*`credentials` - (Optional) The path or contents of a file that contains your
service account private key in JSON format. You can download your existing
[Google Cloud service account file] from the Google Cloud Console, or you can
create a new one from the same page.
Credentials can also be specified using any of the following environment
variables (listed in order of precedence):
*`GOOGLE_CREDENTIALS`
*`GOOGLE_CLOUD_KEYFILE_JSON`
*`GCLOUD_KEYFILE_JSON`
The [`GOOGLE_APPLICATION_CREDENTIALS`][adc]
environment variable can also contain the path of a file to obtain credentials
from.
If no credentials are specified, the provider will fall back to using the
[Google Application Default Credentials][adc].
If you are running Terraform from a GCE instance, see [Creating and Enabling
Service Accounts for Instances][gce-service-account] for details.
On your computer, if you have made your identity available as the
Application Default Credentials by running [`gcloud auth application-default
login`][gcloud adc], the provider will use your identity.
-> [Service accounts][service accounts] are the recommended way
to manage GCP credentials. [GCE metadata] is also acceptable, although it can
only be used when running Terraform from within [certain GCP resources](https://cloud.google.com/docs/authentication/production#obtaining_credentials_on_compute_engine_kubernetes_engine_app_engine_flexible_environment_and_cloud_functions).
Credentials obtained through `gcloud` are not guaranteed to work for all APIs.
*`project` - (Optional) The ID of the project to apply any resources to. This
can also be specified using any of the following environment variables (listed
in order of precedence):
*`GOOGLE_PROJECT`
*`GOOGLE_CLOUD_PROJECT`
*`GCLOUD_PROJECT`
*`CLOUDSDK_CORE_PROJECT`
-> `GOOGLE_PROJECT` is the recommended environment variable to use if
you choose to add your project using environment variables.
*`region` - (Optional) The region to operate under, if not specified by a given resource.
This can also be specified using any of the following environment variables (listed in order of
precedence):
*`GOOGLE_REGION`
*`GCLOUD_REGION`
*`CLOUDSDK_COMPUTE_REGION`
*`zone` - (Optional) The zone to operate under, if not specified by a given resource.
This can also be specified using any of the following environment variables (listed in order of
precedence):
*`GOOGLE_ZONE`
*`GCLOUD_ZONE`
*`CLOUDSDK_COMPUTE_ZONE`
[Google Cloud service account file]: https://console.cloud.google.com/apis/credentials/serviceaccountkey