Release note — infrastructure-as-code family, 2026-10-21

What the IaC family covers at first release, the retirement it leads with, the absences recorded in Config Connector and Infra Manager, and what is known to be missing.

markdownreferencev1RW3J-GMWAstage: designtrust: officialfamily: iacservice: terraforminterface: iacchangelogiacrelease noteterraforminfrastructure managerdeployment managerconfig connector

Created 21 Oct 2026 · Modified 23 Oct 2026 · 1 version

Infrastructure-as-code family — first release

Added

DocumentWhat it carries
reference/iac/terraform-on-google-cloud.mdthe gcs backend, versioning on the state bucket, Blueprints, Infra Manager's three objects
reference/iac/deployment-manager-status.mdthe end-of-support date, the named successors, what to establish before replacing an estate
reference/iac/config-connector.mdthe object shape, the three installation routes, the reconciling identity, the two modes
reference/iac/errors.mdthe service that is not enabled, the identity that is not yours, the four state failures
guides/iac/terraform-first-apply.mdsix steps against a new project, each naming what it prevents
guides/parity/iac.mdCloudFormation and ARM/Bicep ceilings side by side, and why a Terraform-first estate is the portable one

The fact this family exists to carry

Cloud Deployment Manager reached end of support on 31 March 2026. It is the highest-value single fact in the family: a model answering from memory will still write Deployment Manager configurations.

Absences recorded rather than filled in

  • The Config Connector overview does not name the deletion-policy annotation. Documented as an explicit

"do not assume either behaviour", because guessing it wrong deletes a database.

  • The Infra Manager overview states no supported Terraform versions, no default identity, **no API

name and no limits**.

  • The Terraform-on-Google-Cloud overview makes no provider-version and no authentication recommendation.

Provider pinning is labelled as the hub's rule, not the vendor's.

  • The service enable/disable page prints no verbatim not-enabled error string.

Known missing

  • Terraform import coverage per resource type — the question that decides rewrite against re-adoption.
  • Organization Policy / policy-as-code validation (gcloud beta terraform vet).
  • Cloud Build and Cloud Deploy as pipelines in their own right.
  • Infra Manager's own quotas and locations.

Read this document as markdown — the same bytes an agent receives.