GCP architecture builder

The Terraform tab shows the generated configuration, highlighted, file by file: versions.tf (Terraform ≥ 1.9, hashicorp/google and google-beta ~> 8.7), providers.tf (project, region and default labels), variables.tf, main.tf (every API the design needs, enabled with google_project_service), network.tf, iam.tf, compute.tf, data.tf, messaging.tf, analytics.tf, search.tf, edge.tf, security.tf, monitoring.tf, outputs.tf, a terraform.tfvars.example, a README with the resource list, cost and checks, OpenAPI and Workflows YAML where needed, and stub source for every Cloud Run function, PySpark stubs and Airflow DAGs. Download .zip gives you the whole configuration. Show code in the inspector (or Jump to service) highlights the lines a service produced, in every file it appears.

The code uses the current, idiomatic resources — google_cloud_run_v2_service, google_cloudfunctions2_function, google_sql_database_instance, google_pubsub_subscription with push, BigQuery and Cloud Storage configs, google_eventarc_trigger, the global external Application Load Balancer as a global address, managed certificate, HTTPS proxy, URL map, backend services (serverless network endpoint groups for Cloud Run and functions, backend buckets for Cloud Storage) and an HTTP-to-HTTPS redirect. Every workload runs as its own service account, and each connection becomes the narrowest role on the narrowest resource Google Cloud allows: a Cloud Run service publishing to a topic gets roles/pubsub.publisher on that topic; a service reading a bucket gets roles/storage.objectViewer on that bucket; Pub/Sub push, Eventarc, Cloud Scheduler, Cloud Tasks, Workflows and API Gateway get roles/run.invoker on exactly the service they call. Firewall rules target the service accounts of VMs and instance groups and allow only the health-check, proxy-only, IAP or source-service-account ranges the connections need. Services get environment variables naming what they are connected to. The Dev/Prod switch sets deletion protection (Cloud SQL, Cloud Run, GKE, Spanner, Bigtable, Firestore, BigQuery), whether buckets and datasets are emptied on destroy, backup retention, and makes the checks stricter.

Every example, and a design that uses every service type at once, is checked by running terraform init -backend=false, terraform validate and terraform fmt -check with Terraform 1.16.6, provider 8.7.0 and elastic/ec 0.13.1 — no credentials, no Elastic API key and no calls to Google Cloud or Elastic. Validation proves the configuration is well-formed against the provider’s schema, not that apply will succeed in your project: read it, run terraform plan, and only then apply.

The Data & analytics, Integration and Search & caching groups of the palette cover a whole data platform:

Run terraform for designs with Elastic Cloud with EC_API_KEY set to an Elastic Cloud API key; validation needs no key.

The Cost tab totals a rough monthly cost per service with a bar chart, the biggest cost drivers, and the charges that are easy to overlook — Cloud NAT (per VM-hour plus $0.045 per GiB and its external IP), load-balancer forwarding rules ($0.025 an hour for the first five in a project) and internal load-balancer proxies, internet egress, idle minimum instances on Cloud Run, and high availability, which doubles Cloud SQL’s price — and, for data platforms, a Composer environment that bills around the clock whether or not a DAG runs, streaming Dataflow workers that run all month, queries that scan a whole unpartitioned BigQuery table, baseline slots, and cache replicas (one replica per shard doubles Memorystore’s nodes; the Standard tier costs about 30% more than Basic). Expand a row to edit its usage assumptions (requests, request time, GB stored or processed, reads and writes, average VMs, nodes or pod resources…) and to see each line as quantity × rate.

