GCP Landing Zone: Reference¶

Look-up facts for Google Cloud landing-zone work: product names, hierarchy limits, baseline organization policy constraints, well-known IP ranges, IAM roles, firewall tiers and evaluation order, VPC Service Controls terms, blueprint versions, data-layer DR options, pricing, and the security baseline checklist. For the reasoning behind these choices, see the Explanation. For commands, see the How-to Guides.

Documentation domain

Google moved Cloud technical documentation to docs.cloud.google.com in 2025. Old cloud.google.com/.../docs/... links redirect. Pricing pages and the blog remain on cloud.google.com.

Product Names and Renames¶

Older names still appear in blog posts, Terraform resource names, and exam material. Use the current name when you search the docs.

Current name	Former name(s)	Change	Source
Cloud Run functions	Cloud Functions (2nd gen); 1st gen is now "Cloud Run functions (1st gen)"	Renamed 2024-08-21	Release notes
GKE (single offering)	GKE Standard edition / GKE Enterprise edition (earlier: Anthos)	Editions consolidated 2025-09. Fleets, Teams, Config Sync, Policy Controller, and Connect Gateway are now in GKE at no extra cost. Service mesh, Backup for GKE, multi-cluster Gateway, Extended Support, and multi-cloud are standalone SKUs	GKE pricing
Workload Identity Federation for GKE	GKE Workload Identity	Renamed 2024. Kubernetes principals can now be granted IAM roles directly	Concept page
Cloud Next Generation Firewall (Cloud NGFW) Essentials / Standard / Enterprise	Cloud Firewall, Cloud Firewall Plus	Three priced tiers	NGFW tiers
Application Load Balancer / Network Load Balancer (proxy or passthrough)	HTTP(S) Load Balancer, SSL Proxy, TCP Proxy, Network LB	Renamed by layer and mode	LB overview
Spanner, Bigtable	Cloud Spanner, Cloud Bigtable	Docs now use the short names	Spanner docs
Enterprise foundations blueprint	Security foundations blueprint	Renamed. Deployable code is `terraform-example-foundation`	Blueprint
Google Cloud Well-Architected Framework	Google Cloud Architecture Framework	Renamed	Framework
Security baseline constraints	"Secure-by-default" organization policies	Same feature, documentation renamed	Baseline constraints

Resource Hierarchy Limits¶

Item	Limit	Source
Folder nesting depth	10 levels below the organization	Resource Manager limits
Direct child folders per parent	300	Resource Manager limits
Organization resources per Cloud Identity / Workspace account	1	Resource hierarchy
Regions / zones	43 regions, 130 zones (2026-09)	Global locations
Zones per region	3 or more. Most regions have 3, some (for example `us-central1`) have 4	Regions and zones

Baseline Organization Policy Constraints¶

The table lists the constraints most landing zones enforce at the organization node. Legacy constraints use the constraints/<service>.<name> form. Newer managed constraints (compute.managed.*, iam.managed.*) replace several legacy ones and support dry run and Policy Simulator.

Constraint (legacy)	Managed equivalent	Purpose
`constraints/compute.requireOsLogin`	`compute.managed.requireOsLogin`	Enforce OS Login for SSH (no metadata SSH keys)
`constraints/compute.disableSerialPortAccess`	`compute.managed.disableSerialPortAccess`	Disable interactive serial console
`constraints/compute.vmExternalIpAccess`	`compute.managed.vmExternalIpAccess`	Restrict which VMs can have external IPs
`constraints/iam.disableServiceAccountKeyCreation`	`iam.managed.disableServiceAccountKeyCreation`	Block user-managed SA keys (use Workload Identity Federation)
`constraints/iam.disableServiceAccountKeyUpload`	`iam.managed.disableServiceAccountKeyUpload`	Block uploading external public keys to service accounts
`constraints/iam.automaticIamGrantsForDefaultServiceAccounts`	--	Stop automatic Editor grants to default service accounts
`constraints/iam.allowedPolicyMemberDomains`	--	Restrict IAM principals to your Cloud Identity customer IDs
`constraints/gcp.resourceLocations`	--	Restrict resource locations (value groups such as `in:us-locations`, `in:eu-locations`)
`constraints/compute.requireShieldedVm`	--	Require Shielded VM images
`constraints/compute.restrictSharedVpcHostProjects`	--	Limit which projects can become Shared VPC hosts
`constraints/compute.restrictSharedVpcSubnetworks`	--	Limit which Shared VPC subnets service projects can use
`constraints/storage.uniformBucketLevelAccess`	--	Enforce uniform bucket-level access
`constraints/storage.publicAccessPrevention`	--	Block public Cloud Storage objects

