Google Cloud Foundation Builder
Deploys a secure enterprise landing-zone foundation for a Google Cloud organization.
The document requires explicit approval before deployment and discloses organization policies, projects, billing, logging, and monitoring changes; it also warns that the allowed-member-domains policy can lock out the deployment identity. However, permission failures trigger bulk grants of organization-, billing-, and security-level roles to the active identity. This is substantially broader than least privilege, with no systematic data-flow disclosure, rollback plan, or complete confirmation of external effects, so the score is heavily reduced.
The workflow is structured and includes discovery, deployment, reuse checks, and validation checks. However, the referenced files contain no executable test evidence; commands and resource naming have inconsistencies, such as configurable bucket location versus later hard-coded global assumptions, and display-name matching may be unstable. Recovery relies on broad role grants, while abnormal-input handling and diagnosable failure feedback are thin. Static review caps this at 10.
The intended audience, primary scenario, and non-fit case of individual project onboarding are stated, with requested inputs and expected resources. Trigger precision, organization-structure variation, non-fit boundaries, and mainland-China reachability are not adequately addressed; the core workflow depends on gcloud and Google Cloud services, with no Chinese-language support defined. Therefore it is not near full marks.
The documentation has clear progressive structure and includes a preview warning, prerequisites, references, command examples, validation checklist, Apache-2.0 licensing, and official repository maintenance signals. It lacks skill-level versioning, changelog, explicit maintenance ownership, and a concrete update path, while leaving API, IAM, and naming assumptions implicit, so points are deducted.
The skill theoretically covers baseline policies, folders, projects, billing, logging, and monitoring, which aligns with its stated landing-zone goal. Yet key templates and commands are not execution-verified, organization policies may affect existing workloads, idempotency and existing-resource matching are incomplete, and the result requires substantial administrator review and likely field corrections. Static review caps this at 7.
The skill supplies concrete constraints, role mappings, commands, and validation checks, with links to official documentation, providing limited auditability. It contains no committed test suite, CI coverage, execution records, or independently reproducible evidence, and the supplied references do not provide multi-source corroboration. Static review caps this at 5.
- Failure recovery automatically grants entire organization- or billing-level administrative groups to the active identity, creating a serious privilege-expansion risk; least-privilege, pre-authorization, and human approval should replace this behavior.
- Applying organization policies, creating projects, and linking billing can have broad and persistent external effects; a complete rollback or recovery procedure is absent.
- Commands, resource matching, and logging-location assumptions require environment-by-environment verification; no commands were executed in this review.
- The core workflow depends on Google Cloud and gcloud, with no stated mainland-China reachability or Chinese interaction support.
What does this skill do, and when should you use it?
This skill is designed for setting up a new Google Cloud organization or establishing an enterprise landing-zone foundation. It applies 17 organization policies, creates four folders and corresponding projects, and links them to a billing account. It also configures centralized logging, an organization-level audit log sink, and cross-project monitoring. The skill is in preview and is not intended for individual project onboarding.
It first uses gcloud organizations list, gcloud billing accounts list --filter=open=true, and organization metadata commands to identify the organization, open billing accounts, directory customer ID, and domain name, while asking for a project-ID suffix and optional log-bucket region. After explicit confirmation, it generates and sequentially applies 17 organization policies, checks and reuses existing Common, Production, Non-Production, and Development folders, and creates missing folders and four corresponding projects. It links the projects to billing and enables the specified APIs, then configures a central log bucket, an organization-wide log sink, and a cross-environment metrics scope. On permission failures, it attempts to grant the relevant administrative role group with organization-level or billing-level IAM binding commands and retries; if remediation fails, it halts and requests administrator intervention.
- A cloud platform team is establishing security baselines and resource hierarchy for a new Google Cloud organization.
- An enterprise cloud architect is creating production, non-production, and development environments with centralized billing.
- A security team needs organization-wide organization policies, audit logging, and cross-project monitoring.
- A platform engineering team wants a predefined central logging project and environment-project structure.
What are this skill's strengths and limitations?
- Covers core landing-zone areas including organization policies, folders, projects, billing, logging, and monitoring.
- Checks for and reuses existing folders and projects to reduce duplication.
- Includes grouped permission remediation and a post-deployment validation checklist.
- The skill is explicitly in preview and lacks some advanced features.
- It performs high-impact organization-level security and hierarchy changes.
- It requires organization, billing, and related administrative permissions; failed remediation requires manual administrator action.
- The source provides no test-suite or platform-compatibility testing evidence.
How do you install this skill?
Install the repository and select this skill from the available skills:npx skills add google/skills
The skill is located at skills/cloud/google-cloud-recipe-foundation-builder/SKILL.md. The source does not document a separate command for installing only this skill.
How do you use this skill?
After installation, ask a compatible Agent Skills client:
“Deploy the Foundation Builder landing zone for my Google Cloud organization. First list available organizations and open billing accounts, then show me the deployment summary and wait for my confirmation.”
Before use, prepare a Google Cloud organization, an authorized identity configured for the gcloud CLI, and an open billing account. The skill pauses for explicit Yes/No approval before making deployment changes.
How does this skill compare with similar options?
For individual project onboarding, the source points to google-cloud-recipe-onboarding or product-specific skills. This skill targets organization-level landing-zone construction rather than single-project onboarding.