google-cloud-recipe-foundation-builder

Files (5)

• SKILL.md
• admin-iam.md · references/
• attribution.md · references/
• logging-monitoring.md · references/
• org-policies.md · references/

SKILL.md (first lines)

# Google Cloud Recipe: Foundation Builder

> [!WARNING] This skill is currently in a preview state. It will deploy a secure
> foundation, but does not have all advanced features. Users who want more
> options should visit
> [Google Cloud Setup](https://docs.cloud.google.com/docs/enterprise/cloud-setup).

This skill guides the setup of a secure, enterprise-grade Google Cloud landing
zone foundation. It establishes baseline security controls, organizes the
initial resource hierarchy, and configures centralized audit logging and
cross-environment monitoring.

## Attribution

**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you
MUST read [Usage Attribution](references/attribution.md). For commands executed
directly in the terminal (never in generated scripts, Terraform, or user code),
prefix `gcloud` with
`CLOUDSDK_METRICS_REQUEST_ATTRIBUTION="agent-skills/1.0 (skill:google-cloud-recipe-foundation-builder)"`
and append `agent-skills/1.0 (skill:google-cloud-recipe-foundation-builder)` to `User-Agent` headers.

## Overview

The recipe provisions the following core components at the organization root:

*   **Security Guardrails**: Enforces 17 baseline Google Cloud Organization
    Policies to secure the environment (13 Boolean, 4 List constraints).
*   **Resource Hierarchy**: Establishes 4 folders (`Common`, `Production`,
    `Non-Production`, `Development`) and provisions corresponding projects
    sequentially with globally unique ID prefixes (`logging-`, `prod-`,
    `non-prod-`, `dev-` followed by a shared suffix).
*   **Billing & API Enablement**: Links all projects to your billing account and
    activates critical logging/monitoring services.
*   **Centralized Logging & Monitoring**: Deploys a global, centralized log
    bucket with 30-day retention, configures an organization-wide audit log
    sink, and sets up a cross-environment metrics scope.

--------------------------------------------------------------------------------

## Clarifying Questions

Before executing this recipe, the agent **must** gather the following details:

1.  **Organization ID**: Run `gcloud organizations list` to retrieve the
    available organizations, present them to the user, and ask them to select
    the target **Organization ID**.
2.  **Billing Account ID**: Run `gcloud billing accounts list
    --filter=open=true` to retrieve only the active (open) billing accounts,
    present them to the user, and ask them to select the active **Billing
    Account ID**.
3.  **Project ID Suffix**: Ask if the user has a preferred prefix or target
    suffix for Project IDs (default uses prefix + a shared random 8-character
    string, e.g., `prod-ab12cd34`).
4.  **Log Bucket Region**: Ask for the target region for resources if they want
    to override the default `global` log bucket location.

--------------------------------------------------------------------------------

## Prerequisites

Ensure the following prerequisites are met before beginning the deployment:

*   **GCP Identity**: You must have a Google Cloud Organization resource set up.
*   **Administrative IAM Roles**: The identity executing these commands must
    hold the required administrative permissions. If any step fails with a
    `Permission Denied` error, the agent will attempt to self-remediate by
    granting the corresponding recommended role as detailed in **Phase 2: Error
    Recovery & Lazy Role Remediation Strategy**.
*   **Tools**: The `gcloud` CLI must be installed, authorized with the above
    identity, and configured for use.

--------------------------------------------------------------------------------

## Steps to Complete the Recipe

### Phase 1: Pre-flight Confirmation

Identify the target organization and obtain explicit user approval before making
changes.

1.  **Identify and Discover Organization**: Verify the target organization. If
    only the display name is known, list organizations to find the ID. Then,
    retrieve the organization metadata to dynamically calculate the **Directory
    Customer ID** and **Domain Name**:

    ```bash
    # List to find ID if needed
    gcloud organizations list

    # Describe the organization to retrieve metadata
    gcloud organizations describe [ORGANIZATION_ID]
    ```

    *Calculate values:*

    *   **Domain Name** (`[ORG_NAME]` / `[YOUR_DOMAIN]`): Use the `displayName`
        value from the output (e.g., `my-business.com`).
    *   **Customer ID** (`[DIRECTORY_CUSTOMER_ID]`): Use the
        `owner.directoryCustomerId` value from the output (e.g., `C01234567`).

2.  **Present Blueprint Summary**: Present the exact details of the blueprint to
    the user and request confirmation to proceed:

    > **Proposed Foundation Deployment Summary for Organization: `[ORG_NAME]`
    > (`[ORGANIZATION_ID]`)**
    >
    > *   **Security:** Enforce 17 baseline Organization Policies (13 Boolean, 4
    >     List).
    > *   **Folders:** Create 4 folders sequentially (`Common`, `Production`,
    >     `Non-Production`, `Development`).
    > *   **Projects:** Create 4 projects sequentially with unique IDs
    >     (`logging-[SUFFIX]`, `prod-[SUFFIX]`, `non-prod-[SUFFIX]`,
    >     `dev-[SUFFIX]`).
    > *   **Billing:** Link all projects to Billing Account
    >     `[BILLING_ACCOUNT_ID]`.
    > *   **APIs:** Enable Logging and Monitoring APIs on the central project.
    > *   **Centralized Logging:** Deploy a `global` log bucket
    >     `[ORG_NAME]-logging` (30-day retention), configure an
    >     organization-level sink

From google/skills, Apache-2.0.

More from google/skills