Generated by Merlin Studio (https://app.merlin-studio.cloud). Licensed under the Apache License, Version 2.0 (https://www.apache.org/licenses/LICENSE-2.0).

This is a reference configuration for a GCP Landing Zone foundation for acme.com, generated by Merlin Studio. Generate your own at app.merlin-studio.cloud.

🆓 Merlin is now open — no signup, no email. Guest mode lets you start designing your own landing zone instantly. Open Merlin → app.merlin-studio.cloud.

---

acme - Configuration Documentation

Generated: 2026-08-04T14:53:06.425466Z Profile: Standard Organization: acme.com

---

Executive Summary

This document describes the Cloud Foundation configuration for acme.com. This establishes your GCP Landing Zone.

Attribute	Value
Cloud Foundation Name	acme
Organization ID	<YOUR_ORG_ID>
Primary Region	us-central1
Configuration Profile	Standard
Architecture Type	Shared VPC

| Compliance Frameworks | SOC2, CIS |

| Organization Policies | 10 enforced |

| Log Retention | 365 days |

| Billing Account | <YOUR_BILLING_ACCOUNT_ID> |

Compliance Requirements

This cloud foundation is configured to support:

• SOC2

• CIS

Before deploying: This is an example reference. Replace <YOUR_ORG_ID>, <YOUR_BILLING_ACCOUNT_ID>, the acme.com domain, and the acme project prefix with your own values. See DEPLOYMENT_GUIDE.md for the full prerequisite checklist.

---

1. Organization Structure

1.1 Folder Hierarchy

acme.com (<YOUR_ORG_ID>)
│

├── 📁 Production
│   └── Purpose: Environment

├── 📁 Staging
│   └── Purpose: Environment

├── 📁 Development
│   └── Purpose: Environment

├── 📁 Shared Services
│   └── Purpose: Shared Services

├── 📁 Security
│   └── Purpose: Security

Folder	Purpose	Description

| Production | Environment | Production workloads |

| Staging | Environment | Pre-production testing |

| Development | Environment | Development |

| Shared Services | Shared Services | Common infrastructure |

| Security | Security | Security tooling |

1.2 Bootstrap Projects

Project Name	Folder	Purpose	APIs

| prj-seed-cicd | Shared Services | Cicd | cloudbuild.googleapis.com, artifactregistry.googleapis.com |

| prj-seed-logging | Security | Logging | logging.googleapis.com |

| prj-seed-networking | Shared Services | Networking | compute.googleapis.com, servicenetworking.googleapis.com |

| prj-seed-kms | Security | Kms | cloudkms.googleapis.com |

1.3 Environments

Configured environments: Development, Staging, Production

---

2. Identity & Access Management

2.1 Administrative Groups

Group Name	Purpose	Roles

| gcp-organization-admins@acme.com | Org Admin | roles/resourcemanager.organizationAdmin |

| gcp-billing-admins@acme.com | Billing Admin | roles/billing.admin |

| gcp-network-admins@acme.com | Network Admin | roles/compute.networkAdmin |

| gcp-security-admins@acme.com | Security Admin | roles/iam.securityAdmin |

2.3 Service Accounts

Name	Project	Purpose	Roles

| terraform-org-sa | prj-seed-cicd | Terraform | roles/resourcemanager.projectCreator, roles/resourcemanager.folderAdmin |

| cicd-deploy-sa | prj-seed-cicd | Cicd | roles/clouddeploy.operator, roles/cloudbuild.builds.editor, roles/artifactregistry.writer |

---

3. Networking

3.1 Network Architecture

Attribute	Value
Architecture Type	Shared VPC

3.2 VPC Networks

VPC Name	Project	Routing Mode	Purpose

| vpc-shared-prod | prj-network-prod | GLOBAL | Production |

| vpc-shared-dev | prj-network-dev | GLOBAL | Non Production |

3.3 Subnets

Subnet	VPC	Region	CIDR	Private Google Access

| sb-prod-us-central1 | vpc-shared-prod | us-central1 | 10.0.0.0/20 | Yes |

| sb-dev-us-central1 | vpc-shared-dev | us-central1 | 10.1.0.0/20 | Yes |

---

4. Security Configuration

4.1 Organization Policies

10 organization policies configured:

Constraint	Enforcement	Scope

| compute.skipDefaultNetworkCreation | enforce | organization |

| compute.requireOsLogin | enforce | organization |

| compute.requireShieldedVm | enforce | organization |

| compute.disableSerialPortAccess | enforce | organization |

| compute.disableNestedVirtualization | enforce | organization |

| compute.vmExternalIpAccess | deny_all | organization |

| storage.uniformBucketLevelAccess | enforce | organization |

| storage.publicAccessPrevention | enforce | organization |

| sql.restrictPublicIp | enforce | organization |

| iam.disableServiceAccountKeyCreation | enforce | organization |

---

5. Logging & Monitoring

5.1 Log Retention

Setting	Value
Default Retention Period	365 days

5.2 Custom Retention Buckets

Bucket Name	Retention (Days)	Locked

| audit-logs | 365 | No |

5.3 Centralized Logging

Setting	Value
Logging Project	prj-seed-logging

| Aggregated Sinks | 1 configured |

---

6. Cost Management

6.1 Budgets

Budget Name	Amount	Scope

| Production Budget | USD 5000 | folder |

| Non-Production Budget | USD 2000 | folder |

---

Next Steps

This wizard has generated configuration data files (.tfvars) that capture your cloud foundation design decisions. These files are not directly executable — they require Terraform modules to consume them.

What You Have

File Type	Purpose	Directly Executable?
*.tfvars	Variable values for Terraform	No — needs modules
README.md	This documentation	N/A

How to Use These Files

Option 1: Use with Google FAST Fabric (Recommended)

Transform these configurations for use with Google FAST Fabric:

FAST Fabric provides:

• Production-tested modules
• Multi-stage deployment
• Built-in CI/CD integration
• YAML-based factories

Option 2: Create Custom Terraform Modules

Use the tfvars as a reference to build your own modules, then reference the generated files:

terraform plan -var-file="02_resource_hierarchy.auto.tfvars"

Option 3: Engage Professional Services

Share these files with Google Cloud Professional Services (PSO), Google Cloud Partners, or independent cloud consultants.

Deployment Order

Deploy in this order when you have modules:

1. Bootstrap (0-bootstrap)
   └── 2. Resource Management (1-resman)
       └── 3. Networking (2-networking)
           └── 4. Security (2-security)
               └── 5. Project Factory (3-project-factory)

Getting Help

• FAST Fabric: See FAST documentation
• Community: r/googlecloud, Stack Overflow

---

Important Disclaimers

1. No Warranty: These configurations are generated based on your inputs. Review thoroughly before any deployment.

2. Security Review Required: Have your security team review IAM bindings and org policies before deployment.

3. Cost Implications: Deploying this infrastructure will incur GCP charges. Review the Cost Management section.

4. Not Production-Ready Code: The tfvars files are design artifacts, not production Terraform modules.

5. Your Responsibility: Actual deployment, testing, and maintenance are your responsibility.

---

Contacts

Role	Email
Primary Contact	platform-team@acme.com

---

Generated by Merlin Studio. Licensed under the Apache License, Version 2.0