GCP.CertificateManager reference

Certificate

Source: src/GCP/CertificateManager/Certificate.ts

A Certificate Manager TLS certificate — self-managed (uploaded PEM), Google-managed, or managed-identity.

Changing certificateId, location, scope, certificate type, managed-certificate configuration, or self-managed PEM replaces the resource (Certificate Manager rejects in-place SAN list updates). Description and labels update in place.

Certificate: Creating a Self-Managed Certificate

Generated name

const cert = yield* GCP.CertificateManager.Certificate("FrontendTls", {
  pemCertificate,
  pemPrivateKey,
});

Named certificate with labels

const cert = yield* GCP.CertificateManager.Certificate("FrontendTls", {
  certificateId: "app-frontend-tls",
  description: "prod frontend",
  labels: { env: "prod" },
  selfManaged: {
    pemCertificate,
    pemPrivateKey,
  },
});

Certificate: Google-Managed Certificates

const cert = yield* GCP.CertificateManager.Certificate("FrontendTls", {
  type: "MANAGED",
  managed: {
    domains: ["www.example.com"],
    dnsAuthorizations: [authorization.name],
  },
});

Certificate: Regional Certificates

const cert = yield* GCP.CertificateManager.Certificate("RegionalTls", {
  location: "us-central1",
  pemCertificate,
  pemPrivateKey,
});

CertificateIssuanceConfig

Source: src/GCP/CertificateManager/CertificateIssuanceConfig.ts

A Certificate Manager issuance config — how Google-managed certificates are minted from Certificate Authority Service (lifetime, rotation, key algorithm, and CA pool).

Changing certificateIssuanceConfigId, location, lifetime, rotationWindowPercentage, keyAlgorithm, or the CA pool replaces the resource. Description and labels update in place.

CertificateIssuanceConfig: Creating an Issuance Config

Generated name

const pool = yield* GCP.PrivateCA.CaPool("AppCa", {
  location: "us-central1",
});
const issuance = yield* GCP.CertificateManager.CertificateIssuanceConfig(
  "WorkloadTls",
  {
    certificateAuthorityConfig: {
      certificateAuthorityServiceConfig: { caPool: pool.name },
    },
  },
);

Named config with labels

const issuance = yield* GCP.CertificateManager.CertificateIssuanceConfig(
  "WorkloadTls",
  {
    certificateIssuanceConfigId: "app-workload-tls",
    description: "prod workload certs",
    labels: { env: "prod" },
    lifetime: "2592000s",
    rotationWindowPercentage: 66,
    keyAlgorithm: "ECDSA_P256",
    certificateAuthorityConfig: {
      certificateAuthorityServiceConfig: { caPool: pool.name },
    },
  },
);

CertificateIssuanceConfig: Regional Issuance Config

const issuance = yield* GCP.CertificateManager.CertificateIssuanceConfig(
  "RegionalTls",
  {
    location: "us-central1",
    certificateAuthorityConfig: {
      certificateAuthorityServiceConfig: { caPool: pool.name },
    },
  },
);

CertificateIssuanceConfig: Google-Managed Private Certificates

const cert = yield* GCP.CertificateManager.Certificate("FrontendTls", {
  type: "MANAGED",
  managed: {
    domains: ["www.example.com"],
    issuanceConfig: issuance.name,
  },
});

CertificateMap

Source: src/GCP/CertificateManager/CertificateMap.ts

A Certificate Manager certificate map — a collection of certificate configurations selected by SNI for global external Application and proxy Network Load Balancers.

Changing certificateMapId or location replaces the resource. Description and labels update in place. Certificate maps cannot be deleted while they still contain certificate map entries.

CertificateMap: Creating a Certificate Map

Generated name

const map = yield* GCP.CertificateManager.CertificateMap("FrontendMap", {});

Named map with labels

const map = yield* GCP.CertificateManager.CertificateMap("FrontendMap", {
  certificateMapId: "app-frontend",
  description: "prod frontend",
  labels: { env: "prod" },
});

CertificateMap: Updating a Certificate Map

const map = yield* GCP.CertificateManager.CertificateMap("FrontendMap", {
  certificateMapId: "app-frontend",
  description: "prod frontend v2",
  labels: { env: "prod", role: "tls" },
});

CertificateMapEntry

Source: src/GCP/CertificateManager/CertificateMapEntry.ts

A Certificate Manager certificate map entry — binds one or more certificates to an SNI hostname (or the PRIMARY fallback) inside a certificate map.

