Landing zone design in Google Cloud: 10 Elements of GCP landing Zone

Published in

Google Cloud - Community

19 min readJun 18, 2023

Technical GCP Onboarding Overview

As we all know, a smooth and secure onboarding process is a key step for our customers in their digital transformation journey. Our focus is on an accelerated onboarding approach for our global customers, emphasizing speed and scale, powered by automation processes and a robust delivery model. This enables our customers to reap the benefits of Google Cloud from day one.

In the onboarding process, I collaborate with customer stakeholders across various technical domains, such as identity, networking, and security, to identify their cloud foundational needs. By leveraging our customers’ inputs and key decisions, we deploy foundational services using Google Cloud, and our enterprise onboarding checklist ensures effective working sessions with customers, focusing on implementation along with a tech walkthrough of the setup.

Our primary aim is to provide our customers with a workload-agnostic foundation, enabling them to swiftly transition a wide variety of workflows to Google Cloud. Let’s delve into our four-stage onboarding approach:

Business Requirements: At this stage, we gain a thorough understanding of our customers’ business and technical requirements, ensuring alignment with their cloud readiness.
Kickoff and Planning: During this stage, we identify key customer stakeholders and collaboratively agree on the project plan and deliverables.
Preparation: In this stage, we conduct orientation sessions for our customers, addressing and troubleshooting their cloud identity domain and billing setup.
Implementation: Leveraging our automation tools, such as the GCP console, we set up the foundation and verify the implementation. We thoroughly document the deliverables and hand them over to the migration team, ensuring an accelerated adoption and enhanced customer experience.

Throughout this process, we prioritize value-driven onboarding, allowing customers to leverage the full potential of Google Cloud Platform offerings in transforming their businesses.

Now, let’s take a closer look at the steps we undertake to implement the foundation setup:

Organization Setup: We set up the organization, super admin user groups, and best practices, verifying the customer’s domain and configuring a cloud identity tenant. Additionally, we provision primary or secondary identity providers and implement single sign-on, if required. From a users and groups perspective, we create recommended user groups with their respective roles, map users to their groups, and handle unmanaged conflict accounts.
Cloud Billing: We design a single or multi-billing resource hierarchy and associate billing accounts accordingly. Online billing accounts are created, and we assist customers in setting up their invoice-to-billing accounts. Furthermore, we establish budgets, billing alerts, and billing export reports.
Resource Hierarchy and Identity Access Management: We implement our recommended initial resource hierarchy, creating initial folders and projects with proper user group access and permissions.
Network Configuration and Hybrid Connectivity: Based on the provided input, we design a network topology and create VPCs, interconnecting them as necessary. We also set up shared VPCs using a hub-and-spoke model and attach them to relevant projects. Additionally, we configure a highly available VPN to connect GCP VPCs with the customer’s on-premises or external cloud environments, implementing firewalls and security controls to ensure secure VPN connectivity.
Logging and Monitoring: We set up cloud logging and monitoring to collect metrics, events, and metadata from Google Cloud services for the created projects.
Organizational Security: We configure the standard security command centre to monitor cloud assets and implement organizational policies to secure the organization’s cloud resources following GCP best practices. Some examples include disabling external IP addresses for VM instances and enforcing location-specific resource constraints.

In addition to the onboarding process, we leverage the following automation resources:

The ten-step GCP enterprise onboarding checklist.
The Cloud Foundation Toolkit provides a repository of baseline GCP best practices implemented using Terraform and Deployment Manager.

Set up your organisation for success on Google Cloud

Cloud Identity and Organization

Cloud Identity is an identity management platform provided by Google Cloud that allows organizations to manage user identities and access to cloud resources across various applications and services. Cloud Identity provides features such as single sign-on (SSO), multi-factor authentication (MFA), and user provisioning and de-provisioning. Cloud Identity can be used to manage user identities for Google Cloud services such as Google Workspace and third-party applications and services that support SAML-based SSO.