Security baseline constraints (secure-by-default)

Organizations created on or after 2024-05-03 get a bundle of security baseline constraints enforced at creation. The documented set includes iam.managed.disableServiceAccountKeyCreation, iam.managed.disableServiceAccountKeyUpload, and iam.automaticIamGrantsForDefaultServiceAccounts. Some organizations created between February and April 2024 also have them. Check the baseline constraints page for the full current list before you override any of them. Source: Google Cloud blog.

in:eu-locations vs in:europe-locations

in:eu-locations covers only EU member-state regions (it excludes UK regions such as europe-west2). in:europe-locations covers all regions physically in Europe. Source: Restrict resource locations.

Well-Known IP Ranges¶

Range	Used by	Firewall implication	Source
`35.191.0.0/16`, `130.211.0.0/22`	Health check probes for Application LBs, proxy Network LBs, internal passthrough NLB, Cloud Service Mesh	Allow ingress to backends on the health-check port	LB firewall rules
`35.191.0.0/16`, `209.85.152.0/22`, `209.85.204.0/22`	Health checks for external passthrough Network LBs	Allow ingress to backends	Health checks
`35.235.240.0/20`	IAP TCP forwarding (SSH/RDP through IAP)	Allow ingress on 22/3389 from this range only	IAP TCP forwarding
`199.36.153.4/30` (`restricted.googleapis.com`)	Google APIs that support VPC Service Controls	Route and DNS target for VPC SC environments	Private Google Access
`199.36.153.8/30` (`private.googleapis.com`)	Most Google APIs, without the VPC SC restriction	Route and DNS target when VPC SC is not used	Private Google Access
`169.254.169.254`	Metadata server	Always reachable from VMs, not filterable by VPC rules	Metadata server

IAM Roles for Landing-Zone Operations¶

Role	Granted at	Purpose
`roles/resourcemanager.organizationAdmin`	Organization	Manage org IAM, folders, projects
`roles/resourcemanager.folderAdmin`	Organization or folder	Create and manage folders
`roles/resourcemanager.projectCreator`	Organization or folder	Create projects (project factory service account)
`roles/billing.user`	Billing account	Link projects to a billing account
`roles/orgpolicy.policyAdmin`	Organization	Set organization policies
`roles/compute.xpnAdmin` (Shared VPC Admin)	Organization or folder	Enable host projects, attach service projects
`roles/compute.networkUser`	Host project or individual subnet	Let service-project principals use Shared VPC subnets
`roles/compute.networkAdmin`	Host project	Manage networks, routes, peering (not firewall)
`roles/compute.securityAdmin`	Host project	Manage firewall rules, firewall policies, SSL certificates
`roles/compute.orgFirewallPolicyAdmin`	Organization or folder	Manage hierarchical firewall policies
`roles/accesscontextmanager.policyAdmin`	Organization	Manage VPC SC perimeters and access levels
`roles/iap.tunnelResourceAccessor`	Project or instance	Use IAP TCP forwarding (SSH/RDP)
`roles/privilegedaccessmanager.admin`	Organization, folder, or project	Create Privileged Access Manager entitlements for just-in-time elevation (PAM overview)

Cloud NGFW Tiers and Pricing¶

Source: Cloud NGFW pricing, retrieved 2026-09-25. Prices in USD.

Tier	Capabilities	Price
Essentials	IP ranges, ports, protocols, secure tags, service accounts. Includes everything VPC firewall rules do	Free
Standard	Adds FQDN objects, geolocation objects, Google Threat Intelligence lists	$0.0193 per GiB processed (north-south flows evaluated by Standard rules)
Enterprise	Adds Layer 7 inspection: intrusion detection and prevention (IDPS), URL filtering, optional TLS inspection. Uses zonal firewall endpoints	$1.75 per firewall endpoint-hour + $0.0193 per GiB inspected
Hierarchical firewall policies	Per VM per month, by total rule attributes	$0.001369863 per VM-hour (500 attributes or fewer); $0.002054795 per VM-hour (501 or more). No charge if the policy applies to no VMs
VPC firewall rules	Legacy per-network rules	Free

Firewall Policy Evaluation Order¶

With the default network firewall policy enforcement order AFTER_CLASSIC_FIREWALL, Cloud NGFW evaluates in this order. Source: Evaluation order.

