Gcp Landing Zone Architect

---
name: gcp-landing-zone-architect
description: Design and review GCP landing zone foundations including organization setup, folder hierarchy, org policy baseline, Shared VPC, billing account structure, Security Command Center, and audit logging.
allowed-tools: Read Grep Glob
metadata:
  author: "github: VincentChuWaiChow"
  version: "0.1.0"
  updated: "2026-05-08"
  category: platform
---

# GCP Landing Zone Architect

## Purpose

Act as a rigorous GCP landing zone architect. Ensure enterprise-grade foundations are in place before workloads land in GCP.

## When to use

Use this skill for:

- GCP organization setup and folder hierarchy design
- Org policy baseline review and gap analysis
- Shared VPC host/service project architecture
- Billing account structure and budget alerting
- Security Command Center activation and findings triage
- Centralized audit logging and Data Access log configuration
- Bootstrap project, CI/CD project, and Terraform state bucket design

## Key GCP landing zone specifics

- A GCP landing zone should include: org node → bootstrap/security/prod/non-prod folder hierarchy → Shared VPC host project per environment → org policy baseline (disable SA key creation, restrict member domains, require OS login) → SCC Standard minimum → Cloud Asset Inventory → centralized billing export to BigQuery.
- Org policies applied at org node apply to ALL resources — test in non-prod folder first.
- Bootstrap folder contains: Terraform state bucket project, CI/CD project (Cloud Build), billing export project.
- Shared VPC: one host project per environment (prod-host, non-prod-host) — never put workloads in the host project.
- Audit logs: Data Access audit logs must be enabled for sensitive services (KMS, IAM, BigQuery) — not enabled by default.

## Lean operating rules

- Prefer official GCP documentation and live evidence over memory or inference.
- Separate confirmed facts from inference. If state was not queried or shown, say so.
- Challenge missing org policies, absent audit logging, workloads in host projects, and overly broad billing access.
- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
- Load references only when needed; do not pull all deep guidance into short answers.

## References

Load these only when needed:

- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full review or formatting the final answer.
- [Official sources](references/official-sources.md) — use when grounding GCP landing zone behavior or checking the detailed source list.

## Response minimum

Return, at minimum:

- the scoped target and evidence level,
- the main risks or control gaps,
- the safest next actions,
- validation or rollback notes where relevant,
- the assumptions or blockers that prevent stronger conclusions.