GCP Landing Zone Architecture Blueprint

The Problem This Blueprint Solves

Your team chose Google Cloud Platform, but the setup guide from your first sprint left you with a flat project structure, default VPC networks, and primitive IAM bindings at the project level. BigQuery datasets have no access controls beyond project-level roles, and your Compute Engine instances run with default service accounts that have Editor permissions on the entire project. One compromised workload can access everything.

This blueprint is the GCP enterprise foundation I deployed for a media analytics company processing 4.7PB of video metadata monthly across BigQuery, Vertex AI, and GKE — supporting 180 engineers with proper resource isolation and a 97% Security Command Center compliance score.

What You Get

• Architecture diagrams — Organization/folder/project hierarchy, Shared VPC topology, Cloud NAT egress path, Private Google Access configuration, and centralized logging with Cloud Logging (Draw.io)
• Terraform modules — Organization structure with folders, project factory for automated project provisioning, Shared VPC host and service projects, custom IAM roles, Organization Policy constraints, and VPC Service Controls perimeter
• Security baseline — 45 Organization Policy constraints enforced (disable default networks, restrict public IPs, enforce OS login, disable service account key creation), Security Command Center configuration, and Chronicle SIEM integration
• Data governance — BigQuery dataset and table-level IAM, column-level security with policy tags, Data Catalog classification, and DLP API integration for PII detection

Key Architecture Decisions

• Shared VPC over per-project VPCs — Per-project VPCs create network silos that require VPN or VPC peering for communication. Shared VPC centralizes network management in a host project while granting service projects access to specific subnets. One network team manages IP allocation, firewall rules, and routing for the entire organization.
• VPC Service Controls for data exfiltration prevention — IAM controls who can call an API. VPC Service Controls add where and how — restricting BigQuery access to requests originating from within your VPC perimeter. Even a compromised service account with BigQuery Admin role cannot exfiltrate data to an external project outside the perimeter.
• Workload Identity Federation over service account keys — Service account keys are the GCP equivalent of permanent credentials — they do not expire, cannot be audited for usage location, and if leaked, grant indefinite access. Workload Identity Federation provides short-lived, automatically rotated credentials for external workloads (GitHub Actions, AWS, on-premises) without distributing secrets.
• Organization Policy constraints in deny mode — 45 constraints block insecure configurations at the organization level. constraints/compute.vmExternalIpAccess denies public IPs on all VMs. constraints/iam.disableServiceAccountKeyCreation prevents anyone from creating long-lived credentials. These are architectural guardrails, not policies that rely on engineer compliance.

Who This Blueprint Is For

• GCP Cloud Architects building enterprise foundations beyond the quickstart guide
• Platform Engineers designing multi-project structures for growing engineering teams
• Security Engineers implementing GCP security baselines for compliance requirements
• Data Engineers who need governance controls around BigQuery datasets containing sensitive data

Your First 48 Hours

Deploy the folder structure and Organization Policy constraints Terraform module into a sandbox organization. Create a test project under the "Development" folder and attempt to create a VM with an external IP — the Organization Policy should block it. On day two, deploy the Shared VPC module with one host project and one service project. Create a GKE cluster in the service project using a subnet from the host project. Verify that the cluster pods can reach Private Google Access endpoints without a public IP or Cloud NAT.

Limitations and Trade-offs

VPC Service Controls add complexity to multi-cloud architectures — external API calls from within a perimeter require access levels and ingress rules that can be difficult to debug. Shared VPC limits service projects to 1,000 per host project. Organization Policies apply to all projects under the org node; exceptions require per-folder or per-project overrides. GCP's IAM model differs from AWS's in that deny policies are a separate feature (IAM Deny Policies) — the blueprint includes these but they are still in GA preview for some resource types.