Guide · Agent skill
How to use the Google Cloud Landing Zone Builder agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The Google Cloud Landing Zone Builder is an agent skill that tells an AI agent to follow a fixed recipe for building a baseline landing zone under a Google Cloud Organization. It is aimed at platform and cloud engineers who are setting up a new organization and want a standard security foundation without designing one from scratch. By the end of this guide you will know what the skill does, how to install it, how to ask for it in plain language, and what it needs before it touches your cloud environment.
Google Cloud Landing Zone Buildergoogle/skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip. Download the skill ZIP from this page and unzip the google-cloud-recipe-foundation-builder folder.
- 2Place or upload the skill. Copy the folder into ~/.claude/skills/ or your project's .claude/skills/, or upload it under Settings → Capabilities → Skills in the Claude apps.
- 3Check prerequisites. Confirm you have an Organization resource, an installed and authorized gcloud CLI, an open billing account and administrative IAM permissions.
- 4Make the request. Ask the agent to set up a baseline landing zone for your Google Cloud Organization.
- 5Choose organization and billing account. Select the Organization ID and open Billing Account ID from the lists the agent shows, and state any project suffix or region preference.
- 6Review the summary. Read the deployment summary covering policies, folders, projects, billing, APIs and logging.
- 7Approve or decline. Reply Yes only if you accept the changes. Otherwise the operation is aborted.
What is an agent skill?
An agent skill is a folder containing a SKILL.md file and optional reference files and scripts. When it is installed, an AI agent reads the instructions and follows them when a request matches the skill's description.
This skill is named google-cloud-recipe-foundation-builder and is published under the Apache-2.0 licence in the google/skills repository.
What the skill makes the agent do
The recipe provisions core components at the organization root. It enforces 17 baseline Google Cloud Organization Policies (13 Boolean and 4 List constraints), creates four folders, and provisions matching projects.
It also links projects to your billing account, enables logging and monitoring services, and sets up a central log bucket with 30-day retention, an organization-wide audit log sink and a cross-environment metrics scope.
- Folders: Common, Production, Non-Production, Development
- Projects use the prefixes logging-, prod-, non-prod- and dev- followed by a shared suffix, for example prod-ab12cd34
- Log bucket named [ORG_NAME]-logging in the global location
How to install the skill
Download the skill ZIP from this page and unzip it. For a personal install, place the folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder.
If you use the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.
- Personal: ~/.claude/skills/
- Project: .claude/skills/ inside your project folder
- Claude apps: Settings → Capabilities → Skills, then upload
How to trigger the skill with a natural request
Ask in plain language that describes setting up a new Google Cloud Organization or a secure, enterprise-grade landing zone foundation. The skill's description says it applies in those situations.
Do not use it for onboarding a single project. The skill says to use google-cloud-recipe-onboarding or a product-specific skill for that.
- Example: Set up a baseline landing zone for my new Google Cloud Organization.
- Example: Build a secure enterprise foundation for our Google Cloud org with centralized logging.
What the agent does before making changes
The agent first runs gcloud organizations list and gcloud billing accounts list --filter=open=true, then asks you to choose the organization and billing account. It also asks for a project ID prefix or suffix preference and a region if you want to change the global log bucket location.
It then describes the organization and presents a deployment summary. It waits for your explicit Yes before creating anything. If you decline, the operation is aborted.
gcloud organizations list
gcloud billing accounts list --filter=open=trueWhat you need before you start
You need a Google Cloud Organization resource, the gcloud CLI installed and authorized, and an open billing account with permission to link projects. The identity running the commands needs administrative IAM permissions on the organization.
If a step fails with Permission Denied, the agent may try to grant recommended roles to the active identity using gcloud organizations add-iam-policy-binding or gcloud billing accounts add-iam-policy-binding, then retry. Check this behaviour before you approve the run.
- Google Cloud Organization resource
- gcloud CLI installed and authorized
- Open billing account with permission to link projects
- Administrative IAM permissions on the organization
Safety notes: scripts and network access
This skill runs scripts and uses the network. It makes billing and IAM changes that can affect the whole company, so only users with authority over organization-wide settings should run it.
The attribution reference asks the agent to prefix gcloud commands with CLOUDSDK_METRICS_REQUEST_ATTRIBUTION set to the skill identifier. This tag only identifies the skill and its version. It is set inline on each command and not saved with gcloud config set.
- Review the deployment summary before approving.
- Do not run it in an organization that already has a landing zone. The files do not describe how existing folders, policies or log sinks are handled, and re-running could conflict with them.
- The skill is in preview and does not include every advanced feature. Google Cloud Setup is the referenced alternative for more options.
What people use it for
- Setting up a new Google Cloud Organization with a standard set of security guardrails.
- Creating Production, Non-Production and Development folders with matching projects from the start.
- Establishing a central logging project with an organization-wide audit log sink and a 30-day retention bucket.
- Giving an enterprise platform team a repeatable baseline to review against their own requirements.
Frequently asked questions
How do I install the Google Cloud Landing Zone Builder agent skill?
Download the skill ZIP from this page and unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. In the Claude apps you can instead upload it under Settings → Capabilities → Skills.
What are the requirements for this skill?
You need a Google Cloud Organization resource, the gcloud CLI installed and authorized, an open billing account with permission to link projects, and administrative IAM permissions on the organization.
Is the skill free to use?
The skill is published under the Apache-2.0 licence. This page does not state any pricing for Google Cloud resources the recipe creates, so check your billing account before running it.
Can I use it for a single project?
No. The skill says not to use it for individual project onboarding and recommends google-cloud-recipe-onboarding or a product-specific skill instead.
What happens if I already have a landing zone?
The skill is not designed for organizations that already have a landing zone, because re-running it could conflict with existing policies, folders and log sinks. The files do not describe how existing resources are handled.
Does the agent make changes without asking?
No. It first lists organizations and billing accounts, presents a deployment summary, and waits for your explicit approval before making changes.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits platform or cloud engineers who are setting up a new Google Cloud Organization and want a standard, enterprise-style security baseline. It is a poor fit for single-project onboarding, organizations that already have a landing zone, or anyone without authority to change organization-wide billing and IAM settings.
Download the skill