acme-lza1 - Configuration Documentation

Generated: 2026-03-11T10:26:11.613782Z Profile: Advanced Organization: acme.com

Executive Summary

This document describes the Cloud Foundation configuration for acme.com. This establishes your GCP Landing Zone.

Attribute	Value
Cloud Foundation Name	`acme-lza1`
Organization ID	`593874125053`
Primary Region	`us-central1`
Configuration Profile	Advanced
Architecture Type	Hub and Spoke

| Compliance Frameworks | SOC2, FEDRAMP, NIST, SOX |

| Organization Policies | 15 enforced |

| Log Retention | 2555 days |

| Billing Account | 013478-95D694-5670A9 |

Compliance Requirements

This cloud foundation is configured to support:

SOC2
FEDRAMP
NIST
SOX

1. Organization Structure

1.1 Folder Hierarchy

acme.com (593874125053)
│

├── 📁 Production
│   └── Purpose: environment

├── 📁 Staging
│   └── Purpose: environment

├── 📁 Development
│   └── Purpose: environment

├── 📁 Shared Services
│   └── Purpose: shared_services

├── 📁 Security
│   └── Purpose: security

├── 📁 Networking
│   └── Purpose: networking

├── 📁 Data Platform
│   └── Purpose: data

├── 📁 Sandbox
│   └── Purpose: sandbox

Folder	Purpose	Description

| Production | environment | Production workloads |

| Staging | environment | Pre-production testing |

| Development | environment | Development |

| Shared Services | shared_services | Common infrastructure |

| Security | security | Security tooling |

| Networking | networking | Hub networks and connectivity |

| Data Platform | data | Analytics and data services |

| Sandbox | sandbox | Experimentation |

1.2 Bootstrap Projects

Project Name	Folder	Purpose	APIs

| prj-new-service | Shared Services | cicd | cloudbuild.googleapis.com, cloudkms.googleapis.com, secretmanager.googleapis.com, logging.googleapis.com, monitoring.googleapis.com, compute.googleapis.com, dns.googleapis.com, artifactregistry.googleapis.com, servicenetworking.googleapis.com |

1.3 Environments

Configured environments: Development, Staging, Production, Sandbox

2. Identity & Access Management

2.1 Administrative Groups

Group Name	Purpose	Roles

| gcp-organization-admins@acme.com | org_admin | roles/resourcemanager.organizationAdmin |

| gcp-billing-admins@acme.com | billing_admin | roles/billing.admin |

| gcp-network-admins@acme.com | network_admin | roles/compute.networkAdmin, roles/compute.securityAdmin |

| gcp-security-admins@acme.com | security_admin | roles/iam.securityAdmin, roles/accesscontextmanager.policyAdmin |

| gcp-audit-viewers@acme.com | audit_viewer | roles/iam.securityReviewer, roles/logging.viewer |

| gcp-support-admins@acme.com | support_admin | roles/cloudsupport.techSupportEditor |

2.3 Service Accounts

Name	Project	Purpose	Roles

3. Networking

3.1 Network Architecture

Attribute	Value
Architecture Type	Hub and Spoke

3.2 VPC Networks

VPC Name	Project	Routing Mode	Purpose

3.3 Subnets

Subnet	VPC	Region	CIDR	Private Google Access

4. Hybrid Connectivity

Attribute	Value
Connectivity Type	Dedicated Interconnect

4.1 On-Premises Networks

Network Name	CIDR Ranges

| on-prem-network | 192.20.0.0/20 |

4.2 Hybrid DNS

Setting	Value
Inbound Forwarding	Enabled

5. Security Configuration

5.1 Organization Policies

15 organization policies configured:

Constraint	Enforcement	Scope

| compute.skipDefaultNetworkCreation | enforce | organization |

| compute.requireOsLogin | enforce | organization |

| compute.requireShieldedVm | enforce | organization |

| compute.disableSerialPortAccess | enforce | organization |

| compute.vmExternalIpAccess | deny_all | organization |

| compute.disableNestedVirtualization | enforce | organization |

| storage.uniformBucketLevelAccess | enforce | organization |

| storage.publicAccessPrevention | enforce | organization |

| sql.restrictPublicIp | enforce | organization |

| sql.restrictAuthorizedNetworks | enforce | organization |

| iam.disableServiceAccountKeyCreation | enforce | organization |

| iam.disableServiceAccountKeyUpload | enforce | organization |

| gcp.detailedAuditLoggingMode | enforce | organization |

| gcp.resourceLocations | allow_list | organization |

| iam.allowedPolicyMemberDomains | allow_list | organization |

6. Logging & Monitoring

6.1 Log Retention

Setting	Value
Default Retention Period	2555 days

6.2 Custom Retention Buckets

Bucket Name	Retention (Days)	Locked

| audit-logs | 730 | Yes |

| security-logs | 365 | Yes |

6.3 Centralized Logging

Setting	Value
Logging Project	prj-seed-logging

| Aggregated Sinks | 3 configured |

7. Backup & Disaster Recovery

Attribute	Value
DR Strategy	Backup Restore
Failover Automation	Enabled

| Default RPO | 1h | | Default RTO | 15m |

7.1 Backup Policies

Policy Name	Resource Type	Frequency	Retention (Days)	Cross-Region

7.2 Failover Testing

Setting	Value
Testing Frequency	quarterly
Test Type	partial

8. Cost Management

8.1 Budgets

Budget Name	Amount	Scope

| Organization Budget | USD 100000 | billing_account |

What Was Generated

This wizard generated FAST factory YAML data files — structured configuration that plugs directly into Google Cloud's FAST Fabric landing zone framework.

