Skip to content

GCP

A comprehensive guide to Google Cloud Platform project setup patterns, from single-project/single-VPC designs through multi-region active-active architectures and enterprise landing zones.

Architecture Patterns at a Glance

Pattern Scope Complexity Typical Use Case
Single Project + Single VPC One project, one VPC Low Small teams, prototypes, single-application workloads
Multi-VPC (Shared VPC) Host project + service projects Medium Enterprise with centralized networking, multi-team isolation
Multi-VPC (VPC Peering) Peer-to-peer VPC connections Medium SaaS offerings, inter-organization connectivity
Private Service Connect Service-oriented private access Medium Consuming/producing managed services privately across VPC boundaries
Multi-Project + Folders Organization hierarchy High Large enterprises with regulated environments
Multi-Zone / Multi-Region Cross-zone and cross-region deployments High Production workloads requiring HA and DR
DR: Pilot Light Minimal standby in secondary region Medium Cost-optimized DR, tolerates hours of downtime
DR: Warm Standby Scaled-down full replica Medium-High Most enterprises; minutes-level RTO/RPO
DR: Active-Active Full duplicate in multiple regions Very High Mission-critical apps requiring zero downtime
DMZ-Less (Google Recommended) Private subnets + managed edge Medium Modern GCP deployments; no traditional DMZ needed
GCP Landing Zone Org-wide foundation Very High Greenfield enterprise adoption of GCP

Key GCP Services

Networking

  • VPC -- global virtual network with regional subnets
  • Shared VPC -- centralized networking across projects via host/service model
  • VPC Network Peering -- peer-to-peer internal connectivity between VPCs
  • Private Service Connect -- service-oriented private access to managed services and Google APIs
  • Cloud NAT -- managed outbound NAT for private resources
  • Cloud Interconnect / Cloud VPN -- hybrid connectivity to on-premises
  • Cloud Load Balancing -- global and regional L4/L7 load balancers (external LBs sit outside VPC)
  • Cloud DNS -- managed DNS with health-check-based routing
  • VPC Service Controls -- perimeter-based security for Google-managed APIs
  • Cloud Armor -- DDoS protection and WAF for external load balancers

Compute and Orchestration

  • Compute Engine -- VMs (zonal); Regional MIGs for cross-zone HA
  • GKE / GKE Enterprise -- managed Kubernetes; fleet-level multi-cluster management
  • Cloud Run -- serverless containers, multi-region deployment support

Data

  • Cloud SQL -- managed relational DB with HA and cross-region read replicas
  • Cloud Spanner -- globally distributed relational DB (multi-region, 99.999% SLA)
  • AlloyDB -- PostgreSQL-compatible with cross-region replicas
  • Cloud Bigtable -- wide-column NoSQL with built-in replication
  • Cloud Storage -- dual-region and multi-region buckets for DR
  • Firestore -- multi-region document DB (native mode)

Management and Governance

  • Resource Manager -- organization, folder, project hierarchy with policy inheritance
  • Organization Policies -- org-level constraints (location, OS Login, external IPs, etc.)
  • IAM -- fine-grained identity-based access with roles, conditions, deny policies
  • Security Command Center -- threat detection and security posture management
  • Cloud Build / Cloud Deploy -- CI/CD for infrastructure and applications
  • Terraform / Cloud Foundation Toolkit -- IaC for landing zone automation

Real-World Examples

Scenario Pattern(s) Used
Startup running a monolithic web app Single Project + Single VPC
Mid-size SaaS company with 10+ microservices teams Shared VPC with service projects per team
Large bank migrating to GCP with regulatory requirements Full Landing Zone: Folders, Shared VPC, VPC Service Controls, SCC Premium
E-commerce platform needing 99.99% uptime Multi-zone deployment with Global HTTP(S) LB, Cloud SQL HA, Warm Standby DR
Global payments processor Active-Active multi-region with Cloud Spanner, Global LB, GKE Enterprise fleet
Manufacturing company with on-premises data center Hub-and-Spoke Shared VPC + Cloud Interconnect + Pilot Light DR

Questions

  • When should you choose Shared VPC over VPC Peering for inter-project connectivity?
  • What are the exact organization policies that should be set as baseline for any new GCP organization?
  • How does Private Service Connect compare to VPC Peering for SaaS consumption patterns?
  • What is the cost differential between Pilot Light, Warm Standby, and Active-Active DR for a typical 3-tier web application?

Sources