如何通过Terraform在GCP区域子网后部署静态站点？

问题背景 #

尝试通过Terraform创建GCP Backend Bucket，在区域子网后提供静态网站服务，但部署失败。以下是Terraform配置：

resource "random_id" "bucket_prefix" {
  byte_length = 8
}

resource "google_storage_bucket" "static_site" {
  name                        = "${var.name}-${random_id.bucket_prefix.hex}-${var.environment}"
  project                     = var.project_id
  location                    = "us-east4"
  force_destroy               = true
  uniform_bucket_level_access = false
  public_access_prevention    = "enforced"
  storage_class               = "STANDARD"
  website {
    main_page_suffix = "index.html"
  }
  versioning {
    enabled = true
  }
  cors {
    origin          = ["*"]
    method          = ["GET"]
    response_header = ["*"]
    max_age_seconds = 3600
  }
}

resource "google_compute_global_address" "default" {
  project    = var.project_id
  name       = "${var.name}-address-${var.environment}"
  ip_version = "IPV4"
}

resource "google_dns_record_set" "default" {
  project      = var.project_id
  name         = "${var.name}.${var.zone}"
  type         = "A"
  ttl          = 300
  managed_zone = var.zone
  rrdatas      = [google_compute_global_address.default.address]
}


resource "google_compute_backend_bucket" "default" {
  project     = var.project_id
  name        = "${var.name}-backend-bucket-${var.environment}"
  description = "The back end bucket for the ${var.name} web app."
  bucket_name = google_storage_bucket.static_site.name
}

resource "google_compute_region_url_map" "default" {
  project         = var.project_id
  region          = "us-east4"
  name            = "${var.name}-url-map-${var.environment}"
  default_service = google_compute_backend_bucket.default.id
  depends_on      = [google_compute_backend_bucket.default]
}

resource "google_compute_region_target_https_proxy" "default" {
  project          = var.project_id
  name             = var.name
  region           = "us-east4"
  url_map          = google_compute_region_url_map.default.self_link
  ssl_certificates = ["https://www.googleapis.com/compute/v1/projects/${var.project_id}/regions/us-east4/sslCertificates/${var.ssl_certificate}"]
}

resource "google_compute_forwarding_rule" "default" {
  project               = var.project_id
  name                  = "${var.name}-forwarding-rule-${var.environment}"
  load_balancing_scheme = "INTERNAL_MANAGED"
  region                = "us-east4"
  ip_protocol           = "TCP"
  port_range            = "443"
  target                = google_compute_region_target_https_proxy.default.self_link
  network               = data.google_compute_network.gcp_network.self_link
  subnetwork            = "projects/NETWORK_PROJECT_ID/regions/us-east4/subnetworks/SUBNET_NAME"
}

执行terraform plan时，后端桶路径显示正确：

+ resource "google_compute_region_url_map" "default" {
      + creation_timestamp = (known after apply)
      + default_service    = "projects/MY_PROJECT_ID/global/backendBuckets/${var.name}-backend-bucket-${var.environment}"
      + fingerprint        = (known after apply)
      + id                 = (known after apply)
      + map_id             = (known after apply)
      + name               = "NAME"
      + project            = "MY_PROJECT_ID"
      + region             = "us-east4"
      + self_link          = (known after apply)
    }

但执行terraform apply时出现错误，系统错误地查找区域backendServices资源：

│ Error: Error creating RegionUrlMap: googleapi: Error 404: The resource 'projects/MY_PROJECT_ID/regions/us-east4/backendServices/${var.name}-backend-bucket-${var.environment}' was not found, notFound

已知限制：GCP支持确认Regional Internal Application Load Balancer不支持Backend Bucket，且公司禁用了Cloud Run和Cloud Functions。

问题解答 #

1. 是否可以修改Terraform配置，实现将静态站点桶部署在区域子网后？ #

不能。这是GCP产品级别的限制：Regional Internal Application Load Balancer（内部区域ALB）仅支持绑定区域级别的Backend Services，无法识别全局的Backend Bucket资源。你的错误本质是区域URL Map会自动在区域路径下查找后端服务，但Backend Bucket是全局资源，所以即使调整Terraform的参数引用方式，也无法绕过这个限制。

2. 替代方案 #

方案1：全局外部ALB+私有访问限制

使用全局外部ALB，但通过配置限制仅允许VPN/私有子网IP访问：

• 保留现有Backend Bucket配置
• 修改google_compute_forwarding_rule的load_balancing_scheme为EXTERNAL_MANAGED，并添加allow_global_access = false（确保仅内部IP可访问）
• 配置防火墙规则，仅允许来自VPN/私有子网CIDR的443流量访问负载均衡器的IP

方案2：私有子网内部署Nginx代理集群

在私有子网中创建VM实例组（Managed Instance Group），安装Nginx作为反向代理直接访问Cloud Storage内容：

• 给VM分配私有IP，确保仅能通过VPN访问
• 配置Nginx的proxy_pass指向Cloud Storage静态网站端点（https://storage.googleapis.com/[bucket-name]）
• 为VM配置内部SSL证书（使用GCP的google_compute_ssl_certificate资源）
• 可选：搭配Internal TCP/UDP Load Balancer实现高可用

方案3：Cloud Storage私有访问+VPC Service Controls

直接让VPN用户通过VPC内部访问Cloud Storage Bucket：

• 启用Cloud Storage的VPC私有访问，确保Bucket流量仅走VPC内部
• 配置VPC Service Controls，限制Bucket只能被指定的私有子网访问
• VPN用户连接后，直接访问Bucket的私有端点（https://[bucket-name].storage.googleapis.com），流量不会经过公网

内容的提问来源于stack exchange，提问作者Sam Redmond