How do I install the GCP Services skill?

Run npx skillmds@latest add agentient/gcp-services in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the GCP Services skill do?

GCP Services Skill (IAM, Secret Manager, Networking) It is listed under DevOps & Infra on SkillMD.

Is GCP Services safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with GCP Services?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is GCP Services free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published GCP Services?

Agentient (@agentient) published this skill. Their other Agent Skills are listed on their SkillMD profile.

GCP Services by agentient — Agent Skill

Name: GCP Services
Author: Agentient

File contents

GCP Services Skill (IAM, Secret Manager, Networking)

Metadata (Tier 1)

Keywords: iam, service account, secret manager, vpc, firewall, permissions, least privilege, policy, network

File Patterns: .tf (google_project_iam_, google_secret_*, google_compute_network)

Modes: gcp_dev, deployment

Instructions (Tier 2)

IAM Least Privilege

Service Account Creation

gcloud iam service-accounts create SERVICE-sa \
  --display-name="Service Account for SERVICE"

Grant Minimal Permissions

# Secret Manager access
gcloud projects add-iam-policy-binding PROJECT \
  --member="serviceAccount:SERVICE-sa@PROJECT.iam.gserviceaccount.com" \
  --role="roles/secretmanager.secretAccessor"

# Cloud SQL client
gcloud projects add-iam-policy-binding PROJECT \
  --member="serviceAccount:SERVICE-sa@PROJECT.iam.gserviceaccount.com" \
  --role="roles/cloudsql.client"

NEVER Use Basic Roles

❌ roles/owner ❌ roles/editor ❌ roles/viewer (on service accounts)

✅ Use predefined roles (roles/run.invoker) ✅ Use custom roles for specific needs

Secret Manager

Create Secret

echo -n "SECRET_VALUE" | gcloud secrets create SECRET_NAME --data-file=-

Grant Access

gcloud secrets add-iam-policy-binding SECRET_NAME \
  --member="serviceAccount:SA@PROJECT.iam.gserviceaccount.com" \
  --role="roles/secretmanager.secretAccessor"

Access in Cloud Run

# As environment variable (less secure)
gcloud run deploy SERVICE --update-secrets=VAR=secret:version

# As mounted file (more secure)
gcloud run deploy SERVICE --update-secrets=/secrets/file=secret:version

Best Practices

Pin to specific versions in production (not :latest)
Enable rotation for sensitive secrets
Use automatic replication unless data residency required
Never pass secrets via environment variables in logs

VPC & Firewall

Create Custom VPC

gcloud compute networks create NETWORK \
  --subnet-mode=custom

gcloud compute networks subnets create SUBNET \
  --network=NETWORK \
  --region=REGION \
  --range=10.0.0.0/24

Firewall Rules (Deny by Default)

# Allow HTTPS from anywhere
gcloud compute firewall-rules create allow-https \
  --network=NETWORK \
  --allow=tcp:443 \
  --source-ranges=0.0.0.0/0

# Allow SSH from specific bastion
gcloud compute firewall-rules create allow-ssh-bastion \
  --network=NETWORK \
  --allow=tcp:22 \
  --source-ranges=10.0.1.0/24 \
  --target-tags=ssh-enabled

VPC Connector for Cloud Run

gcloud compute networks vpc-access connectors create CONNECTOR \
  --network=NETWORK \
  --region=REGION \
  --range=10.8.0.0/28

Anti-Patterns

❌ Using default VPC in production ❌ Overly permissive firewall rules (0.0.0.0/0 on SSH) ❌ Service account keys (use Workload Identity) ❌ Secrets in environment variables ❌ Basic IAM roles on service accounts

---name: gcp-servicesdescription: GCP Services Skill (IAM, Secret Manager, Networking)---# GCP Services Skill (IAM, Secret Manager, Networking)## Metadata (Tier 1)**Keywords**: iam, service account, secret manager, vpc, firewall, permissions, least privilege, policy, network**File Patterns**: *.tf (google_project_iam_*, google_secret_*, google_compute_network)**Modes**: gcp_dev, deployment---## Instructions (Tier 2)### IAM Least Privilege#### Service Account Creation```bashgcloud iam service-accounts create SERVICE-sa \ --display-name="Service Account for SERVICE"```#### Grant Minimal Permissions```bash# Secret Manager accessgcloud projects add-iam-policy-binding PROJECT \ --member="serviceAccount:SERVICE-sa@PROJECT.iam.gserviceaccount.com" \ --role="roles/secretmanager.secretAccessor"# Cloud SQL clientgcloud projects add-iam-policy-binding PROJECT \ --member="serviceAccount:SERVICE-sa@PROJECT.iam.gserviceaccount.com" \ --role="roles/cloudsql.client"```#### NEVER Use Basic Roles❌ roles/owner❌ roles/editor❌ roles/viewer (on service accounts)✅ Use predefined roles (roles/run.invoker)✅ Use custom roles for specific needs### Secret Manager#### Create Secret```bashecho -n "SECRET_VALUE" | gcloud secrets create SECRET_NAME --data-file=-```#### Grant Access```bashgcloud secrets add-iam-policy-binding SECRET_NAME \ --member="serviceAccount:SA@PROJECT.iam.gserviceaccount.com" \ --role="roles/secretmanager.secretAccessor"```#### Access in Cloud Run```bash# As environment variable (less secure)gcloud run deploy SERVICE --update-secrets=VAR=secret:version# As mounted file (more secure)gcloud run deploy SERVICE --update-secrets=/secrets/file=secret:version```#### Best Practices- Pin to specific versions in production (not :latest)- Enable rotation for sensitive secrets- Use automatic replication unless data residency required- Never pass secrets via environment variables in logs### VPC & Firewall#### Create Custom VPC```bashgcloud compute networks create NETWORK \ --subnet-mode=customgcloud compute networks subnets create SUBNET \ --network=NETWORK \ --region=REGION \ --range=10.0.0.0/24```#### Firewall Rules (Deny by Default)```bash# Allow HTTPS from anywheregcloud compute firewall-rules create allow-https \ --network=NETWORK \ --allow=tcp:443 \ --source-ranges=0.0.0.0/0# Allow SSH from specific bastiongcloud compute firewall-rules create allow-ssh-bastion \ --network=NETWORK \ --allow=tcp:22 \ --source-ranges=10.0.1.0/24 \ --target-tags=ssh-enabled```#### VPC Connector for Cloud Run```bashgcloud compute networks vpc-access connectors create CONNECTOR \ --network=NETWORK \ --region=REGION \ --range=10.8.0.0/28```### Anti-Patterns❌ Using default VPC in production❌ Overly permissive firewall rules (0.0.0.0/0 on SSH)❌ Service account keys (use Workload Identity)❌ Secrets in environment variables❌ Basic IAM roles on service accounts

Frequently asked questions

GCP Services