{"id":8384,"date":"2024-08-28T12:59:18","date_gmt":"2024-08-28T12:59:18","guid":{"rendered":"https:\/\/rax-stg-wp-aws.com\/blogs\/building-a-google-cloud-landing-zone-in-a-scalable-repeatable-and-secure-way-part-1\/"},"modified":"2026-11-03T19:29:35","modified_gmt":"2026-11-03T19:29:35","slug":"building-a-google-cloud-landing-zone-in-a-scalable-repeatable-and-secure-way-part-1","status":"publish","type":"blogs","link":"https:\/\/www.rackspace.com\/en-gb\/blogs\/building-a-google-cloud-landing-zone-in-a-scalable-repeatable-and-secure-way-part-1\/","title":{"rendered":"Building a Google Cloud Landing Zone in a Scalable, Repeatable and Secure Way (Part 1)"},"content":{"rendered":"<p><strong>Introduction<\/strong><\/p>\n<p>Landing zones are a way for an organization or enterprise to build its Google Cloud environment in a structured and consistent way, following a load of proven best practices. It ensures that all the tenants that run on the landing zone avoid reinventing the wheel, and, using appropriate shared components, are adhering to agreed policies and are only building their environments using approved IaC routes.<\/p>\n<p><strong>Overview of Cloud Foundation Fabric and Fabric FAST<\/strong><\/p>\n<p><a href=\"https:\/\/github.com\/GoogleCloudPlatform\/cloud-foundation-fabric\">Cloud Foundation Fabric<\/a> was designed from the ground-up to provide a robust way to implement a landing zone. It provides a set of Terraform modules, a landing zone blueprint, a set of reference blueprints to achieve certain goals (e.g., working with Cloud SQL, Dataflow and BigQuery, GKE, etc.) and Fabric FAST.<\/p>\n<p><a href=\"https:\/\/github.com\/GoogleCloudPlatform\/cloud-foundation-fabric\/tree\/master\/fast\">Fabric FAST<\/a> is a production-ready landing zone blueprint implementation, built by pre-aggregating the Fabric reference blueprints. It\u2019s a Terraform-based solution for bootstrapping and building a GCP LZ from scratch.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/27011-body-Picture1_0.png\" alt=\"GCPLZ pic 1\" \/><\/p>\n<p class=\"MsoNormal\">In this blog, I will be using FAST to build a landing zone. Google describes FAST as \u201can ideal blueprint for organizations of all sizes, ranging from startups to the largest companies.\u201dSince it\u2019s open source, if you stumble across any issues along the way, you can always make changes to improve FAST and raise a PR to incorporate your changes.<\/p>\n<p>&nbsp;<strong>Pre-requisites<\/strong><\/p>\n<p>First, make sure you have the following prerequisites:<\/p>\n<ul>\n<li>You have Git installed and a<a href=\"https:\/\/github.com\/\"> GitHub account<\/a>.<\/li>\n<li>You have <a href=\"https:\/\/developer.hashicorp.com\/terraform\/downloads\">Terraform<\/a> installed, the infrastructure-as-code tool we\u2019ll use to run the Fabric FAST process.<\/li>\n<li>You have a domain. If you don\u2019t yet have one, you\u2019ll need to register one. It\u2019s usually very cheap. It is important that you have your own domain, since you\u2019ll need to verify your ownership later in the Google Cloud organization creation process.<\/li>\n<\/ul>\n<p><strong>Getting started \u2014 Fork and clone the CFF repo<\/strong><\/p>\n<p>First, we need to fork the <a href=\"https:\/\/github.com\/GoogleCloudPlatform\/cloud-foundation-fabric\">Google Cloud Foundation Fabric repo<\/a>.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/27011-body-Picture2.png\" alt=\"GCPLZ Pic 2\" \/><\/p>\n<p>Next, clone the repo to your local machine, e.g., git clone <a href=\"https:\/\/github.com\/GoogleCloudPlatform\/cloud-foundation-fabric.git\">here<\/a>.<\/p>\n<p><strong>Organization creation<\/strong><\/p>\n<p class=\"MsoNormal\">We\u2019re following the Cloud Identity and Organization steps from <a href=\"https:\/\/cloud.google.com\/docs\/enterprise\/setup-checklist#checklist-section-1\">Google\u2019s Enterprise Setup Checklist<\/a>.<\/p>\n<p class=\"MsoNormal\">1.&nbsp;<strong>Create your Google organization and admin account<\/strong><\/p>\n<p class=\"MsoNormal\">We\u2019re going to create a <a href=\"https:\/\/cloud.google.com\/resource-manager\/docs\/creating-managing-organization\">Google organization resource<\/a> associated with your domain. (This assumes you don\u2019t already have an organization within Google Cloud.) For example, I\u2019ve created a Google organization associated with my ccoe-gcp.org domain. When working with Google Cloud, the organization&#8217;s resources are at the top level of your <a href=\"https:\/\/cloud.google.com\/resource-manager\/docs\/cloud-platform-resource-hierarchy#cloud_platform_resource_hierarchy_and_iam_policy_hierarchy\">resource hierarchy<\/a>.