Google Cloud Terraform Resources

A BigQuery job is free to submit. A query job bills per TiB of data scanned under on-demand pricing; load, copy, and export jobs are free. Bytes scanned is the cost.

Dedicated BigQuery compute capacity (slots) for predictable query pricing. Priced per slot-hour by edition, billed for the reserved slot count.

A BigQuery table is free to declare. Cost comes from the data stored in it per GB-month and the bytes queries scan against it, so schema and partitioning drive the real bill.

Managed Apache Airflow. Composer 2: ~$455/month minimum (web server $73 + scheduler $73 + workers $25/CPU + Cloud SQL $73). Composer 3 introduces serverless workers. Often the priciest 'orchestration' bill.

Managed Spark, Hadoop, Flink, and Presto. Bills underlying Compute Engine VMs + $0.010/vCPU-hour Dataproc fee. Dataproc Serverless eliminates cluster management. Dataproc on GKE runs Spark on existing GKE.

A managed Hive metastore for data lakes. Priced as a flat hourly service fee by tier, billed continuously while the service runs.

A managed Looker BI platform instance. Priced per instance-hour by platform edition, billed continuously while the instance runs.

A managed gateway for serverless backends. Priced per million API calls, with a free tier and no always-on cost.

A managed cron job that triggers HTTP, Pub/Sub, or App Engine targets on a schedule. Priced per job per month, with the first three jobs free.

Serverless orchestration that chains services and APIs. Priced per step executed, separating cheaper internal steps from pricier external HTTP calls.

An autoscaler is free. It varies the size of a managed instance group with demand. The cost is the VMs it runs, which floats between the min and max you set.

A Google Compute Engine VM. Priced per second by machine type, region, and license. Sustained-use discounts apply automatically.

An instance group is free. It manages a fleet of VMs from a template. The cost is the running VMs times the group's size, priced by machine type and disk.

A managed instance group that runs and autoscales a fleet of identical VMs, billed as the Compute Engine instances. 3× e2-medium is ~$73/month.

An instance template is free. It is a blueprint for VMs. The cost is every VM a managed instance group stamps out from it, priced by machine type and disk.

A regional (multi-zone) managed instance group, billed as the Compute Engine VMs it runs across zones. 3× e2-medium is ~$73/month.

A managed JupyterLab notebook VM for data science. Priced at the underlying Compute Engine rate per hour, plus boot disk and any attached GPUs.

A dedicated VMware vSphere cluster running on Google Cloud. Priced per ESXi node-hour, with a multi-node minimum that makes this one of the largest standing costs.

A managed registry for container images, Helm charts, language packages. $0.10/GB-month storage plus data transfer.

A managed Kubernetes cluster on GKE. Two operating modes: Standard with per-cluster management fee, or Autopilot priced per pod.

Compute Engine worker nodes for a GKE cluster. Bills as the VMs it runs: node_count × machine_type. 3× e2-standard-4 is ~$294/month.

PostgreSQL-compatible managed database with up to 4x faster queries than standard PG. CPU $0.06814/vCPU-hour + memory $0.00822/GB-hour. Storage $0.30/GB-month. Designed for OLTP and analytical workloads.

A PostgreSQL-compatible instance within an AlloyDB cluster. Priced per vCPU-hour and per GB of memory-hour, plus separately-billed cluster storage.

A serverless data warehouse dataset. Two pricing models: on-demand ($6.25/TB scanned) or capacity-based (slot-hours).

Wide-column NoSQL for low-latency, high-throughput workloads. $0.65/node-hour (SSD) or $0.17/node-hour (HDD) plus storage. 3-node minimum production. Replication to another region doubles node cost.

A managed Apache Beam job for streaming and batch data processing. Priced per worker-hour by machine type and tier, plus data processed.

A serverless document database billed by reads, writes, deletes, and storage, no instances. 10M reads + 2M writes + 50 GB is ~$19/month, with a free daily tier.

A managed Memcached cluster. Priced per node by vCPU-hour and memory GB-hour, multiplied across the node count.

