Terraform for foundations; Config Connector for workload-coupled infra.
Two tools, two layers — never let both manage the same live resource.
FactorTerraformConfig Connector
Best fitShared/foundational — networks, org policy, IAMNamespace-scoped, workload-adjacent resources
Review workflow.tf diff, standard software reviewSame PR as the app's own Deployment YAML
Drift detectionNeeds a scheduled plan jobContinuous reconciliation, built in
Hard rule: never manage the same GCP resource with both. Each reconciler assumes sole ownership — two controllers fighting over one resource flaps, each reverting the other's last change.