- enable api: "dns.googleapis.com", "compute.googleapis.com", "cloudresourcemanager.googleapis.com"
- create custom vpc
- create 1 subnet without external IP ranges
- create Cloud DNS private zone
- create type CNAME record set
- create type A record set
- open variables.tf file and setup arguments
- run terraform init command
- run terraform apply command
Noted that if you run terraform destroy command, the entire infrastructure build along with this terraform code will be destroyed. Thus, if you still need the dns.googleapis.com or compute.googleapis.com API to be enabled, you shall annotate the google_project_service.service resource block in order to protect it from being destroyed.
Reference: https://cloud.google.com/vpc/docs/configure-private-google-access-hybrid#config