Terraform Google Cloud Provider 8.0 Is GA — Three Breaking Changes That Will Affect Your Infrastructure

The Terraform Google Cloud provider has been at version 7.x for long enough that 8.0 carries real migration weight. This is not a minor version bump — there are three categories of breaking changes that will affect most teams using GCP resources with Terraform, and the removal of deprecated resources is a forced migration for teams that haven’t already moved.

The Breaking Changes

1. Load balancer default changed from EXTERNAL to EXTERNAL_MANAGED

Any backend service configuration that relied on the default load_balancing_scheme will now provision an Application Load Balancer (managed tier) instead of a Classic External Load Balancer. This changes pricing behavior, feature availability, and — in some cases — DNS and routing behavior for services that have external-facing endpoints.

If you need Classic Load Balancer behavior after the upgrade, you must explicitly set load_balancing_scheme = "EXTERNAL" in your configuration. Terraform plans will flag this as a resource change if your state file has the old default.

2. Deprecated resources removed

Version 8.0 eliminates resources that were deprecated in 7.x but still functional:

• IAP OAuth (google_iap_brand, google_iap_client) — removed; no direct replacement, IAP configuration migrates to other methods
• Notebooks resources — migrate to google_workbench_instance
• ML Engine (google_ml_engine_model) — migrate to Vertex AI equivalents
• BeyondCorp components — migrate to Security Gateway resources

Teams managing these resources will see errors on terraform plan after upgrading. The 8.0 Upgrade Guide in the Terraform Registry documents migration paths for each affected resource.

3. List/set schema conversions

Several attributes were converted from lists to sets to prevent perpetual diffs when the GCP API returns resources in variable ordering. This is a state-level change: if Terraform detects a list-to-set conversion, it may attempt to recreate resources. Testing in a non-production environment before applying to prod is critical for these changes.

What’s New

Infrastructure discovery expanded significantly in the 7.x cycle and carries into 8.0. The terraform query workflow with list resources now covers Compute Engine, IAM, BigQuery, and Pub/Sub — giving teams a read-only mechanism for auditing existing infrastructure against Terraform state without running destructive plans.

Write-only attributes protect sensitive values (certificate private keys, AlloyDB passwords, IAP credentials) from appearing in Terraform state files. If your state files are stored in a shared backend with access logging, this reduces the surface area for credential exposure.

The Upgrade Path

HashiCorp recommends a two-step migration:

1. Upgrade to the latest 7.x release first and resolve all deprecation warnings. This surfaces which removed resources your configuration uses before you hit hard errors.
2. Upgrade to 8.0, explicitly set load_balancing_scheme where needed, and run terraform plan in a non-production workspace before applying.

The 8.0 Upgrade Guide at registry.terraform.io/providers/hashicorp/google/latest/docs/guides/version_8_upgrade is the authoritative reference — if you’re running Compute, IAP, Notebooks, or ML Engine resources, read it before upgrading.

Source: HashiCorp Blog

Content created with AI assistance and reviewed for accuracy.