_project.firestore,
  ]
}

이는 firestore.rules라는 로컬 파일에 있어야 하는 Cloud Firestore 보안 규칙의 규칙 세트입니다.

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    allow read: if request.auth != null;
    allow create: if request.auth != null;
    allow update: if request.auth != null;
  }
}

기본 Cloud Storage 버킷 프로비저닝

이 구성은 새 Google Cloud 프로젝트를 만들고, 프로젝트에 Firebase 서비스를 사용 설정하고, 프로젝트의 기본 Cloud Storage 버킷을 프로비저닝하며, 프로젝트에 세 가지 앱 유형을 등록합니다.

또한 Cloud Storage 버킷에 대한 Firebase 보안 규칙을 프로비저닝하고 버킷에 파일을 업로드합니다.

# Creates a new Google Cloud project.
resource "google_project" "storage" {
  provider   = google-beta.no_user_project_override
  folder_id  = "folder-id-for-new-project"
  name       = "Project Display Name"
  project_id = "project-id-for-new-project"

  # Required for the project to display in a list of Firebase projects.
  labels = {
    "firebase" = "enabled"
  }
}

# Enables required APIs.
resource "google_project_service" "storage" {
  provider = google-beta.no_user_project_override
  project  = google_project.storage.project_id
  for_each = toset([
    "serviceusage.googleapis.com",
    "cloudresourcemanager.googleapis.com",
    "firebaserules.googleapis.com",
    "firebasestorage.googleapis.com",
    "storage.googleapis.com",
  ])
  service = each.key

  # Don't disable the service if the resource block is removed by accident.
  disable_on_destroy = false
}

# Enables Firebase services for the new project created above.
resource "google_firebase_project" "storage" {
  provider = google-beta
  project  = google_project.storage.project_id
}

# Provisions the default Cloud Storage bucket for the project via Google App Engine.
resource "google_app_engine_application" "default" {
  provider    = google-beta
  project     = google_project.storage.project_id
  # See available locations: https://firebase.google.com/docs/projects/locations#default-cloud-location
  # This will set the location for the default Storage bucket and the App Engine App.
  location_id = "name-of-region-for-default-bucket"

  # If you use Firestore, uncomment this to make sure Firestore is provisioned first.
  # depends_on = [
    # google_firestore_database.firestore
  # ]
}

# Makes the default Storage bucket accessible for Firebase SDKs, authentication, and Firebase Security Rules.
resource "google_firebase_storage_bucket" "default-bucket" {
  provider  = google-beta
  project   = google_project.storage.project_id
  bucket_id = google_app_engine_application.default.default_bucket
}

# Creates a ruleset of Cloud Storage Security Rules from a local file.
resource "google_firebaserules_ruleset" "storage" {
  provider = google-beta
  project  = google_project.storage.project_id
  source {
    files {
      # Write security rules in a local file named "storage.rules".
      # Learn more: https://firebase.google.com/docs/storage/security/get-started
      name    = "storage.rules"
      content = file("storage.rules")
    }
  }

  # Wait for the default Storage bucket to be provisioned before creating this ruleset.
  depends_on = [
    google_firebase_project.storage,
  ]
}

# Releases the ruleset to the default Storage bucket.
resource "google_firebaserules_release" "default-bucket" {
  provider     = google-beta
  name         = "firebase.storage/${google_app_engine_application.default.default_bucket}"
  ruleset_name = "projects/${google_project.storage.project_id}/rulesets/${google_firebaserules_ruleset.storage.name}"
  project      = google_project.storage.project_id
}

# Uploads a new file to the default Storage bucket.
# Don't use real end-user or production data in this file.
resource "google_storage_bucket_object" "cat-picture" {
  provider = google-beta
  name     = "cat.png"
  source   = "path/to/cat.png"
  bucket   = google_app_engine_application.default.default_bucket
}

# Creates a Firebase Android App in the new project created above.
resource "google_firebase_android_app" "storage" {
  provider     = google-beta
  project      = google_project.storage.project_id
  display_name = "My Android app"
  package_name = "android.package.name"

  # Wait for Firebase to be enabled in the Google Cloud project before creating this App.
  depends_on = [
    google_firebase_project.storage,
  ]
}

