GCP Production Landing Zone

Tiered foundation, one apply — toggle on edge, compute, and data.

The Google Cloud sibling of the landing-zone pattern. Foundation (always on): a VPC with a single shared Cloud NAT, a CMEK key ring, logs + artifacts GCS buckets, least-privilege service accounts, a monitoring baseline, and Secret Manager. Flip enable_edge for Cloud DNS + a managed cert + Cloud Armor (WAF), enable_compute for a global HTTPS load balancer in front of Cloud Run, and enable_data for Cloud SQL + Memorystore. tofu validate is clean with everything off and everything on.

Google Cloud14 modules14 live-tested$918.00 a-la-carte

How it composes

Foundation (always on): the VPC uses a single Cloud NAT; the KMS key ring provides CMEK for the buckets; service accounts are least-privilege; monitoring exports logs and alerts. enable_edge adds Cloud DNS + a Google-managed cert + Cloud Armor; enable_compute bridges a global HTTPS load balancer to Cloud Run through a serverless NEG; enable_data adds a private-IP Cloud SQL instance + a Basic Memorystore Redis.

Composed root - live-tested 2026-08-04

This stack ships a single OpenTofu/Terraform root module that wires its modules together, statically validated with tofu validate. Set your domain and CIDRs in terraform.tfvars, then tofu init && tofu apply. We also ran the root itself through a real apply → verify → destroy cycle. Full stack (edge + compute + data tiers on): 51 resources applied against a real GCP project, all 14 tier outputs verified, and everything destroyed back to an empty state. The foundation-only variant passed the same cycle on 2026-08-03.

Modules in this stack

Browse the full catalog How we verify