A horizontally-scalable, sharded Redis Cluster on Memorystore. Priced per shard-node-hour by capacity, multiplied across shards and replicas.

A managed Redis instance. Priced per GB-hour by service tier (Basic or Standard) and capacity.

Globally-consistent, horizontally-scalable SQL database. $0.90/node-hour ($657/month) for regional, $3/node-hour for multi-region. Storage $0.30/GB-month regional, $0.50/GB-month multi-region. Processing Units offer 1/1000th node granularity.

A managed MySQL, PostgreSQL, or SQL Server database. Priced by tier, storage, and HA mode. Sustained-use discounts apply.

A project IAM binding is free. It grants a role to a member at the project level. It has no charge; it only enables access to resources that may cost money.

A service account is free. It is an identity for workloads to authenticate and be granted permissions. It has no charge and no cost drivers of its own.

A bucket IAM binding is free. It grants a role to a member on a Cloud Storage bucket. The cost is the bucket itself: its stored data, operations, and egress.

Managed ML inference endpoint. Bills n1-standard-2 at $0.05/hour up to GPU-backed n1-highmem-32 at $5+/hour. Foundation model endpoints (Gemini, PaLM) bill per-token. Batch prediction available for offline workloads.

A managed Jupyter notebook VM for Vertex AI, billed the underlying Compute Engine rate per hour. An e2-standard-4 is ~$98/month if left on, idle notebooks are the waste.

Routes matching log entries from a project to a destination such as BigQuery, Cloud Storage, Pub/Sub, or another log bucket. The sink is free. Cost lives in the destination and in Cloud Logging ingestion.

Managed task queue for HTTP/gRPC targets. First 1M tasks/month free, then $0.40 per million tasks. No queue infrastructure to manage. Tasks call HTTP endpoints (Cloud Run, Cloud Functions, GKE services) with retry and rate limiting.

A Pub/Sub subscription is free to create. Cost comes from message throughput delivered, retained storage for unacked or replayable messages, and egress to the subscriber.

A pub/sub topic for messaging. Priced per TB of message ingestion and delivery, with a generous free tier.

A reserved static IP address. Per-hour charge based on attachment state and IP version (IPv4 vs IPv6).

A backend service is free configuration. It binds a load balancer to its backends and their health checks. The Cloud Load Balancing charge lands on the forwarding rule plus data processed.

A VPC firewall rule is free. It allows or denies traffic to and from instances at no cost. The bill comes from the resources the rule protects and the traffic it permits.

A regional forwarding rule is where the Cloud Load Balancing charge lands. It bills an hourly rate per rule plus per-GB data processed, on top of the backends behind it.

A reserved global static external IP. Charged ~$0.01/hour (~$7.30/month) only while reserved-but-unattached, attached to a load balancer it's free.

A global forwarding rule is where the global Cloud Load Balancing charge lands. It bills an hourly rate per rule plus per-GB data processed, in front of a global HTTP(S) or proxy load balancer.

A high-availability IPsec VPN gateway with a 99.99% SLA. Priced per tunnel-hour, plus standard egress on traffic leaving Google Cloud.

A health check is free. It probes backends to decide which are eligible for traffic. The cost sits on the load balancer's forwarding rule and the backends it protects.

A VLAN attachment connecting your VPC to a Cloud Interconnect, billed per hour by capacity. A 1 Gbps attachment is ~$75/month, plus egress over the link.

A VPC network is free. The network, its routes, and internal traffic within a region cost nothing. The bill comes from the resources you run inside it and the traffic that leaves it.

A VPC route is free. It tells traffic where to go within a network. The cost sits on the next hop it points at, such as a Cloud NAT gateway or a VM, and the egress it enables.

A Cloud Router is free. It runs BGP to exchange dynamic routes at no charge. The cost lands on what it hosts, chiefly Cloud NAT, and on the VPN or Interconnect attachments it advertises.

Managed NAT gateway for private GKE/VMs reaching the internet. $0.044/hour per gateway + $0.045/GB processed. Significantly cheaper than AWS NAT Gateway, and outbound to Google services is free via Private Google Access.