# Creates a Firebase Apple-platforms App in the new project created above.
resource "google_firebase_apple_app" "storage" {
  provider     = google-beta
  project      = google_project.storage.project_id
  display_name = "My Apple app"
  bundle_id    = "apple.app.12345"

  # Wait for Firebase to be enabled in the Google Cloud project before creating this App.
  depends_on = [
    google_firebase_project.storage,
  ]
}

# Creates a Firebase Web App in the new project created above.
resource "google_firebase_web_app" "storage" {
  provider     = google-beta
  project      = google_project.storage.project_id
  display_name = "My Web app"

  # The other App types (Android and Apple) use "DELETE" by default.
  # Web apps don't use "DELETE" by default due to backward-compatibility.
  deletion_policy = "DELETE"

  # Wait for Firebase to be enabled in the Google Cloud project before creating this App.
  depends_on = [
    google_firebase_project.storage,
  ]
}

이는 storage.rules라는 로컬 파일에 있어야 하는 Cloud Storage 보안 규칙의 규칙 세트입니다.

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read, write: if request.auth != null;
    }
  }
}

여러 Cloud Storage 버킷 프로비저닝

이 구성은 새 Google Cloud 프로젝트를 만들고, 프로젝트를 Cloud Billing 계정에 연결하고(여러 개의 버킷에 Blaze 요금제를 사용해야 함), 프로젝트에 Firebase 서비스를 사용 설정하며, 여러 개의 Cloud Storage 버킷(프로젝트의 기본 Cloud Storage 버킷 포함)을 프로비저닝하고 프로젝트에 세 가지 앱 유형을 등록합니다.

또한 Cloud Storage 버킷에 대한 Firebase 보안 규칙을 프로비저닝하고 기본 Cloud Storage 버킷에 파일을 업로드합니다.

# Creates a new Google Cloud project.
resource "google_project" "storage-multi" {
  provider  = google-beta.no_user_project_override
  folder_id = "folder-id-for-new-project"
  name            = "Project Display Name"
  project_id      = "project-id-for-new-project"

  # Associates the project with a Cloud Billing account
  # (required for multiple Cloud Storage buckets).
  billing_account = "000000-000000-000000"

  # Required for the project to display in a list of Firebase projects.
  labels = {
    "firebase" = "enabled"
  }
}

# Enables required APIs.
resource "google_project_service" "storage-multi" {
  provider = google-beta.no_user_project_override
  project  = google_project.storage-multi.project_id
  for_each = toset([
    "cloudbilling.googleapis.com",
    "serviceusage.googleapis.com",
    "cloudresourcemanager.googleapis.com",
    "firebaserules.googleapis.com",
    "firebasestorage.googleapis.com",
    "storage.googleapis.com",
  ])
  service = each.key

  # Don't disable the service if the resource block is removed by accident.
  disable_on_destroy = false
}

# Enables Firebase services for the new project created above.
resource "google_firebase_project" "storage-multi" {
  provider = google-beta
  project  = google_project.storage-multi.project_id
}

# Provisions the default Cloud Storage bucket for the project via Google App Engine.
resource "google_app_engine_application" "default-multi" {
  provider = google-beta
  project  = google_project.storage-multi.project_id
  # See available locations: https://firebase.google.com/docs/projects/locations#default-cloud-location
  # This will set the location for the default Storage bucket and the App Engine App.
  location_id = "name-of-region-for-default-bucket"

  # If you use Firestore, uncomment this to make sure Firestore is provisioned first.
  # depends_on = [
  # google_firestore_database.firestore
  # ]
}

# Provisions an additional Cloud Storage bucket.
# Additional Cloud Storage buckets are not provisioned via App Engine.
resource "google_storage_bucket" "bucket-multi" {
  provider = google-beta
  project  = google_project.storage-multi.project_id
  name     = "name-of-additional-storage-bucket"
  # See available locations: https://cloud.google.com/storage/docs/locations#available-locations
  # This location does not need to be the same as the default Storage bucket.
  location = "name-of-region-for-additional-bucket"
}

# Makes the default Storage bucket accessible for Firebase SDKs, authentication, and Firebase Security Rules.
resource "google_firebase_storage_bucket" "default-bucket-multi" {
  provider  = google-beta
  project   = google_project.storage-multi.project_id
  bucket_id = google_app_engine_application.default-multi.default_bucket
}