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/27011-body-Picture3.png\" alt=\"GCPLZ Pic 3\" \/><\/p>\n<p>To create a Google Cloud organization, you must create a Google Workspace or Cloud Identity account. This is a summary of how it works:<\/p>\n<ul>\n<li>Sign up for a Cloud Identity account with your existing email address. (It can be any email address that belongs to you.)<\/li>\n<li>The email address you sign-up with becomes your super admin account.<\/li>\n<li>You will then verify your domain, which results in the creation of your Google organization associated with that domain.<\/li>\n<\/ul>\n<p>Let\u2019s start by visiting the <a href=\"https:\/\/console.cloud.google.com\/cloud-setup\/\">Google Cloud Identity and Organization guided setup<\/a>. You\u2019ll see a Cloud Foundation page like this:<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/27011-body-Picture4-obfuscate_1.png\" alt=\"GCPLZ Pic 4\" \/><\/p>\n<p>&nbsp;Click on \u2018Begin the Setup&#8217; &#8211;&nbsp; You\u2019ll see a page like this:<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/27011-body-Picture5.png\" alt=\"GCPLZ Pic 5\" \/><\/p>\n<p>Now click on \u2018Sign Up for Cloud Identity,\u2019 which will take you to the <a href=\"https:\/\/workspace.google.com\/gcpidentity\/signup\/welcome?sku=identitybasic\">Cloud Identity Sign-Up Page<\/a>.<\/p>\n<p>Note: if you\u2019re already paying for Google Workspace, then you\u2019ll already have an account, and you\u2019ll already be familiar with the <a href=\"https:\/\/accounts.google.com\/\">Google Admin Console<\/a>. Otherwise, you\u2019ll want a Google Cloud Identity account. It\u2019s free!<\/p>\n<p>When you visit the Cloud Identity sign-up page, you\u2019ll see a page that looks like this:&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_technical_images\/27011-body-start-page.png\" alt=\"GCPLZ start page\" \/><\/p>\n<p class=\"MsoNormal\">You\u2019ll be guided through a few screens:<\/p>\n<ul>\n<li>Enter the business name you want to associate with your account. You can call it whatever you want.<\/li>\n<li>Specify how many employees your business will have. For the purposes of testing, and for setting up various identities for your Google Cloud organization, I\u2019d suggest that 10 \u2013 99 is more than enough.<\/li>\n<li>Eventually, you\u2019ll be asked to provide your domain name. Here, you must provide the domain name that you own, e.g. yourdomain.com.<\/li>\n<li>You\u2019ll then be asked for a username that you will use to sign into your new Cloud Identity account. This will be your new super administrator identity. It needs to be an email address associated with the same domain you provided earlier. For example, it might be super-admin@yourdomain.com.<\/li>\n<\/ul>\n<p>Your account is now created. You\u2019ll be asked to login to the <a href=\"https:\/\/admin.google.com\/\">Google Admin console<\/a> with the email address you just provided.<\/p>\n<p><strong>Verify your domain<\/strong><\/p>\n<p>You\u2019ll now be directed to verify that you own the domain. The manual process (which you are guided through) involves obtaining a domain verification code from the Admin Console, which you then need to supply as a DNS TXT record with your domain registrar.<strong> <\/strong>The Admin Console will ask you to set up users. Don\u2019t do this, because the Checklist will help you automate some of the work. Instead, click on \u2018Setup GCP Console now.\u2019 This will open the Google Cloud Console on the IAM page.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/27011-body-GCPLZIAM-ADMIN.png\" alt=\"GCPLZ Pic 7\" \/><\/p>\n<p>Click on \u2018Go to the Checklist,\u2019 and you\u2019ll be directed back to the Cloud Foundation page.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/27011-body-Picture8.png\" alt=\"GCPLZ Pic 8\" \/><\/p>\n<p>If, at this point, the Checklist does not detect your new organization, it might be because you\u2019re signed in with an email address that belongs to a different domain than the one you used to set up your organization. If so, switch over to your newly created Admin account to continue with the checklist.<\/p>\n<p><strong>User and group setup<\/strong><\/p>\n<p><strong>Creating groups<\/strong><\/p>\n<p>The Fabric FAST process expects that you will provision user groups that align with the best practice set of groups. Later, we will use Fabric FAST to assign Cloud IAM roles to the groups, as required. It\u2019s Google&#8217;s best practice to manage access at the group level, not at an individual user level. We could provision the required groups from within the <a href=\"https:\/\/admin.google.com\/\">Google Admin Console<\/a>. But the Cloud foundation setup page can automate most of the hard work for us.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/27011-body-Picture9_0.png\" alt=\"GCPLZ Pic 9\" \/><\/p>\n<p>&nbsp;Click on \u2018Start Users and Groups.