Attribute	Value
Output Format	FAST Factory YAML
Framework	Cloud Foundation Fabric (FAST)

| Stages Generated | 5 |

FAST Stages Overview

Stage	Directory	Description

| Organization Setup | org-setup/ | Folders, IAM bindings, org policies, tags, billing |

| Networking | networking/ | VPC networks, subnets, firewall rules, DNS, VPNs |

| Security | security/ | KMS keyrings, security projects, SCC |

| Project Factory | project-factory/ | Workload projects (GKE, data, apps, compute, ops) |

| VPC Service Controls | vpcsc/ | Service perimeters, access levels, ingress/egress policies |

How to Deploy

Prerequisites

Cloud Foundation Fabric repository cloned
GCP Organization with appropriate permissions
Terraform >= 1.7 installed
A service account or user with Organization Admin privileges

Deployment Steps

Clone FAST Fabric (if not already done):

git clone https://github.com/GoogleCloudPlatform/cloud-foundation-fabric.git
cd cloud-foundation-fabric/fast

Place the generated data files into the corresponding FAST stage directories:
- Copy org-setup/ contents into the FAST org-setup/ stage data directory
- Copy networking/ contents into the FAST networking/ stage data directory
- Copy security/ contents into the FAST security/ stage data directory
- Copy project-factory/ contents into the FAST project-factory/ stage data directory
- Copy vpcsc/ contents into the FAST vpcsc/ stage data directory
Deploy stages in order:
- Stage 0: Organization Setup (org-setup/)
- Stage 1: Networking (networking/)
- Stage 2: Security (security/)
- Stage 3: Project Factory (project-factory/)
- Stage 4: VPC Service Controls (vpcsc/)

Review and apply each stage with Terraform:

terraform init
terraform plan
terraform apply

FAST Data File Format

The generated YAML files use FAST's factory data format with $-interpolation tokens that are resolved at terraform plan time:

$iam_principals:... — References to IAM identities
$project_ids:... — References to project IDs from the FAST registry
$folder_ids:... — References to folder IDs

These tokens ensure that cross-stage dependencies are resolved automatically by FAST.

Getting Help

FAST Documentation: See FAST README
Stage-specific docs: Each FAST stage directory contains its own README
Community: r/googlecloud, Stack Overflow

Important Disclaimers

No Warranty: These configurations are generated based on your inputs. Review thoroughly before any deployment.
Security Review Required: Have your security team review IAM bindings and org policies before deployment.
Cost Implications: Deploying this infrastructure will incur GCP charges. Review the Cost Management section.
Not Standalone: The YAML data files require FAST Fabric modules to deploy. They are not standalone Terraform.
Your Responsibility: Actual deployment, testing, and maintenance are your responsibility.

Contacts

Role	Email
Primary Contact	cloudteam@acme.com

| Secondary Contact | cloud-team@gmail.com |

Generated by Cloud Foundation Design Studio v1.0.0

Name		Name	Last commit message	Last commit date
Latest commit History 5 Commits
images		images
networking/datasets/hub-and-spokes-peerings		networking/datasets/hub-and-spokes-peerings
org-setup/datasets/main		org-setup/datasets/main
project-factory		project-factory
security/datasets/classic		security/datasets/classic
vpcsc/datasets/default		vpcsc/datasets/default
ARCHITECTURE_REPORT.json		ARCHITECTURE_REPORT.json
ARCHITECTURE_SCORECARD.md		ARCHITECTURE_SCORECARD.md
CMEK_WIRING.md		CMEK_WIRING.md
README.md		README.md
US-Federal-Agency-Example.md		US-Federal-Agency-Example.md
VALIDATION_WARNINGS.md		VALIDATION_WARNINGS.md
architecture.mmd.txt		architecture.mmd.txt

Folders and files

Latest commit

History

Repository files navigation

acme-lza1 - Configuration Documentation

Executive Summary

Compliance Requirements

1. Organization Structure

1.1 Folder Hierarchy

1.2 Bootstrap Projects

1.3 Environments

2. Identity & Access Management

2.1 Administrative Groups

2.3 Service Accounts

3. Networking

3.1 Network Architecture

3.2 VPC Networks

3.3 Subnets

4. Hybrid Connectivity

4.1 On-Premises Networks

4.2 Hybrid DNS

5. Security Configuration

5.1 Organization Policies

6. Logging & Monitoring

6.1 Log Retention

6.2 Custom Retention Buckets

6.3 Centralized Logging

7. Backup & Disaster Recovery

7.1 Backup Policies

7.2 Failover Testing

8. Cost Management

8.1 Budgets

What Was Generated

FAST Stages Overview

How to Deploy

Prerequisites

Deployment Steps

FAST Data File Format

Getting Help

Important Disclaimers

Contacts

About

Topics

Resources

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Uh oh!

Contributors

Uh oh!

Packages