Prices are public list prices for us-central1 (Premium network tier, no committed-use or sustained-use discounts), read on 14 and 15 October 2026 from Google Cloud’s public pricing pages without an account; every row links to its page, e.g. https://cloud.google.com/run/pricing. The data platform uses: BigQuery $6.25 per TiB scanned on demand, $0.023 and $0.016 per GiB-month of active and long-term storage, and $0.04, $0.06 and $0.10 per slot-hour for the Standard, Enterprise and Enterprise Plus editions; Dataproc’s $0.01 per vCPU-hour on top of the Compute Engine VMs (Spot prices for secondary workers) and $0.06 per DCU-hour for Dataproc Serverless; Dataflow $0.069 per streaming and $0.056 per batch vCPU-hour, $0.003557 per GB-hour of memory, $0.018 per GB through Streaming Engine and $0.011 per GB shuffled in batch; Composer 3 $0.06 per DCU-hour; Managed Kafka $0.09 per DCU-hour (1 vCPU = 0.6 DCU, 1 GiB = 0.1 DCU) plus storage and $0.01 per GiB replicated between zones; Datastream $2 per GiB of change data (less above 2,500 GiB) and $0.40 per GiB of backfill above 500 GiB a month; Vertex AI Search $1.50 or $4 per 1,000 queries and $5 per GiB-month of index above 10 GiB; Memorystore Redis Cluster and Valkey per node-hour. Elastic Cloud is Elastic’s price, not Google’s: the “as low as” monthly price per subscription tier (Standard $99, Gold $114, Platinum $131, Enterprise $184) from Elastic’s pricing page, for its reference production deployment (120 GB of storage over two zones), billed through Google Cloud Marketplace if your Elastic organisation subscribes there — enter a size multiple from Elastic’s calculator. The other regions — us-east1, us-west1, europe-west1, europe-west2, asia-northeast1 and australia-southeast1 — multiply them by a ratio measured from the same pages per family (Compute Engine, Cloud SQL, Cloud Run, Cloud Storage, GKE Autopilot, Memorystore, internet egress); other services use the us-central1 price. Apply free-tier allowances subtracts the free tier, shared across the design: 2 million Cloud Run requests with 180,000 vCPU-seconds and 360,000 GiB-seconds, Firestore’s 50,000 reads and 20,000 writes a day, 1 TiB of BigQuery queries and 10 GiB of storage, 10 GiB of Pub/Sub, 5 GB of Cloud Storage and one e2-micro VM in the US regions, three Cloud Scheduler jobs, the GKE cluster-fee credit and more. The first 50 GiB of logs a month are always free, and Identity Platform’s first 50,000 monthly users are free whichever way the switch is set. The $300 trial credit is not modelled. Treat the total as a rough estimate and check it with the Google Cloud Pricing Calculator.

The Checks tab lists errors (things that won’t deploy or are unsafe), warnings and notes, with Fix buttons where the fix is a setting, plus every firewall rule and IAM binding the design produces. Among them: buckets readable by allUsers (fine only for a website behind the load balancer), Cloud SQL with a public IP or authorized networks, no HA or backups in production, Cloud Run allowing unauthenticated calls when every caller authenticates — or not allowing them behind a load balancer that has no IAP, where requests arrive unauthenticated — a run.app URL that bypasses the load balancer, push subscriptions without a dead-letter topic, the default compute service account, ports open to 0.0.0.0/0 other than 80 and 443, single-zone resources in production, services that can’t reach a private database because they are outside the VPC, and a note listing data stores without customer-managed encryption keys in production. For data platforms: large unpartitioned BigQuery tables, datasets readable by allUsers or allAuthenticatedUsers, Dataproc clusters with neither autoscaling nor idle deletion, Composer in production without high resilience, streams without a dead-letter topic, search exposed publicly (an open or empty-filter Elastic endpoint, a public Vertex AI Search widget, users querying search directly), Kafka memory outside 1–8 GiB per vCPU and Dataflow jobs reading Kafka from outside its VPC. Badges on the diagram show which service has a problem.

Designs autosave in this browser (localStorage) as you work; keep several with Design ▾ (new, duplicate, rename, delete), and move them between machines with Export JSON / Import JSON. Export diagram as SVG/PNG saves a light-theme picture of the diagram. Share link packs the current design into the link — designs hold settings and names only, never secrets.