# Makes the additional Storage bucket accessible for Firebase SDKs, authentication, and Firebase Security Rules.
resource "google_firebase_storage_bucket" "bucket-multi" {
  provider  = google-beta
  project   = google_project.storage-multi.project_id
  bucket_id = google_storage_bucket.bucket-multi.name
}

# Creates a ruleset of Firebase Security Rules from a local file.
resource "google_firebaserules_ruleset" "storage-multi" {
  provider = google-beta
  project  = google_project.storage-multi.project_id
  source {
    files {
      # Write security rules in a local file named "storage.rules"
      # Learn more: https://firebase.google.com/docs/storage/security/get-started
      name    = "storage.rules"
      content = file("storage.rules")
    }
  }

  # Wait for the Storage buckets to be provisioned before creating this ruleset.
  depends_on = [
    google_firebase_project.storage-multi,
  ]
}

# Releases the ruleset to the default Storage bucket.
resource "google_firebaserules_release" "default-bucket-multi" {
  provider     = google-beta
  name         = "firebase.storage/${google_app_engine_application.default-multi.default_bucket}"
  ruleset_name = "projects/${google_project.storage-multi.project_id}/rulesets/${google_firebaserules_ruleset.storage-multi.name}"
  project      = google_project.storage-multi.project_id
}

# Releases the ruleset to the additional Storage bucket.
resource "google_firebaserules_release" "bucket-multi" {
  provider     = google-beta
  name         = "firebase.storage/${google_storage_bucket.bucket-multi.name}"
  ruleset_name = "projects/${google_project.storage-multi.project_id}/rulesets/${google_firebaserules_ruleset.storage-multi.name}"
  project      = google_project.storage-multi.project_id
}

# Uploads a new file to the default Storage bucket.
# Do not use real end-user or production data in this file.
resource "google_storage_bucket_object" "cat-picture-multi" {
  provider = google-beta
  name     = "cat.png"
  source   = "path/to/cat.png"
  bucket   = google_app_engine_application.default-multi.default_bucket
}

# Creates a Firebase Android App in the new project created above.
resource "google_firebase_android_app" "storage-multi" {
  provider     = google-beta
  project      = google_project.storage-multi.project_id
  display_name = "My Android app"
  package_name = "android.package.name"

  # Wait for Firebase to be enabled in the Google Cloud project before creating this App.
  depends_on = [
    google_firebase_project.storage-multi,
  ]
}

# Creates a Firebase Apple-platforms App in the new project created above.
resource "google_firebase_apple_app" "storage-multi" {
  provider     = google-beta
  project      = google_project.storage-multi.project_id
  display_name = "My Apple app"
  bundle_id    = "apple.app.12345"

  # Wait for Firebase to be enabled in the Google Cloud project before creating this App.
  depends_on = [
    google_firebase_project.storage-multi,
  ]
}

# Creates a Firebase Web App in the new project created above.
resource "google_firebase_web_app" "storage-multi" {
  provider     = google-beta
  project      = google_project.storage-multi.project_id
  display_name = "My Web app"

  # The other App types (Android and Apple) use "DELETE" by default.
  # Web apps don't use "DELETE" by default due to backward-compatibility.
  deletion_policy = "DELETE"

  # Wait for Firebase to be enabled in the Google Cloud project before creating this App.
  depends_on = [
    google_firebase_project.storage-multi,
  ]
}

이는 storage.rules라는 로컬 파일에 있어야 하는 Cloud Storage 보안 규칙의 규칙 세트입니다.

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read, write: if request.auth != null;
    }
  }
}

Cloud Firestore 인스턴스 및 기본 Cloud Storage 버킷 프로비저닝

이 구성은 새 Google Cloud 프로젝트를 만들고, 프로젝트에 Firebase 서비스를 사용 설정하고, Cloud Firestore 인스턴스를 프로비저닝한 다음 기본 Cloud Storage 버킷을 프로비저닝합니다.

또한 Cloud Firestore 인스턴스 및 기본 Cloud Storage 버킷에 대한 Firebase 보안 규칙을 프로비저닝합니다.