Changing certificateMapEntryId, certificateMap, location, hostname, or matcher replaces the resource. Description, labels, and certificates update in place. Hostname and matcher are mutually exclusive; if both are set, hostname is used.

CertificateMapEntry: Creating a Hostname Entry

SNI hostname

const cert = yield* GCP.CertificateManager.Certificate("FrontendTls", {
  pemCertificate,
  pemPrivateKey,
});
const map = yield* GCP.CertificateManager.CertificateMap("FrontendMap", {});
const entry = yield* GCP.CertificateManager.CertificateMapEntry("Www", {
  certificateMap: map.name,
  certificates: [cert.name],
  hostname: "www.example.com",
});

Named entry with labels

const entry = yield* GCP.CertificateManager.CertificateMapEntry("Www", {
  certificateMap: map.name,
  certificateMapEntryId: "app-www",
  description: "prod www",
  labels: { env: "prod" },
  certificates: [cert.name],
  hostname: "www.example.com",
});

CertificateMapEntry: Primary Fallback

const fallback = yield* GCP.CertificateManager.CertificateMapEntry("Default", {
  certificateMap: map.name,
  certificates: [cert.name],
  matcher: "PRIMARY",
});

CertificateMapEntry: Updating Certificates

const entry = yield* GCP.CertificateManager.CertificateMapEntry("Www", {
  certificateMap: map.name,
  certificates: [cert.name, extra.name],
  hostname: "www.example.com",
});

DnsAuthorization

Source: src/GCP/CertificateManager/DnsAuthorization.ts

A Certificate Manager DNS authorization proving ownership of a domain for Google-managed certificates.

Changing dnsAuthorizationId, location, domain, or type replaces the resource. Description and labels update in place.

DnsAuthorization: Creating a DNS Authorization

Generated name

const authorization = yield* GCP.CertificateManager.DnsAuthorization(
  "WwwAuth",
  { domain: "www.example.com" },
);

Named authorization with labels

const authorization = yield* GCP.CertificateManager.DnsAuthorization(
  "WwwAuth",
  {
    dnsAuthorizationId: "www-example-auth",
    description: "prod www",
    domain: "www.example.com",
    labels: { env: "prod" },
  },
);

DnsAuthorization: Regional Per-Project Records

const authorization = yield* GCP.CertificateManager.DnsAuthorization(
  "WwwAuth",
  {
    location: "us-central1",
    type: "PER_PROJECT_RECORD",
    domain: "www.example.com",
  },
);

DnsAuthorization: Google-Managed Certificates

const authorization = yield* GCP.CertificateManager.DnsAuthorization(
  "WwwAuth",
  { domain: "www.example.com" },
);
const cert = yield* GCP.CertificateManager.Certificate("FrontendTls", {
  type: "MANAGED",
  managed: {
    domains: ["www.example.com"],
    dnsAuthorizations: [authorization.name],
  },
});

TrustConfig

Source: src/GCP/CertificateManager/TrustConfig.ts

A Certificate Manager TrustConfig — the PKI used to validate client certificates in mutual TLS (load balancer or SPIFFE).

Changing trustConfigId or location replaces the resource. Description, labels, trust stores, allowlisted certificates, and SPIFFE trust stores update in place.

TrustConfig: Creating a Trust Config

Generated name

const trust = yield* GCP.CertificateManager.TrustConfig("ClientMtls", {
  trustStores: [
    {
      trustAnchors: [{ pemCertificate }],
    },
  ],
});

Named config with labels

const trust = yield* GCP.CertificateManager.TrustConfig("ClientMtls", {
  trustConfigId: "app-client-mtls",
  description: "prod mTLS roots",
  labels: { env: "prod" },
  trustStores: [
    {
      trustAnchors: [{ pemCertificate: rootPem }],
      intermediateCas: [{ pemCertificate: intermediatePem }],
    },
  ],
});

TrustConfig: Allowlisted Certificates

const trust = yield* GCP.CertificateManager.TrustConfig("Allowlist", {
  allowlistedCertificates: [
    { pemCertificate: clientPemA },
    { pemCertificate: clientPemB },
  ],
});

TrustConfig: Regional Trust Config

const trust = yield* GCP.CertificateManager.TrustConfig("RegionalMtls", {
  location: "us-central1",
  trustStores: [
    {
      trustAnchors: [{ pemCertificate }],
    },
  ],
});