An organization represents a hierarchy of resources, starting with the organization itself and including folders and projects within the organization. Organizational policies can be applied at different levels of the hierarchy to ensure consistent security and governance across projects.

Cloud Identity and Organization together, organizations can manage user access to cloud resources across their entire Google Cloud hierarchy. Cloud Identity can be used to manage user identities and access policies, while Organization can be used to apply consistent security and governance policies across all projects within the organization.

Users and Groups

Google Cloud Platform (GCP) users and groups are used to manage access to GCP resources. Users are individual people who have accounts on GCP, while groups are collections of users who share a common role or set of permissions.

Users

Each user has a unique email address and password.
Users can be assigned IAM roles, which grant them permissions to access GCP resources.
Users can be members of groups, which inherit the IAM roles granted to the group.

Groups

Groups can be created by users or administrators.
Groups can have a name, email address, and description.
Groups can have members, who are individual users or other groups.
Groups can be assigned IAM roles, which are inherited by all members of the group.

Managing Users and Groups

Users and groups can be managed using the Google Cloud console, the gcloud CLI, or the Cloud Identity and Access Management (IAM) API.

Benefits of Using Users and Groups

Users and groups provide a way to manage access to GCP resources at scale.
Users and groups can help to simplify the process of granting and revoking permissions.
Users and groups can help to improve security by centralizing the management of permissions.

Here are some of the key benefits of using users and groups in GCP:

Scalability: Users and groups can be used to manage access to GCP resources at scale. This is because users and groups can be created and managed in bulk, which can save time and effort.
Simplicity: Users and groups can help to simplify the process of granting and revoking permissions. This is because permissions can be granted to groups, rather than individual users. This can make it easier to manage permissions, especially in large organizations.
Security: Users and groups can help to improve security by centralizing the management of permissions. This is because permissions are managed in a single location, which makes it easier to track and audit permissions.

Administrative Access

GCP Administrative Access is a set of permissions that allow users to manage GCP resources. These permissions include the ability to create, delete, and modify resources, as well as the ability to grant and revoke access to other users.
Administrative Access is typically granted to users who need to manage GCP resources on a day-to-day basis. This includes roles such as project owners, billing administrators, and network administrators.
There are two types of Administrative Access:
Project-level Administrative Access grants users permissions to manage resources within a specific project.
Organization-level Administrative Access grants users permissions to manage resources across an entire organization.
To grant Administrative Access to a user, you need to assign them the appropriate IAM role. The IAM role you assign will determine the level of access the user has to GCP resources.
For example, if you want to grant a user the ability to create and delete projects, you would assign them the roles/owner role.
It is important to note that Administrative Access is a powerful set of permissions. Users with Administrative Access can make significant changes to your GCP resources, so it is important to carefully consider who you grant these permissions to.

Here are some best practices for managing GCP Administrative Access:

Only grant Administrative Access to users who need it.
Use IAM roles to give users the least amount of permissions they need to do their job.
Rotate Administrative Access credentials regularly
Use auditing to track who has access to your GCP resources and what they are doing.

Billing

Google Cloud Platform (GCP) billing is a system that tracks and manages your expenses for using Google Cloud services. GCP billing is based on a pay-as-you-go model, which means that you only pay for the resources that you use.

There are a few different ways to track your GCP billing:

The Google Cloud console: The Google Cloud console is a web-based interface that you can use to manage your GCP resources. The console includes a billing section that shows you your current billing information, including your usage, costs, and payments.
The Cloud Billing API: The Cloud Billing API is a RESTful API that you can use to programmatically access your billing information. The API can be used to get your current billing information, as well as to track your historical billing information.
The Cloud Billing reports: Cloud Billing reports provide you with detailed information about your billing usage. Reports can be generated for a specific period of time, or for a specific set of resources.