# Creates a new Google Cloud project.
resource "google_project" "fs" {  # fs = Firestore + Storage
  provider   = google-beta.no_user_project_override
  folder_id  = "folder-id-for-new-project"
  name       = "Project Display Name"
  project_id = "project-id-for-new-project"

  # Required for the project to display in a list of Firebase projects.
  labels = {
    "firebase" = "enabled"
  }
}

# Enables required APIs.
resource "google_project_service" "fs" {
  provider = google-beta.no_user_project_override
  project  = google_project.fs.project_id
  for_each = toset([
    "serviceusage.googleapis.com",
    "cloudresourcemanager.googleapis.com",
    "firebaserules.googleapis.com",
    "firebasestorage.googleapis.com",
    "storage.googleapis.com",
    "firestore.googleapis.com",
  ])
  service = each.key

  # Don't disable the service if the resource block is removed by accident
  disable_on_destroy = false
}

# Enables Firebase services for the new project created above.
resource "google_firebase_project" "fs" {
  provider = google-beta
  project  = google_project.fs.project_id

}

#### Set up Firestore before default Cloud Storage bucket ####

# Provisions the Firestore database instance.
resource "google_firestore_database" "firestore-fs" {
  provider         = google-beta
  project          = google_project.fs.project_id
  name             = "(default)"
  # See available locations: https://firebase.google.com/docs/projects/locations#default-cloud-location
  location_id      = "name-of-region"
  # "FIRESTORE_NATIVE" is required to use Firestore with Firebase SDKs, authentication, and Firebase Security Rules.
  type             = "FIRESTORE_NATIVE"
  concurrency_mode = "OPTIMISTIC"

  # Wait for Firebase to be enabled in the Google Cloud project before initializing Firestore.
  depends_on = [
    google_firebase_project.fs,
  ]
}

# Creates a ruleset of Firestore Security Rules from a local file.
resource "google_firebaserules_ruleset" "firestore-fs" {
  provider = google-beta
  project  = google_project.fs.project_id
  source {
    files {
      # Write security rules in a local file named "firestore.rules".
      # Learn more: https://firebase.google.com/docs/firestore/security/get-started
      name = "firestore.rules"
      content = file("firestore.rules")
    }
  }

  # Wait for Firestore to be provisioned before creating this ruleset.
  depends_on = [
    google_firestore_database.firestore-fs
  ]
}

# Releases the ruleset for the Firestore instance.
resource "google_firebaserules_release" "firestore-fs" {
  provider     = google-beta
  name         = "cloud.firestore" # must be cloud.firestore
  ruleset_name = google_firebaserules_ruleset.firestore-fs.name
  project      = google_project.fs.project_id

  # Wait for Firestore to be provisioned before releasing the ruleset.
  depends_on = [
    google_firestore_database.firestore-fs,
  ]
}

#### Set up default Cloud Storage default bucket after Firestore ####

# Provisions the default Cloud Storage bucket for the project via Google App Engine.
resource "google_app_engine_application" "default-bucket-fs" {
  provider    = google-beta
  project     = google_project.fs.project_id
  # See available locations: https://firebase.google.com/docs/projects/locations#default-cloud-location
  # This will set the location for the default Storage bucket and the App Engine App.
  location_id = "name-of-region"  # Must be in the same location as Firestore (above)

  # Wait for Firestore to be provisioned first.
  # Otherwise, the Firestore instance will be provisioned in Datastore mode (unusable by Firebase).
  depends_on = [
    google_firestore_database.firestore-fs,
  ]
}

# Makes the default Storage bucket accessible for Firebase SDKs, authentication, and Firebase Security Rules.
resource "google_firebase_storage_bucket" "default-bucket-fs" {
  provider  = google-beta
  project   = google_project.fs.project_id
  bucket_id = google_app_engine_application.default-bucket-fs.default_bucket
}

# Creates a ruleset of Cloud Storage Security Rules from a local file.
resource "google_firebaserules_ruleset" "default-bucket-fs" {
  provider = google-beta
  project  = google_project.fs.project_id
  source {
    files {
      # Write security rules in a local file named "storage.rules".
      # Learn more: https://firebase.google.com/docs/storage/security/get-started
      name    = "storage.rules"
      content = file("storage.rules")
    }
  }

