`shared_network` — version 1.0

Source: presets/shared-network.satz

Purpose

A shared VPC in a host project of its own: one network, the subnets the projects ask for, and a network firewall policy whose rules they ask for.

The host project, the network and the policy are the estate's. The subnets and the firewall rules are lists a project adds to through a request — a small pack of contributes_shared_vpc_subnets / contributes_shared_firewall_rules entries, checked with satz check-request and vendored into the estate by pull request — and each writes one resource per entry. A project's Google project joins the network as a service project in the project's own state, at the attach point network_host_project (the attaching identity needs Shared VPC Admin); it uses a subnet once a grant of roles/compute.networkUser on it exists, at the attach point shared_subnets.

Use it

params {
  use_shared_network = true

  // the pack's own defaults — copy only the lines you change
  network_host_project_id = "{customer_shortname}-net-host-001"
  network_host_project_folder = ""
  shared_network_name = "shared"
  shared_vpc_subnets = []
  shared_subnet_flow_sampling = 0.5
  shared_firewall_rules = []
}

use "presets/shared-network.satz" when use_shared_network

use_shared_network is the gate: while it is falsy the pack contributes nothing — no resources, no params, no claims. It is declared by estate_map, and the estate's own binding wins.

Needs from outside the pack:

billing_account_infra — declared by estate_core; use one of them alongside, or declare it in the estate.
customer_shortname — declared by estate_core; use one of them alongside, or declare it in the estate.

Params

param	default
`network_host_project_id`	`"{customer_shortname}-net-host-001"`
`network_host_project_folder`	`""`
`shared_network_name`	`"shared"`
`shared_vpc_subnets`	`[]`
`shared_subnet_flow_sampling`	`0.5`
`shared_firewall_rules`	`[]`

Questions

What to ask before this pack is configured, and what changing the answer costs.

asks about	prompt	reversal	blast	recommends
`network_host_project_id`	The Google project that hosts the shared VPC	recreate	high	—
`network_host_project_folder`	The folder the host project is created in — a folder the estate declares as `google_folder.<label>.name`, an existing one by its numeric id, or empty for the organisation	edit	low	—

network_host_project_id — A project id is immutable. Changing it later creates a second host project and a second network, and every project attached to the first stays there.

network_host_project_folder — It decides the policies and the grants the host project inherits. Changing it afterwards moves a live project between parents.

Contributes

resource type	labels
`google_compute_network`	`shared`
`google_compute_network_firewall_policy`	`shared`
`google_compute_network_firewall_policy_association`	`shared`
`google_compute_network_firewall_policy_rule`	`one per entry of shared_firewall_rules, by name`
`google_compute_shared_vpc_host_project`	`host`
`google_compute_subnetwork`	`one per entry of shared_vpc_subnets, by name`
`google_project`	`network_host`

Exports

Outputs of the root module and values of the interfaces under interfaces/ in every estate that uses this pack: a core export is carried by every interface, another one by its own interface and every interface that uses it. An interface a pack declares is common: every project's folder carries it.

interface	output	value	description
`network`	`network_host_project`	`"${google_project.network_host.project_id}"`	The Google project that hosts the shared VPC — a project attaches its own as a service project — attach point for `google_compute_shared_vpc_service_project`
`network`	`shared_network`	`"${google_compute_network.shared.id}"`	The shared VPC network, projects/<host>/global/networks/<name>
`network`	`shared_subnets`	`all google_compute_subnetwork under google_project.network_host`	Every subnet of the shared VPC, by name — a project grants roles/compute.networkUser on its own — attach point for `google_compute_subnetwork_iam_member`

Requests

What a project may add to this pack's lists, through contributes_<param> in a file the estate uses after a reviewed pull request; satz check-request checks such a file.

list	key	fields	description
`shared_vpc_subnets`	`name`	`name`, `cidr`, `region`	A subnet of the shared VPC in the host project: its name, its primary range and its region
`shared_firewall_rules`	`name`	`name`, `priority`, `direction`, `action`, `description`, `match`	A rule of the shared VPC's network firewall policy: priority, INGRESS or EGRESS, allow or deny, and its match block

Claims

None — this pack proves no control by itself.

History

version	date	change
1.0	2026-09-26	first version: a shared VPC in a host project, a network firewall policy, and two request points — `shared_vpc_subnets` and `shared_firewall_rules` — whose entries become one subnet and one policy rule each, every subnet with flow logs; the common interface `network` publishes the host project, the network and every subnet

The whole library's history: the changelog in presets/CHANGELOG.md.

Notes

No notes yet.

shared_network — version 1.0