To understand GCP billing, it is important to understand the following terms:

Project: A project is a collection of resources that you use in GCP. Each project has its own billing account.
Billing account: A billing account is a container for your billing information. Each billing account can be associated with one or more projects.
Usage: Usage is the amount of resources that you use in GCP. Usage is measured in units, such as GB-hours for Compute Engine or API calls for Cloud Storage.
Cost: Cost is the amount of money that you pay for your usage. Cost is calculated based on the usage of your resources and the pricing of those resources.
Payment: A payment is a transaction that you make to Google to pay for your GCP usage. Payments can be made by credit card, bank account, or wire transfer.

Resource Hierarchy

Resource hierarchy in GCP is a way of organizing your GCP resources into a tree-like structure. This hierarchy can be used to manage access to your resources, as well as to track and audit your resource usage.

The root of the resource hierarchy is the organization. An organization is a container for all of your GCP resources. You can create folders and projects within your organization. Folders are a way of grouping projects together, and projects are the smallest unit of resource hierarchy in GCP.

Resource hierarchy is important for a few reasons. First, it allows you to manage access to your resources. You can control who has access to your organization, folders, and projects. This can help you to protect your resources from unauthorized access.

Second, resource hierarchy can help you to track and audit your resource usage. You can track how much resources are being used by each organization, folder, and project. This can help you to identify areas where you can save money.

Here are some of the benefits of using resource hierarchy in GCP:

Centralized management: Resource hierarchy allows you to manage your GCP resources from a single location. This can save you time and effort, as you don’t have to log in to multiple different resources to manage them.
Improved security: Resource hierarchy can help you to improve the security of your GCP resources. You can control who has access to your resources, and you can track and audit your resource usage.
Simplified billing: Resource hierarchy can help you to simplify your billing. You can track your billing costs by organization, folder, and project. This can help you to identify areas where you can save money.

Here are some of the key concepts of resource hierarchy in GCP:

Organization: The root of the resource hierarchy is the organization. An organization is a container for all of your GCP resources.
Folder: Folders are a way of grouping projects together. You can create folders within your organization.
Project: A project is the smallest unit of resource hierarchy in GCP. A project is a collection of resources that you use in GCP.
Inheritance: Resource hierarchy uses inheritance to determine the permissions that users have to resources. If a user has permission to a folder, they also have permission to all of the projects in that folder.

Network Configuration

GCP Network Configuration is a set of rules that control how your GCP resources can communicate with each other and with the outside world. These rules are enforced by the Google Cloud Networking service.

The main components of GCP Network Configuration are:

VPC networks: VPC networks are logical networks that you can create in GCP. VPC networks are isolated from each other, so traffic between VPC networks is not allowed by default.
Subnets: Subnets are sub-networks of a VPC network. Subnets are used to group your resources together and to control how they can communicate with each other.
Firewall rules: Firewall rules control how traffic flows into and out of your VPC networks. Firewall rules can be used to allow or deny traffic based on a variety of criteria, such as the source and destination IP addresses, the port numbers, and the protocol.
Network tags: Network tags are labels that you can assign to your resources. Network tags can be used to control how your resources can communicate with each other and with the outside world.

Here are some of the benefits of using GCP Network Configuration:

Security: GCP Network Configuration can help you to improve the security of your GCP resources. You can control how your resources can communicate with each other and with the outside world, which can help to protect your resources from unauthorized access.
Performance: GCP Network Configuration can help you to improve the performance of your GCP resources. By grouping your resources together in subnets, you can reduce the amount of traffic that needs to cross the internet, which can improve the performance of your resources.
Cost: GCP Network Configuration can help you to save money on your GCP costs. By controlling how your resources can communicate with each other and with the outside world, you can reduce the amount of traffic that you need to pay for.