Step	Policy type	Scope	Notes
1	Hierarchical firewall policy	Organization, then each folder down the path	`goto_next` delegates to the next level. Always evaluated first
2	Regional system firewall policies	Region	Google-managed
3	VPC firewall rules	Network	Legacy per-network rules. Target by network tag or service account
4	Global network firewall policy	One per network	Supports secure tags (IAM-governed) and Standard/Enterprise features
5	Regional network firewall policy	Region of a network	Region-scoped rules
6	Implied rules	Network	Deny all ingress, allow all egress

Set BEFORE_CLASSIC_FIREWALL on the network to evaluate network firewall policies (steps 4-5) before VPC firewall rules (step 3).

Recommended Firewall Rules¶

Rule	Direction	Source	Target	Action
Allow LB health checks	Ingress	`35.191.0.0/16`, `130.211.0.0/22`	Secure tag or network tag `load-balanced-backend`	Allow
Allow IAP SSH/RDP	Ingress	`35.235.240.0/20`	Secure tag or network tag `iap-access`, ports 22/3389	Allow
Allow app-to-data	Ingress	Tag `app-tier`	Tag `data-tier` on DB port	Allow
Allow internal between app instances	Ingress	Tag `app-tier`	Tag `app-tier`	Allow
Deny all other ingress	Ingress	`0.0.0.0/0`	All instances	Deny (the implied rule already does this. An explicit low-priority rule makes it visible in logs)
Restrict egress	Egress	Tag `restricted-egress`	Specific destinations only	Allow
Deny egress to internet	Egress	All instances	`0.0.0.0/0`	Deny (overrides the implied allow-egress rule)

Prefer secure tags (IAM-governed Resource Manager tags) in network firewall policies over network tags. Anyone with compute.instances.setTags can change a network tag, while binding a secure tag needs IAM permission on the tag value. Source: Secure tags for firewalls.

VPC Service Controls Key Concepts¶

Concept	Description
Service Perimeter	Boundary around projects (and VPC networks) that blocks API data movement across the boundary by default
Ingress Rule	Allows access from outside the perimeter based on identity, source (access level, project, VPC network), and target service/method
Egress Rule	Allows principals inside the perimeter to reach specific resources outside it
Access Level	Access Context Manager condition set (source IP ranges, device policy, region, identity)
Perimeter Bridge	Connects two perimeters for data exchange. Google now recommends ingress/egress rules instead of bridges for most cases (Ingress and egress rules)
Restricted VIP	`restricted.googleapis.com` (`199.36.153.4/30`). Private route to VPC SC-supported APIs, no internet exposure
Dry Run Mode	Logs violations without blocking access (for policy testing)
Pricing	No separate charge (VPC SC pricing)

Landing-Zone Blueprints and Tooling Versions¶

Versions checked 2026-09-25 against each project's CHANGELOG.md on GitHub.

Tool	Latest version (date)	What it is	Source
Cloud Foundation Fabric (FAST)	v58.0.0 (2026-09-01)	Google PSO-maintained Terraform modules plus FAST, a staged landing-zone reference (bootstrap, resource management, security, networking, project factory). Frequent major releases	Changelog
terraform-example-foundation (enterprise foundations blueprint)	v6.0.0 (2026-09-08)	CFT-based staged foundation (0-bootstrap to 5-app-infra). v6.0.0 moved to one default common VPC SC perimeter. v5.0.0 (2026-07-01) removed Jenkins support, moved to SCC v2 resources, removed the base network project	Repo
terraform-google-project-factory (CFT)	18.3.0 (2026-06-05)	Project factory module. Needs Terraform 1.3+	Repo
Terraform provider `hashicorp/google`	8.3.0 (2026-09-15). 8.0.0 released 2026-08-26	Default `load_balancing_scheme` for `google_compute_backend_service` and `google_compute_global_forwarding_rule` changed from `EXTERNAL` to `EXTERNAL_MANAGED` in 8.0.0	Changelog
Google Cloud Setup	Console-guided	Click-through foundation setup that can also export Terraform	Landing zone design
pbmm-on-gcp-onboarding	--	Canadian Protected B (PBMM) overlay on the example foundation. Niche, public-sector only	Repo

Terraform resource for org policies

google_organization_policy uses the Resource Manager v1 API. google_org_policy_policy uses the Organization Policy v2 API and supports conditions (tags), dry-run specs, and managed constraints. Use v2 for new code. Source: terraform-google-org-policy v2 module.

