GCP Project Factory
Opinionated project creation: API enablement, billing budget, default-SA lockdown, audit log sinks and baseline IAM.
Verification
Live-testedReally deployed to a cloud sandbox, verified against its outputs and assertions, then destroyed - with the teardown confirmed.
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Cosign signature
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-08-03 · how we verify
Verify this download
cosign · sha-256Don't take our word for it. Every release is signed with cosign - check the bytes against our pinned public key before you trust them.
# 1. Our pinned public key - fetch once, trust out-of-band
curl -O https://www.iac-bazaar.com/cosign.pub
# 2. This module's Sigstore bundle
curl -o gcp-project-factory-1.0.0.sigstore.json \
https://www.iac-bazaar.com/api/artifacts/gcp-project-factory/signature
# 3. Verify the tarball you downloaded
cosign verify-blob \
--key cosign.pub \
--bundle gcp-project-factory-1.0.0.sigstore.json \
gcp-project-factory-1.0.0.tar.gz
# → Verified OK
# 4. (optional) confirm the checksum too
echo "d9c1af29ae3dde0448278a2ef410fddc9c8d420c30d83aeb7badd539235b348e gcp-project-factory-1.0.0.tar.gz" | sha256sum -cUse it from the registry
terraform · opentofumodule "project_factory" {
source = "www.iac-bazaar.com/iac-bazaar/gcp-project-factory/gcp"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads live-tested because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/gcp-project-factory?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Terraform module 1.0.0, live-tested on IaC Bazaar: [GCP Project Factory](https://www.iac-bazaar.com/catalog/gcp-project-factory?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```hcl
module "project_factory" {
source = "www.iac-bazaar.com/iac-bazaar/gcp-project-factory/gcp"
version = "1.0.0"
}
```Preview:
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
gcp-project-factory
An opinionated GCP project factory: creates a project with a
deny-by-default network posture, explicit API enablement, default
service-account lockdown, additive baseline IAM, an optional billing budget
with threshold alerts, and an optional audit log sink. One module call gives
you a project that is not shipped with the legacy default VPC and whose
over-privileged default compute SA has had Editor stripped. Works with
Terraform and OpenTofu (>= 1.6), Google provider >= 7.0, < 8.0.
Prerequisites: this needs an Organization or Folder, plus
roles/resourcemanager.projectCreatorandroles/billing.user. A standalone personal project is not sufficient.
Design & secure defaults
- No legacy default network (
auto_create_network = false) — bring your own VPC for a deny-by-default footprint. - Default-SA lockdown: the default compute / App Engine service accounts
are over-privileged (Editor) out of the box.
default_service_accounts_action = "DEPRIVILEGE"strips that role at create time;DISABLE/DELETEgo further;NONEopts out. - Explicit API enablement only —
serviceusageandcloudresourcemanagerare always added; nothing else is on unless you list it.disable_dependent_servicesstays off so a destroy never cascades unless you opt in. - Additive baseline IAM (
google_project_iam_member), non-authoritative and safe to compose with bindings managed elsewhere. deletion_policy = "PREVENT"so the project cannot be destroyed by accident.- Optional budget with multi-threshold alerts and audit log sink with a unique writer identity.
Cross-field invariants are enforced with preconditions: exactly one of
org_id / folder_id, and a budget requires billing_account.
Requirements
| Requirement | Version |
|---|---|
| Terraform / OpenTofu | >= 1.6 |
hashicorp/google | >= 7.0, < 8.0 |
Caller IAM: roles/resourcemanager.projectCreator on the org/folder and
roles/billing.user on the billing account.
License
Commercial — LicenseRef-IaCBazaar-Commercial. See the IaC Bazaar terms.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
- Inputs
- Outputs
Related modules
gcp-billing-budget
The API accepts a budget with default recipients disabled and no channel, topic or threshold rule - a number that is tracked and never sent anywhere. Refuses that, insists on a FORECASTED_SPEND rule, and defaults credit_types_treatment to EXCLUDE_ALL_CREDITS, because a budget that counts credits measures your runway, not your spend, and looks healthy until the month they run out.
gcp-org-policy
dry_run_spec is a separate configuration from spec and only spec enforces, so a dry-run policy appears in the console, evaluates everything and denies nothing. inherit_from_parent defaults to false, which makes a local addition silently REPLACE the organization policy rather than add to it.
gcp-resource-tags
Tag keys and values are definitions; conditional IAM, organisation policies and firewall rules read bindings, and a tag bound to nothing governs nothing while appearing fully defined. Bindings come with the keys - to folders, so every project beneath inherits - and the values that attach nowhere are listed in an output, along with the namespaced names conditions need.
gcp-essential-contacts
Without Essential Contacts, security notices, suspension warnings, billing problems and API shutdowns go to whoever holds Owner - a service account and an alias nobody reads - and the list is empty by default. Contacts per category, with a refusal when any category is left uncovered and an output naming the ones that still fall through to the Owner path.
aws-control-tower
A Control Tower landing zone from a manifest the module writes: the governed regions (the only usable ones), the Security and Sandbox units, centralized logging in the log archive account you name kept a year (access logs ten) under your KMS key (the AWS-managed key by name), the audit account, Identity Center access, and the controls you map to organizational units.
alicloud-landing-zone
A Resource Directory with its folders and member accounts. Two switches decide whether it works: control policies are off until the directory enables them, so a policy written elsewhere attaches to nothing; and member deletion is off by default, which makes every account this creates permanent and terraform destroy fail on it. Both are on here.