Here are some of the key concepts of GCP Network Configuration:

VPC network: A VPC network is a logical network that you can create in GCP. VPC networks are isolated from each other, so traffic between VPC networks is not allowed by default.
Subnet: A subnet is a sub-network of a VPC network. Subnets are used to group your resources together and to control how they can communicate with each other.
Firewall rule: A firewall rule controls how traffic flows into and out of your VPC networks. Firewall rules can be used to allow or deny traffic based on a variety of criteria, such as the source and destination IP addresses, the port numbers, and the protocol.
Network tag: A network tag is a label that you can assign to your resources. Network tags can be used to control how your resources can communicate with each other and with the outside world.

Hybrid Connectivity

Hybrid Connectivity is a suite of services that allow you to connect your on-premises networks to Google Cloud Platform (GCP). This allows you to seamlessly connect your on-premises applications and workloads to GCP services, such as Compute Engine, Cloud Storage, and BigQuery.

There are three main types of Hybrid Connectivity services:

Cloud Interconnect: Cloud Interconnect provides a dedicated physical connection between your on-premises network and Google’s network. This is the most reliable and secure way to connect to GCP.
Cloud VPN: Cloud VPN provides a secure, encrypted connection between your on-premises network and Google’s network over the public internet. This is a more cost-effective option than Cloud Interconnect, but it is not as reliable or secure.
Peering with Google: Peering with Google allows you to connect your on-premises network directly to Google’s network at the edge of your ISP’s network. This is the most cost-effective option, but it is not as reliable or secure as Cloud Interconnect or Cloud VPN.

Hybrid Connectivity can be used for a variety of purposes, including:

Migrating on-premises workloads to GCP: Hybrid Connectivity can be used to migrate your on-premises workloads to GCP without having to change your network architecture.
Extending your on-premises network to GCP: Hybrid Connectivity can be used to extend your on-premises network to GCP, allowing you to access GCP services from your on-premises applications and workloads.
Balancing traffic between on-premises and GCP: Hybrid Connectivity can be used to balance traffic between your on-premises network and Google’s network, improving the performance of your applications and workloads.

Here are some of the benefits of using Hybrid Connectivity:

Reliability: Hybrid Connectivity provides a reliable and secure way to connect to GCP. This is because Cloud Interconnect and Cloud VPN use dedicated physical connections or encrypted tunnels, respectively.
Performance: Hybrid Connectivity can improve the performance of your applications and workloads by reducing latency and improving throughput. This is because Hybrid Connectivity uses dedicated physical connections or encrypted tunnels, which can provide a more direct path between your on-premises network and Google’s network.
Cost-effectiveness: Hybrid Connectivity can be a cost-effective way to connect to GCP, especially if you already have a high-speed internet connection.

Logging and Monitoring

Logging and Monitoring on Google Cloud are two key pillars of observability, which is the practice of collecting and analyzing data about your applications and infrastructure to gain insights into their performance, health, and security.

Logging is the process of collecting and storing data about events that occur in your applications and infrastructure. This data can include things like errors, warnings, and performance metrics.

Monitoring is the process of analyzing the data collected by your logs to identify problems, trends, and opportunities for improvement.

Google Cloud provides a comprehensive set of logging and monitoring tools that can help you to collect, store, and analyze data about your applications and infrastructure. These tools include:

Cloud Logging: Cloud Logging is a fully-managed service that collects and stores logs from your applications and infrastructure.
Cloud Monitoring: Cloud Monitoring is a fully-managed service that collects and analyzes metrics, events, and logs from your applications and infrastructure.
Cloud Trace: Cloud Trace is a fully-managed service that collects and analyzes distributed tracing data from your applications.

These tools can be used to collect data about a wide variety of events, including:

Errors: Errors are events that indicate that something has gone wrong with your application or infrastructure.
Warnings: Warnings are events that indicate that something may be wrong with your application or infrastructure.
Performance metrics: Performance metrics are data points that measure the performance of your application or infrastructure.
Distributed tracing: Distributed tracing is a technique for tracking the flow of requests through your application or infrastructure.

The data collected by your logs can be used to identify problems, trends, and opportunities for improvement. For example, you can use your logs to identify errors that are occurring in your application, or to track the performance of your infrastructure over time.

