GCP Landing Zone Rollout Playbook

GCP Landing Zone Rollout Playbook

A Google Cloud landing zone provides the governed foundation: a resource hierarchy of folders and projects, organization policies, shared VPC networking, and a project factory, all delivered as code. Building it first ensures every workload lands in a project that is secure, billed correctly, and connected.

Phase-by-Phase

Resource Hierarchy Design. Design the folder structure under the organization node to mirror environments and business domains, decide the project model, and define a labeling standard for cost attribution. The hierarchy drives IAM inheritance, so plan it deliberately.

Org Policy and IAM. Apply organization policy constraints to restrict regions, enforce shielded VMs, and block public IPs. Design an IAM model on least privilege using groups and predefined roles, and route audit logs to a centralized sink.

Shared VPC Networking. Build a shared VPC so projects attach to centrally managed networks, configure private service access for managed services, and establish Cloud Interconnect for hybrid connectivity.

Project Factory. Automate project creation with a Terraform-based project factory so teams request and receive governed projects. Publish reusable modules and onboard a pilot to validate before broad rollout.

Team and Roles

A platform architect owns the hierarchy and network design. DevOps builds the project factory and module registry. Security owns org policies and IAM. SRE owns logging and monitoring with Cloud Operations, Prometheus, and Grafana. Product owns onboarding.

Risks and Mitigations

Org policy changes have wide blast radius; test in a sandbox folder first. Project sprawl is controlled by the factory and labeling. Shared VPC adds complexity; document host and service project boundaries clearly. IAM over-granting is mitigated with groups, role recommendations, and periodic access review.

Success Criteria

Project provisioning is fast and self-service, org policies cover the whole organization, the estate is audit-ready, and teams operate independently within their projects.

Tooling

Terraform with the project factory module defines the landing zone, GitHub Actions runs the pipeline, Vault or Secret Manager handles secrets, and Prometheus and Grafana provide observability.