\u2019<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/27011-body-Picture10_0.png\" alt=\"GCPLZ Pic 10\" \/><\/p>\n<p>Now click on \u2018Create All Groups,\u2019 then on \u2018Save and Create.\u2019 A couple of minutes later, the groups will be created. Click on Groups in the <a href=\"https:\/\/admin.google.com\/\">Google Admin Console<\/a> to see &nbsp;all the newly created groups:<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/27011-body-Picture11_0.png\" alt=\"GCPLZ Pic 11\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><strong>Create an org admin user<\/strong><\/p>\n<p>Okay, we\u2019ve got our groups, but we must create users manually. At the very least, we will need to create a user who will be a Cloud Organization Admin.<\/p>\n<p>Note that the super admin and the organization admin accounts should be two different accounts, as they serve different purposes:<\/p>\n<ul>\n<li><strong>Cloud Identity Super Admin:<\/strong> Provides the capability to create and manage users and groups in Google Cloud Identity. You will use this to create your Google Cloud Organizational Admin account.<\/li>\n<\/ul>\n<ul>\n<li><strong>Google Cloud Organization Admin:<\/strong> Use within Google Cloud, including Google Cloud IAM.<\/li>\n<\/ul>\n<p>From the <a href=\"https:\/\/admin.google.com\/\">Google Admin Console<\/a>, select Users &gt; Add New User. We\u2019ll create a user who will be one of our Organization Admins. Most of the Fabric FAST process will be run by this user.&nbsp;<\/p>\n<p>Now, assign this new user to the Organization Admin (gcp-organization-admins) group. Click on Groups &gt; gcp-organization-admins &gt; Add Members. Find your newly created user.<\/p>\n<p><strong>Creating other users<\/strong><\/p>\n<p>While we\u2019re at it, let\u2019s create a user for each of these three groups also:<\/p>\n<ul>\n<li>gcp-network-admins<\/li>\n<li>gcp-billing-admins<\/li>\n<li>gcp-devops<\/li>\n<\/ul>\n<p><strong>Summary<\/strong><\/p>\n<p>We\u2019ve created everything we need to progress with Fabric FAST, including:<\/p>\n<ul>\n<li>Clone of the Google CFF repo<\/li>\n<li>Cloud Identity Account<\/li>\n<li>Cloud Identity Super Admin account<\/li>\n<li>Google Cloud organization resource and associated it with our domain<\/li>\n<li>Set of user groups<\/li>\n<li>Some users, now associated with their respective user group<\/li>\n<\/ul>\n<p>Read Part 2 <a href=\"https:\/\/www.rackspace.com\/blog\/building-google-cloud-landing-zones-part-2\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Building a Google Cloud Landing Zone in a Scalable, Repeatable and Secure Way (Part 1)<\/p>\n","protected":false},"author":2,"featured_media":8386,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","format":"standard","meta":{"content-type":"","nid":"27011","content_type":"blog","created_by":"10130","authored_on":"2024-07-10T14:25:21+00:00","field_article_industries":"","tag_category":"Technical","field_blog_author_text":"By Jasbir Singh, Staff Consulting Architect, Rackspace Technology ","seo_description":"How to build a Google Cloud Landing Zone in a scalable, repeatable and secure way, with step-by-step instructions from to a Rackspace Technology expert. ","field_featured_image":"","insights_image":"\/wp-content\/uploads\/2026\/blog_technical_images\/27011-insights_image-google-cloud-technical-blog-1-insights.jpg","field_partners":"Google Cloud","rxt_platforms":"Google Cloud Data","product":"","publisheddate":"2024-08-28T12:59:18","rxt_solutions":"Cloud Optimization, Public Cloud","opengraph_tag":"","x_tag":"","teaser_flag":"Technical Blog","seo_titile":"Scalable, Repeatable & Secure Google Cloud Landing Zone Part 1 | Rackspace Technology","field_topics":"Public Cloud","field_slug":"building-google-cloud-landing-zone-in-a-scalable-repeatable-secure-way-part-1","footnotes":""},"categories":[178],"tags":[187,183,204],"class_list":["post-8384","blogs","type-blogs","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-google-cloud","tag-public-cloud","tag-technical"],"_links":{"self":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/8384","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs"}],"about":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/types\/blogs"}],"author":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/comments?post=8384"}],"version-history":[{"count":4,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/8384\/revisions"}],"predecessor-version":[{"id":17111,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/8384\/revisions\/17111"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media\/8386"}],"wp:attachment":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media?parent=8384"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/categories?post=8384"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/tags?post=8384"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}