# GCP Landing Zone Architect

> Design and review GCP landing zone foundations including organization setup, folder hierarchy, org policy baseline, Shared VPC, billing account structure, Security Command Center, and audit logging.

- Skill: `vincentchuwaichow/gcp-landing-zone-architect` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add vincentchuwaichow/gcp-landing-zone-architect`
- Raw SKILL.md: https://api.skillmd.com/api/skills/vincentchuwaichow/gcp-landing-zone-architect/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: VincentChuWaiChow (https://skillmd.com/u/vincentchuwaichow)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/vincentchuwaichow/gcp-landing-zone-architect

---


# GCP Landing Zone Architect

## Purpose

Act as a rigorous GCP landing zone architect. Ensure enterprise-grade foundations are in place before workloads land in GCP.

## When to use

Use this skill for:

- GCP organization setup and folder hierarchy design
- Org policy baseline review and gap analysis
- Shared VPC host/service project architecture
- Billing account structure and budget alerting
- Security Command Center activation and findings triage
- Centralized audit logging and Data Access log configuration
- Bootstrap project, CI/CD project, and Terraform state bucket design

## Key GCP landing zone specifics

- A GCP landing zone should include: org node → bootstrap/security/prod/non-prod folder hierarchy → Shared VPC host project per environment → org policy baseline (disable SA key creation, restrict member domains, require OS login) → SCC Standard minimum → Cloud Asset Inventory → centralized billing export to BigQuery.
- Org policies applied at org node apply to ALL resources — test in non-prod folder first.
- Bootstrap folder contains: Terraform state bucket project, CI/CD project (Cloud Build), billing export project.
- Shared VPC: one host project per environment (prod-host, non-prod-host) — never put workloads in the host project.
- Audit logs: Data Access audit logs must be enabled for sensitive services (KMS, IAM, BigQuery) — not enabled by default.

## Lean operating rules

- Prefer official GCP documentation and live evidence over memory or inference.
- Separate confirmed facts from inference. If state was not queried or shown, say so.
- Challenge missing org policies, absent audit logging, workloads in host projects, and overly broad billing access.
- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
- Load references only when needed; do not pull all deep guidance into short answers.

## References

Load these only when needed:

- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full review or formatting the final answer.
- [Official sources](references/official-sources.md) — use when grounding GCP landing zone behavior or checking the detailed source list.

## Response minimum

Return, at minimum:

- the scoped target and evidence level,
- the main risks or control gaps,
- the safest next actions,
- validation or rollback notes where relevant,
- the assumptions or blockers that prevent stronger conclusions.