  # Wait for the Cloud Storage bucket to be provisioned before creating this ruleset.
  depends_on = [
    google_firebase_project.fs,
  ]
}

# Releases the ruleset to the default Storage bucket.
resource "google_firebaserules_release" "default-bucket-fs" {
  provider     = google-beta
  name         = "firebase.storage/${google_app_engine_application.default-bucket-fs.default_bucket}"
  ruleset_name = "projects/${google_project.fs.project_id}/rulesets/${google_firebaserules_ruleset.default-bucket-fs.name}"
  project      = google_project.fs.project_id
}

이는 firestore.rules라는 로컬 파일에 있어야 하는 Cloud Firestore 보안 규칙의 규칙 세트입니다.

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    allow read: if request.auth != null;
    allow create: if request.auth != null;
    allow update: if request.auth != null;
  }
}

이는 storage.rules라는 로컬 파일에 있어야 하는 Cloud Storage 보안 규칙의 규칙 세트입니다.

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read, write: if request.auth != null;
    }
  }
}

다양한 프로젝트 관련 속성(예: project, user_project_override)에 대해 자세히 알아보세요.

이 가이드에서는 '프로젝트'를 수행할 때 다음 Terraform 속성을 사용합니다.

resource 블록 내 project

권장: 가능하면 각 resource 블록 내에 project 속성을 포함하세요.

프로젝트 속성을 포함하면 Terraform은 지정된 프로젝트 내의 리소스 블록에 지정된 인프라를 만듭니다. 이 가이드와 샘플 구성 파일은 모두 이 방법을 사용합니다.

project에 대한 공식 Terraform 문서를 참조하세요.

provider 블록 내 user_project_override

대부분의 리소스 프로비저닝은 user_project_override = true를 사용해야 합니다. 즉, 자체 Firebase 프로젝트와 비교하여 할당량을 확인합니다. 그러나 할당량 확인을 허용할 수 있도록 새 프로젝트를 설정하려면 먼저 user_project_override = false를 사용해야 합니다.

user_project_override에 대한 공식 Terraform 문서를 참조하세요.

generic::permission_denied: Firebase Tos Not Accepted 오류가 발생합니다.

gcloud CLI 명령어를 실행하는 데 사용하는 사용자 계정이 Firebase 서비스 약관에 동의했는지 확인합니다.

• 사용자 계정으로 로그인한 브라우저를 사용하고 Firebase Console에서 기존 Firebase 프로젝트를 확인하면 됩니다. 기존 Firebase 프로젝트를 볼 수 있으면 사용자 계정이 Firebase 서비스 약관에 동의한 것입니다.

• 기존 Firebase 프로젝트를 볼 수 없는 경우 사용자 계정이 Firebase 서비스 약관에 동의하지 않은 것일 수 있습니다. 이 문제를 해결하려면 Firebase Console을 통해 새 Firebase 프로젝트를 만들고 프로젝트 생성 과정에서 Firebase 서비스 약관에 동의합니다. 콘솔의 프로젝트 설정에서 이 프로젝트를 즉시 삭제할 수 있습니다.

terraform apply를 실행한 후 generic::permission_denied: IAM authority does not have the permission 오류가 발생합니다.

몇 분 정도 기다린 후 terraform apply를 다시 실행해 봅니다.

리소스 생성에 실패했지만 terraform apply를 다시 실행하면 ALREADY_EXISTS가 표시됩니다.

이는 여러 시스템의 전파 지연으로 인해 발생할 수 있습니다. terraform import를 실행하여 Terraform 상태로 리소스를 가져와 이 문제를 해결해 보세요. 그런 다음 terraform apply를 다시 실행해 보세요.

Terraform 문서의 '가져오기' 섹션에서 각 리소스를 가져오는 방법을 알아볼 수 있습니다(예: Cloud Firestore의 '가져오기' 문서).

Cloud Firestore로 작업할 때 Error creating Index: googleapi: Error 409;...Concurrent access -- try again 오류가 발생합니다.

오류에서 알 수 있듯이 Terraform은 여러 색인을 프로비저닝하려고 하거나 문서를 동시에 만들려고 하는데 동시 실행 오류가 발생했을 수 있습니다. terraform apply를 다시 실행해 보세요.

