GCP Landing Zone Setup Checklist

When to Use This Checklist

Use this when building a Google Cloud foundation that will host production workloads, following Google's enterprise foundations blueprint. It sets up the resource hierarchy, org policies, networking, and logging that everything else inherits, and it should be done before migration or large-scale build.

It applies equally to a fresh organization and to consolidating ungoverned projects under a coherent hierarchy.

How to Use This Checklist

Start with the organization, folder, and project hierarchy, since IAM, org policies, and billing all attach to it. Apply organization policy constraints early so guardrails cover every project. Treat the Shared VPC, centralized audit logging, and Security Command Center items as required.

Deploy with the Cloud Foundation Toolkit Terraform modules rather than the console so the foundation is reproducible and reviewable. Prove the project factory with a pilot project before opening it to teams.

What Good Looks Like

A good GCP landing zone has a clear folder and project hierarchy, org-policy guardrails, and least-privilege IAM bound to groups rather than individuals. Networking uses a Shared VPC with planned addressing and hierarchical firewalls, audit logs flow into a locked logging project and BigQuery, and Security Command Center monitors the estate. Billing is exported to BigQuery, resources are consistently labeled, and projects are created through a codified factory.

Common Pitfalls

Creating projects directly under the organization with no folder structure makes policy and access management chaotic. Per-user IAM grants instead of group bindings become unmaintainable. Independent per-project VPCs lead to overlapping ranges and complex peering, where a Shared VPC would have been simpler. Skipping centralized log sinks leaves gaps during investigations, and console-built foundations drift from their intended state.

Related Resources

Ground the design in the Google Cloud Architecture Framework and the cloud landing-zone best practice. Use the Terraform module patterns to keep the foundation maintainable and the tagging/labeling practice for cost allocation.