Data Layer Strategy¶

Service	Multi-Zone	Multi-Region Strategy
Cloud SQL	Automatic with HA config (`--availability-type=REGIONAL`)	Cross-region read replicas. Manual promote, or Enterprise Plus DR replica switchover
Spanner	Automatic	Built-in multi-region configurations (TrueTime, 99.999% SLA). Multi-region needs Enterprise Plus edition
AlloyDB	Automatic	Cross-region secondary clusters
Bigtable	Automatic	Replication with app-profile routing and failover
Cloud Storage	Automatic (regional)	Dual-region (optional turbo replication, 15-minute RPO) or multi-region buckets
Firestore	Automatic	Multi-region locations built in

Cloud SQL for PostgreSQL 16 and later defaults to Enterprise Plus edition. Source: Create instances.

Spanner and Cloud Storage Location Codes¶

Code	Type	Regions	Source
Spanner `nam6`	Multi-region	Read-write: `us-central1`, `us-east1`. Read-only: `us-west1`, `us-west2`. Witness: `us-central2`	Spanner configurations
Cloud Storage `NAM4`	Predefined dual-region	`us-central1` + `us-east1`	Bucket locations
Cloud Storage `US` + `--placement`	Configurable dual-region	Any two regions in the same continent code, for example `us-central1,us-east1`	Bucket locations

DR Comparison Matrix¶

Strategy	RPO	RTO	Relative Cost	Complexity	Best For
Pilot Light	Minutes to hours (replication lag)	Hours	Low	Low	Cost-conscious orgs tolerating downtime
Warm Standby	Minutes	Minutes	Medium	Medium	Most enterprises needing fast recovery
Active-Active	Near-zero	Near-zero	High	Very High	Mission-critical: payments, ecommerce

Source: Disaster recovery planning guide. RPO/RTO values are typical ranges, not SLAs.

Pricing Quick Reference¶

USD list prices, retrieved 2026-09-25. Check the linked page for your region and currency.

Item	Price	Source
Shared VPC, VPC Network Peering (the feature itself)	No charge. Normal data-transfer pricing applies	Network pricing
VPC Service Controls	No charge	VPC SC pricing
Cloud NAT (public) gateway	$0.0014 per VM-hour, capped at $0.044/hour above 32 VMs	Cloud NAT pricing
Cloud NAT data processing	$0.045 per GiB (inbound and outbound)	Cloud NAT pricing
Cloud NAT external IP	$0.005 per IP-hour	Cloud NAT pricing
PSC endpoint for Google APIs	$0.01 per endpoint-hour, no data charge	Network pricing
PSC endpoint for a published service	$0.01 per endpoint-hour + consumer data processing $0.01/GiB (first 1 PiB/month)	Network pricing
GKE cluster management fee	$0.10 per cluster-hour. $74.40/month free-tier credit per billing account (one zonal or Autopilot cluster)	GKE pricing
Security Command Center	Standard: free. Premium: subscription or pay-as-you-go. Enterprise: subscription, minimum $15,000/year	SCC pricing
Cloud NGFW	See Cloud NGFW Tiers and Pricing	NGFW pricing

Security Command Center¶

SCC Feature	Purpose
Security Health Analytics	Detect misconfigurations (open firewall rules, public buckets)
Event Threat Detection	Near-real-time threat detection from Cloud Audit Logs and other log sources
Container / VM Threat Detection	Detect crypto mining, malware, reverse shells in GKE and Compute Engine
Vulnerability scanning	OS and container vulnerability assessment
Web Security Scanner	DAST for App Engine, Cloud Run, and Compute Engine
Asset Inventory	Track all resources and their security posture

SCC Enterprise tier is deprecated

The SCC Enterprise tier was deprecated on 2026-05-21 and shuts down on or after 2027-05-21. Enterprise organizations then move to Premium. Plan new deployments on Standard or Premium. Source: SCC service tiers, SCC deprecations.