From gcp
Provision and sync the GCP landing zone — Organization, Folders, Projects, Organization Policies, Billing Account links, and budget alerts — from a landing-zone-design.md and naming-convention.md. Uses the GCP MCP server. Use when applying or updating the GCP cloud structure after running design-landing-zone.
How this skill is triggered — by the user, by Claude, or both
Slash command
/gcp:manage-gcp-landing-zoneThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Implementation
Implementation
resourcemanager.folders.create, resourcemanager.folders.updateresourcemanager.projects.create, resourcemanager.projects.moveorgpolicy.policies.create, orgpolicy.policies.updatebilling.accounts.getIamPolicy, billing.accounts.setIamPolicybilling.resourceAssociations.create (to link projects to billing accounts)budgets.budgets.create, budgets.budgets.updateNote: For large deployments, consider using GCP Fabric FAST or the Google Cloud Landing Zones blueprint rather than provisioning resources individually.
Apply the landing zone definition from landing-zone-design.md to GCP. Ensure that:
This skill is idempotent.
When writing configurations or documentation, you MUST strictly adhere to the structural notation and types defined in the book. Before proceeding, read the following reference files:
references/notation.mdreferences/types.mdBefore proceeding, ask the user (or infer from context):
landing-zone-design.md. Read it first.naming-convention.md.eu01) to GCP region names (e.g., europe-west1).Read both input documents before proceeding.
Read landing-zone-design.md and naming-convention.md. Extract:
Validate that all names conform to GCP naming constraints:
Note that GCP Project IDs are globally unique and immutable — once created, they cannot be renamed. Confirm the proposed IDs before proceeding.
For each Folder in the design:
Do not delete Folders not in the design — Folders containing Projects cannot be deleted.
For each Project in the design:
sector, tier, etc.). Remember: GCP uses label keys without colons — adapt from the naming convention's tag keys accordingly.Required projects beyond the design:
audit project exists in the Security folder and has a centralized log sink.connectivity project (Shared VPC host) exists in the Platform folder.Organization Policies constrain what can be configured within the GCP resource hierarchy. Apply constraints from the guardrail requirements in the design.
Recommended constraints at Organization level:
constraints/compute.disableSerialPortAccess — deny serial port access to VMsconstraints/iam.disableServiceAccountKeyCreation — prevent long-lived service account keysconstraints/iam.disableServiceAccountKeyUpload — prevent external key uploadconstraints/iam.allowedPolicyMemberDomains — restrict IAM members to the organization's domainconstraints/storage.uniformBucketLevelAccess — enforce uniform bucket-level access on Cloud StorageAt Sector Folder level:
constraints/gcp.resourceLocations — restrict resource creation to declared regionsAt Tier("live") Folder level:
constraints/compute.requireShieldedVm — require Shielded VM on all Compute Engine instancesconstraints/sql.restrictPublicIp — deny public IP assignment to Cloud SQL instancesTier("sandbox") — more permissive; omit compute security constraints to allow faster iteration.
For each constraint:
For the audit project:
For each Project, configure a budget:
Note: GCP billing budgets are created on the Billing Account, filtered by project. Ensure the Billing Account permits the executing identity to manage budgets.
Produce a summary:
In dry-run mode, produce the report without making changes.
Produce a Markdown report named gcp-landing-zone-report.md:
# GCP Landing Zone Sync Report
**Date**: [timestamp]
**Mode**: [applied / dry-run]
**Organization ID**: [org-id]
## Folders
| Display Name | Parent | Status |
|-------------|--------|--------|
| Platform | Organization | created |
| ECommerce | Organization | exists |
## Projects
| Project ID | Folder | Billing Linked | Status |
|-----------|--------|---------------|--------|
| ecommerce-live | ECommerce/Live | yes | created |
| audit | Security | yes | exists |
## Organization Policies
| Constraint | Scope | Status |
|-----------|-------|--------|
| iam.disableServiceAccountKeyCreation | Organization | applied |
| gcp.resourceLocations (eu01, us01) | ECommerce folder | applied |
| compute.requireShieldedVm | ECommerce/Live folder | applied |
## Centralized Audit
| Component | Status |
|-----------|--------|
| Org-level log sink | created |
| Security Command Center | enabled |
| Audit bucket retention policy | applied |
## Budget Alerts
| Project | Amount | Status |
|---------|--------|--------|
| ecommerce-live | $5,000/mo | created |
## Open Items
[Policy propagation delays, globally taken Project IDs, billing account access issues, etc.]
This skill is grounded in Chapter 6: Infrastructure of Crafting Platforms.
npx claudepluginhub craftingplatforms/ai --plugin gcpDesign and review GCP landing zone foundations: org setup, folder hierarchy, org policy baseline, Shared VPC, billing structure, Security Command Center, and audit logging.
Guides multi-account strategies for new cloud projects from day one, covering account structures, environment isolation, blast radius control, billing separation, landing zones, and governance.
Provides GCP architecture expertise for organization/project structure, VPC networking, data/analytics, Kubernetes/serverless, AI/ML platforms, security, and cost optimization. Use when designing or evaluating GCP systems.