Google Cloud also provides a number of features that can help you to make sense of the data collected by your logs. These features include:

Log analytics: Log analytics is a process of analyzing the data collected by your logs to identify problems, trends, and opportunities for improvement.
Log alerts: Log alerts are notifications that are triggered when certain conditions are met in your logs.
Log exports: Log exports allow you to export the data collected by your logs to other systems, such as BigQuery or Cloud Dataflow.

By using the logging and monitoring tools provided by Google Cloud, you can gain a deeper understanding of your applications and infrastructure, and you can use this understanding to improve the performance, reliability, and security of your systems.

Organizational Security

Organizational security on GCP is a set of policies and controls that you can use to protect your organization’s data and resources. These policies and controls can be used to control access to your resources, to enforce security best practices, and to audit your organization’s security posture.

Google Cloud provides a number of features that can help you to implement organizational security. These features include:

IAM: IAM is a system that allows you to control who has access to your resources. You can use IAM to create roles and permissions, and to assign those roles and permissions to users and groups.
Organization policies: Organization policies are a way to enforce security best practices across your entire organization. You can use organization policies to control things like the use of encryption, the configuration of your firewall, and the use of privileged accounts.
Cloud Audit Logging: Cloud Audit Logging is a service that collects logs of all API calls made to your organization’s resources. You can use Cloud Audit Logging to audit your organization’s security posture, and to identify potential security risks.

By using the features provided by Google Cloud, you can implement a comprehensive organizational security program that can help to protect your organization’s data and resources.

Here are some of the benefits of implementing organizational security on GCP:

Increased security: Organizational security can help to protect your organization’s data and resources from unauthorized access, modification, or destruction.
Reduced risk: Organizational security can help to reduce your organization’s risk of data breaches, compliance violations, and other security incidents.
Improved compliance: Organizational security can help your organization to comply with industry regulations, such as HIPAA and PCI DSS.
Increased efficiency: Organizational security can help to improve your organization’s efficiency by reducing the time and resources that you spend on security-related tasks.

Customer Care Portfolio — Support

Google Cloud Platform (GCP) offers a variety of support options to help you get the most out of your cloud journey. The Customer Care Portfolio is a suite of support services that are designed to meet the needs of organizations of all sizes.

The Customer Care Portfolio includes three levels of support:

Basic Support: Basic Support is included with all Google Cloud accounts. It provides 24/7 access to documentation, community support, and Cloud Billing Support.
Enhanced Support: Enhanced Support provides additional benefits over Basic Support, including priority support, access to technical experts, and 24/7 phone support.
Premium Support: Premium Support is the highest level of support offered by Google Cloud. It provides all of the benefits of Enhanced Support, as well as dedicated technical account managers, and SLAs for response and resolution times.

The Customer Care Portfolio is designed to be flexible and scalable, so you can choose the level of support that best meets your needs. If you are just getting started with GCP, Basic Support may be sufficient. However, if you are running critical workloads or need help with complex issues, you may want to consider Enhanced or Premium Support.

Here is a table that summarizes the benefits of each level of support:

Level of SupportBenefitsBasic Support24/7 access to documentation, community support, and Cloud Billing SupportEnhanced SupportPriority support, access to technical experts, and 24/7 phone supportPremium SupportDedicated technical account managers, SLAs for response and resolution times

To learn more about the Customer Care Portfolio, visit the Google Cloud Support website: https://cloud.google.com/support.

Cloud Foundation Toolkit

The Cloud Foundation Toolkit (CFT) is a set of open-source tools and configurations provided by Google Cloud Platform (GCP) to help you provision a landing zone or a foundation for your cloud environment. It aims to provide a scalable and standardized infrastructure setup across your organization’s GCP projects.

To get started with the Cloud Foundation Toolkit, you can follow these steps:

Install and set up the necessary dependencies:

Install the latest version of Python (2.7 or 3.5+).
Install Terraform, a popular infrastructure-as-code tool, which is a dependency for the CFT.
Install Git, a version control system used to download the CFT code.

