diff --git a/cluster_regional.tf b/cluster_regional.tf
index 61c2df6b4e..8b6eeb4d1f 100644
--- a/cluster_regional.tf
+++ b/cluster_regional.tf
@@ -33,6 +33,8 @@ resource "google_container_cluster" "primary" {
   logging_service    = "${var.logging_service}"
   monitoring_service = "${var.monitoring_service}"
 
+  master_authorized_networks_config = "${var.master_authorized_networks_config}"
+
   addons_config {
     http_load_balancing {
       disabled = "${var.http_load_balancing ? 0 : 1}"
diff --git a/cluster_zonal.tf b/cluster_zonal.tf
index 053fcde549..c506558da4 100644
--- a/cluster_zonal.tf
+++ b/cluster_zonal.tf
@@ -33,6 +33,8 @@ resource "google_container_cluster" "zonal_primary" {
   logging_service    = "${var.logging_service}"
   monitoring_service = "${var.monitoring_service}"
 
+  master_authorized_networks_config = "${var.master_authorized_networks_config}"
+
   addons_config {
     http_load_balancing {
       disabled = "${var.http_load_balancing ? 0 : 1}"
diff --git a/outputs.tf b/outputs.tf
index d74cdbcb31..98f8fa8754 100644
--- a/outputs.tf
+++ b/outputs.tf
@@ -60,6 +60,11 @@ output "monitoring_service" {
   value       = "${local.cluster_monitoring_service}"
 }
 
+output "master_authorized_networks_config" {
+  description = "Networks from which access to master is permitted"
+  value       = "${var.master_authorized_networks_config}"
+}
+
 output "master_version" {
   description = "Current master kubernetes version"
   value       = "${local.cluster_master_version}"
diff --git a/variables.tf b/variables.tf
index 643fcbf0e9..e70e557369 100644
--- a/variables.tf
+++ b/variables.tf
@@ -65,6 +65,25 @@ variable "node_version" {
   default     = ""
 }
 
+variable "master_authorized_networks_config" {
+  type = "list"
+
+  description = <<EOF
+  The desired configuration options for master authorized networks. Omit the nested cidr_blocks attribute to disallow external access (except the cluster node IPs, which GKE automatically whitelists)
+
+  ### example format ###
+  default = [{
+    cidr_blocks = [{
+      cidr_block   = "10.0.0.0/8"
+      display_name = "example_network"
+    }],
+  }]
+
+  EOF
+
+  default = []
+}
+
 variable "horizontal_pod_autoscaling" {
   description = "Enable horizontal pod autoscaling addon"
   default     = false