"you may need to specify 'X-Goog-User-Project' HTTP header for quota and billing purposes" 오류가 발생합니다.

Terraform에서 할당량을 확인할 비교 대상 프로젝트를 알 수 없을 때 이 오류가 발생합니다. 문제를 해결하려면 resource 블록에서 다음을 확인합니다.

• project 속성 값을 지정했는지 확인합니다.
• Firebase 샘플에서 google-beta인 user_project_override = true(별칭 없음)가 있는 제공업체를 사용하고 있는지 확인합니다.

새 Google Cloud 프로젝트를 만들면 새 프로젝트에 지정된 프로젝트 ID가 이미 존재한다는 오류가 발생합니다.

프로젝트 ID가 이미 존재할 수 있는 이유는 다음과 같습니다.

• 해당 ID와 연결된 프로젝트가 다른 사용자의 소유입니다.

  • 해결 방법: 다른 프로젝트 ID를 선택합니다.

• 이 ID와 연결된 프로젝트가 최근에 삭제되었습니다(소프트 삭제 상태).

  • 해결 방법: ID와 연결된 프로젝트가 본인 소유라고 생각되면 projects.get REST API를 사용하여 프로젝트 상태를 확인하세요.

• 이 ID와 연결된 프로젝트가 현재 사용자 아래에 올바르게 존재합니다. 이 오류는 이전 terraform apply가 중단된 것이 원인일 수 있습니다.

  • 해결 방법: 다음 명령어를 실행합니다.
    terraform import google_project.default PROJECT_ID 다음
    terraform import google_firebase_project.default PROJECT_ID

Cloud Firestore를 프로비저닝한 후 google_app_engine_application을 통해 Cloud Storage를 프로비저닝하려고 하면 Error: Error creating App Engine application: googleapi: Error 409: Cannot create Firestore database resource <resource-name> since it already exists at location <location-id>, alreadyExists 오류가 발생합니다.

App Engine 애플리케이션에는 Cloud Firestore 인스턴스가 필요하지만 프로젝트당 하나의 Cloud Firestore 인스턴스만 가질 수 있습니다. 따라서 오류 메시지에서 알 수 있듯이 한 위치에 있는 프로젝트의 Cloud Firestore 인스턴스를 이미 프로비저닝한 경우 다른 위치에 있는 Cloud Firestore 인스턴스를 프로비저닝하려고 하면 App Engine에서 오류가 발생합니다. App Engine에서는 이미 기존 Cloud Firestore 인스턴스를 '다시 프로비저닝'하려고 한다고 판단합니다.

이 오류를 해결하려면 Cloud Firestore와 App Engine 애플리케이션 모두에 동일한 위치를 사용합니다. Cloud Firestore와 다른 위치에 Cloud Storage 버킷이 필요한 경우 추가 버킷을 프로비저닝할 수 있습니다(여러 개의 Cloud Storage 버킷을 만들기 위한 샘플 구성 참조).

google_app_engine_application을 통해 Cloud Storage를 프로비저닝한 후 Cloud Firestore를 프로비저닝하려고 하면 Error: Error creating Database: googleapi: Error 409: Database already exists. Please use another database_id 오류가 발생합니다.

google_app_engine_application을 통해 프로젝트의 기본 Cloud Storage 버킷을 프로비저닝하고 프로젝트에 아직 Cloud Firestore 인스턴스가 없는 경우 google_app_engine_application은 프로젝트의 Cloud Firestore 인스턴스를 자동으로 프로비저닝합니다.

따라서 프로젝트의 Cloud Firestore 인스턴스가 이미 프로비저닝된 경우 Cloud Firestore 인스턴스를 명시적으로 프로비저닝하려고 하면 google_firestore_database에서 오류가 발생합니다.

프로젝트의 Cloud Firestore 인스턴스가 프로비저닝되면 '다시 프로비저닝'하거나 위치를 변경할 수 없습니다. 오류 발생을 중지하려면 구성 파일에서 google_firestore_database 리소스 블록을 삭제합니다. 단, 프로젝트의 기본 Cloud Storage 버킷보다 먼저 Cloud Firestore를 프로비저닝하는 것이 좋습니다(이유는 아래 참조).