Clone the CFT repository:

Go to the CFT GitHub repository at: https://github.com/GoogleCloudPlatform/cloud-foundation-toolkit.
Clone the repository to your local machine using Git: git clone https://github.com/GoogleCloudPlatform/cloud-foundation-toolkit.git.
Change to the cloned directory: cd cloud-foundation-toolkit.

Customize the CFT configurations:

The CFT provides a set of example configurations and templates that you can modify to suit your organization’s requirements.
Review the config/ directory and modify the configurations according to your needs.
Update variables such as organization ID, project IDs, naming conventions, and resource configurations in the respective configuration files.

Provision the landing zone:

Open a terminal or command prompt in the cloud-foundation-toolkit directory.
Initialize Terraform by running terraform init to download the necessary providers and modules.
Use terraform apply to provision the landing zone. This command will validate the configurations and create the infrastructure based on the provided settings.

It’s important to note that the Cloud Foundation Toolkit is a powerful and flexible tool, but it may require significant customization and expertise to tailor it to your specific needs. It’s recommended to carefully review the documentation and consult with your team or cloud experts when using it in production environments.

For detailed instructions, please refer to the official Cloud Foundation Toolkit documentation, available at: https://cloud.google.com/foundation-toolkit

Conclusion:

Designing a robust landing zone on Google Cloud requires careful planning, adherence to best practices, and continuous optimization. By defining clear objectives, establishing a solid foundation, leveraging managed services, and prioritizing security, you can create a high-performing, scalable, and secure cloud environment to support your organization’s growth and innovation. Embrace the power of Google Cloud to unlock the full potential of your cloud-based applications and services

About Me

I am having experienced IT professional with a passion for helping businesses embark on their journey to the cloud. With over 14+ years of industry experience, I currently serve as a Google Cloud Principal architect, specializing in assisting customers in building highly scalable and efficient solutions on the Google Cloud Platform. My expertise lies in infrastructure and zero trust security, google cloud networking, and cloud infrastructure building using Terraform. I hold several prestigious certifications, including Google Cloud Certified, HashiCorp Certified, Microsoft Azure Certified, and Amazon AWS Certified.

Certificated :

Google Cloud Certified — Cloud Digital Leader.
2. Google Cloud Certified — Associate Cloud Engineer.
3. Google Cloud Certified — Professional Cloud Architect.
4. Google Cloud Certified — Professional Data Engineer.
5. Google Cloud Certified — Professional Cloud Network Engineer.
6. Google Cloud Certified — Professional Cloud Developer Engineer.
7. Google Cloud Certified — Professional Cloud DevOps Engineer.
8. Google Cloud Certified — Professional Security Engineer.
9. Google Cloud Certified — Professional Database Engineer.
10. Google Cloud Certified — Professional Workspace Administrator.
11. Google Cloud Certified — Professional Machine Learning.
12. HashiCorp Certified — Terraform Associate
13. Microsoft Azure AZ-900 Certified
14. Amazon AWS-Practitioner Certified

Helping professionals and students to Build their cloud careers. My responsibility is to provide make the cloud easy content to easily understand! Please do #like, #share and #subscribe for more amazing #googlecloud content and #googleworkspace content If you need any guidance and help feel free to connect with me

YouTube:https://www.youtube.com/@growwithgooglecloud

Topmate :https://topmate.io/gcloud_biswanath_giri

Medium:https://bgiri-gcloud.medium.com/

Telegram: https://t.me/growwithgcp

Twitter: https://twitter.com/bgiri_gcloud

Instagram:https://www.instagram.com/google_cloud_trainer/

LinkedIn: https://www.linkedin.com/in/biswanathgirigcloudcertified/

Facebook:https://www.facebook.com/biswanath.giri

Linktree:https://linktr.ee/gcloud_biswanath_giri

and DM me,:) I am happy to help!!