Skip to content
Get packs

Google Cloud Landing Zone Builder

Sets up a secured baseline Google Cloud Organization with policies, folders, projects and central logging

Source Download skill
Repository
google/skills
Stars
21,782
Licence
Apache-2.0
Files
5 files

What it does

When installed, the agent follows a step-by-step recipe to build a baseline 'landing zone' for a Google Cloud Organization. It enforces 17 security Organization Policies, creates four folders (Common, Production, Non-Production, Development) with matching projects, links them to a billing account, and sets up centralized audit logging and monitoring. The agent must first list your organizations and billing accounts, show a deployment summary, and wait for your explicit approval before making changes.

Great for

  • Platform or cloud engineers setting up a new Google Cloud Organization
  • Teams that want a standard, enterprise-style security foundation without designing it from scratch

Skip it if

  • Onboarding a single project, since the skill says to use other recipes or product-specific skills instead
  • Organizations that already have a landing zone, because re-running it could conflict with existing policies, folders and log sinks (the files do not describe how existing resources are handled)
  • Users without authority to change organization-wide settings, since it can make billing and IAM changes that affect the whole company

Try asking

  • “Set up a secure Google Cloud landing zone for my new organization”
  • “Create the Common, Production, Non-Production and Development folders with matching projects and billing”
  • “Apply baseline Organization Policies and centralized audit logging to my Google Cloud org”
Step-by-step guide: how to use Google Cloud Landing Zone BuilderInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 5 original files, the Apache-2.0 licence and an attribution note.

    google-cloud-recipe-foundation-builder.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip google-cloud-recipe-foundation-builder.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip google-cloud-recipe-foundation-builder.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Review the deployment summary carefully, especially organization ID, billing account and project suffix, before approving.
  • Use a dedicated admin identity with the least privileges needed, and be cautious about allowing the agent to grant itself roles.
  • The skill is in preview and warns it lacks some advanced options; check the linked Google Cloud Setup docs for fuller configuration.

What's inside

  • references/admin-iam.md
  • references/attribution.md
  • references/logging-monitoring.md
  • references/org-policies.md
  • SKILL.md

Redistributed unmodified from google/skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.