A subnetwork is free. It carves a regional IP range out of a VPC, and the cost comes from the resources placed in it and the traffic they generate.

A target HTTP proxy is free. It connects a forwarding rule to a URL map for HTTP load balancing. The Cloud Load Balancing charge sits on the forwarding rule and data processed.

A target HTTPS proxy is free, and so are Google-managed SSL certificates. It terminates TLS and routes via a URL map. The Cloud Load Balancing charge sits on the forwarding rule and data processed.

A URL map is free. It routes requests by host and path to backend services. The Cloud Load Balancing charge sits on the forwarding rule and data processed.

An IPsec VPN tunnel to an on-premises or peer network, billed per tunnel-hour. One tunnel is ~$37/month, and HA VPN needs two, plus egress over the tunnel.

A managed DNS zone. Priced per zone per month plus per-query, both at low flat rates that scale with the number of zones and query volume.

A network-level Cloud DNS policy for inbound or outbound forwarding, alternative name servers, and query logging. The policy is free. Cost lives in Cloud DNS zones and queries and in the logging it can enable.

A DNS record set is essentially free to define. Cloud DNS bills per managed zone per month and per million queries, so cost scales with zones and query volume, not with individual records.

A bucket for storing GCP logs. Ingestion is $0.50/GiB beyond the free tier; storage beyond 30 days is $0.01/GiB-month.

TLS certificates for Google Cloud load balancers. Google-managed and self-managed certificates are free. Cost lives in the load balancer that serves them and, for private PKI, in Certificate Authority Service.

A managed intrusion detection endpoint built on Palo Alto threat engines. Priced per endpoint-hour plus per-GB of traffic inspected.

Customer-managed encryption keys. Software keys $0.06/key-month + $0.03/10K operations. HSM keys $1-$2.50/key-month + $0.03/10K operations. External Key Manager (EKM) keys also supported.

A KMS key ring is free. It is a regional container that groups crypto keys. The cost is on the keys inside it: active key versions and cryptographic operations.

A managed private certificate authority. Priced as a flat monthly CA fee by tier, plus a per-certificate issuance charge.

Grants a role to a set of members at the project level, authoritatively for that role. IAM is always free. Cost lives in what the granted access lets members create and consume, and in the audit logs it can generate.

A managed secret with versioning and IAM access. $0.06/month per active secret version, plus per-access fees beyond the free tier.

A secret version holds one payload of a secret. Secret Manager bills per active secret version per month and per 10,000 access operations, so cost tracks versions and how often they are read.

Grants a role to members on a single Cloud Storage bucket, authoritatively for that role. IAM is free. Cost lives in the bucket's storage, operations, and egress, and a public grant can drive a large egress bill.

A Cloud Armor (Enterprise tier) WAF/DDoS policy billed per policy plus per rule, plus request inspection. A policy with 5 rules is ~$10/month before requests.

An individual cryptographic key version in Cloud KMS, billed per active version per month (software ~$0.06; HSM more), plus per cryptographic operation.

A serverless container service. Billed by request count and per-request CPU/memory time. Generous free tier.

A fully managed container service that scales to zero. Priced per vCPU-second and GiB-second while requests are being handled, plus per-request fees.

A 1st-gen serverless function. Priced per invocation plus compute time (GHz-seconds and GB-seconds), with a generous free tier and scale to zero.

A serverless function (2nd gen, Cloud Run-based). Billed per invocation, vCPU-time, memory-time, and outbound networking.

Attaches an existing persistent disk to a Compute Engine instance. The attachment is free. Cost lives on the disk itself: provisioned capacity by disk type, plus snapshots and regional replication.

A block storage disk for Compute Engine VMs. Priced per GB-month by disk type. Hyperdisk adds per-IOPS and per-throughput billing.

Managed NFS file storage. Basic HDD at $0.16/GB-month (1 TB min). Basic SSD at $0.30/GB-month. Enterprise tier at $0.45/GB-month with regional replication. High Scale at $0.10/GB-month for parallel workloads.

Object storage on GCS. Priced by storage class, region, operations, and egress. Lifecycle rules can auto-tier cold data.