/google-cloud-recipe-foundation-builder

name: google-cloud-recipe-foundation-builder
metadata:
  version: "1.0.1"
  category: GettingStarted
description: >-
  Deploys a baseline landing zone foundation for a Google Cloud Organization, establishing security guardrails using Organization Policies, resource hierarchy folders and projects, billing association, and centralized logging and monitoring. Deploys Google Cloud's recommended security controls and architecture.
  Use when setting up a new Google Cloud Organization or establishing a secure, enterprise-grade landing zone foundation.

  Don't use for individual project onboarding (use google-cloud-recipe-onboarding or product-specific skills instead).

Google Cloud Recipe: Foundation Builder

> [!WARNING] This skill is currently in a preview state. It will deploy a secure > foundation, but does not have all advanced features. Users who want more > options should visit > [Google Cloud Setup](https://docs.cloud.google.com/docs/enterprise/cloud-setup).

This skill guides the setup of a secure, enterprise-grade Google Cloud landing zone foundation. It establishes baseline security controls, organizes the initial resource hierarchy, and configures centralized audit logging and cross-environment monitoring.

Attribution

**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you MUST read [Usage Attribution](references/attribution.md). For commands executed directly in the terminal (never in generated scripts, Terraform, or user code), prefix `gcloud` with `CLOUDSDK_METRICS_REQUEST_ATTRIBUTION="agent-skills/1.0 (skill:google-cloud-recipe-foundation-builder)"` and append `agent-skills/1.0 (skill:google-cloud-recipe-foundation-builder)` to `User-Agent` headers.

Overview

The recipe provisions the following core components at the organization root:

• **Security Guardrails**: Enforces 17 baseline Google Cloud Organization

Policies to secure the environment (13 Boolean, 4 List constraints).

• **Resource Hierarchy**: Establishes 4 folders (`Common`, `Production`,

`Non-Production`, `Development`) and provisions corresponding projects sequentially with globally unique ID prefixes (`logging-`, `prod-`, `non-prod-`, `dev-` followed by a shared suffix).

• **Billing & API Enablement**: Links all projects to your billing account and

activates critical logging/monitoring services.

• **Centralized Logging & Monitoring**: Deploys a global, centralized log

bucket with 30-day retention, configures an organization-wide audit log sink, and sets up a cross-environment metrics scope.

--------------------------------------------------------------------------------

Clarifying Questions

Before executing this recipe, the agent **must** gather the following details:

1. **Organization ID**: Run `gcloud organizations list` to retrieve the available organizations, present them to the user, and ask them to select the target **Organization ID**. 2. **Billing Account ID**: Run `gcloud billing accounts list --filter=open=true` to retrieve only the active (open) billing accounts, present them to the user, and ask them to select the active **Billing Account ID**. 3. **Project ID Suffix**: Ask if the user has a preferred prefix or target suffix for Project IDs (default uses prefix + a shared random 8-character string, e.g., `prod-ab12cd34`). 4. **Log Bucket Region**: Ask for the target region for resources if they want to override the default `global` log bucket location.

--------------------------------------------------------------------------------

Prerequisites

Ensure the following prerequisites are met before beginning the deployment:

• **GCP Identity**: You must have a Google Cloud Organization resource set up.
• **Administrative IAM Roles**: The identity executing these commands must

hold the required administrative permissions. If any step fails with a `Permission Denied` error, the agent will attempt to self-remediate by granting the corresponding recommended role as detailed in **Phase 2: Error Recovery & Lazy Role Remediation Strategy**.

• **Tools**: The `gcloud` CLI must be installed, authorized with the above

identity, and configured for use.

--------------------------------------------------------------------------------

Steps to Complete the Recipe

Phase 1: Pre-flight Confirmation

Identify the target organization and obtain explicit user approval before making changes.

1. **Identify and Discover Organization**: Verify the target organization. If only the display name is known, list organizations to find the ID. Then, retrieve the organization metadata to dynamically calculate the **Directory Customer ID** and **Domain Name**:

    # List to find ID if needed
    gcloud organizations list

    # Describe the organization to retrieve metadata
    gcloud organizations describe [ORGANIZATION_ID]

*Calculate values:*

• **Domain Name** (`[ORG_NAME]` / `[YOUR_DOMAIN]`): Use the `displayName`

value from the output (e.g., `my-business.com`).

• **Customer ID** (`[DIRECTORY_CUSTOMER_ID]`): Use the

`owner.directoryCustomerId` value from the output (e.g., `C01234567`).

2. **Present Blueprint Summary**: Present the exact details of the blueprint to the user and request confirmation to proceed:

> **Proposed Foundation Deployment Summary for Organization: `[ORG_NAME]` > (`[ORGANIZATION_ID]`)** > > * **Security:** Enforce 17 baseline Organization Policies (13 Boolean, 4 > List). > * **Folders:** Create 4 folders sequentially (`Common`, `Production`, > `Non-Production`, `Development`). > * **Projects:** Create 4 projects sequentially with unique IDs > (`logging-[SUFFIX]`, `prod-[SUFFIX]`, `non-prod-[SUFFIX]`, > `dev-[SUFFIX]`). > * **Billing:** Link all projects to Billing Account > `[BILLING_ACCOUNT_ID]`. > * **