The challenge
The goal is a VM that costs nothing, can be rebuilt from code at any time, and carries no embedded credentials — while staying strictly inside Google’s Always-Free limits.
Our approach
Rather than lean on the default network, we build a small, self-contained VPC with its own subnet and firewall rules, so the whole environment is explicit and reproducible. Authentication uses gcloud Application Default Credentials, and only the public half of the SSH key is injected via instance metadata — the private key never leaves your machine.
Technical specifics
- Terraform ≥ 1.5.0 with the google provider ~> 6.0.
- An e2-micro machine type in a free-tier region (us-west1 / us-central1 / us-east1).
- A custom VPC and subnet (10.0.1.0/24) with firewall rules for SSH, HTTP, and HTTPS.
- 30 GB standard boot disk on Ubuntu 24.04 LTS; ephemeral public IP via access config.
- Five resources plus a read-only image lookup; the same four commands every time.
Example configuration
A self-contained VPC and the instance; only the public SSH key is injected via metadata.
resource "google_compute_network" "vpc" {
name = "freetier-vpc"
auto_create_subnetworks = false
}
resource "google_compute_subnetwork" "subnet" {
name = "freetier-subnet"
network = google_compute_network.vpc.id
ip_cidr_range = "10.0.1.0/24"
region = var.region
}
resource "google_compute_instance" "vm" {
name = var.name
machine_type = "e2-micro" # Always Free
zone = "${var.region}-a"
boot_disk { initialize_params { image = "ubuntu-os-cloud/ubuntu-2404-lts-amd64"; size = 30 } }
network_interface { subnetwork = google_compute_subnetwork.subnet.id; access_config {} }
metadata = { ssh-keys = "ubuntu:${file(var.public_key_path)}" }
}Outcome
One e2-micro VM running at $0 within the Always-Free tier, fully reproducible, with no credentials in the repo and reviewable diffs before every change.