Generated by Merlin Studio (https://app.merlin-studio.cloud). Licensed under the Apache License, Version 2.0 (https://www.apache.org/licenses/LICENSE-2.0).
This is a reference configuration for a GCP Landing Zone foundation for acmebank.com, generated by Merlin Studio. Generate your own at app.merlin-studio.cloud.
🆓 Merlin is now open — no signup, no email. Guest mode lets you start designing your own landing zone instantly. Open Merlin → app.merlin-studio.cloud.
Generated: 2026-09-01T14:32:22.012870Z Profile: Advanced Organization: acmebank.com
This document describes the Cloud Foundation configuration for acmebank.com. This establishes your GCP Landing Zone.
| Attribute | Value |
|---|---|
| Cloud Foundation Name | acmebank |
| Organization ID | <YOUR_ORG_ID> |
| Primary Region | europe-west9 |
| Configuration Profile | Advanced |
| Architecture Type | Hub and Spoke |
| Compliance Frameworks | ISO27001, PCI, GDPR, EUCS, CIS |
| Organization Policies | 14 enforced |
| Log Retention | 3650 days |
| Billing Account | <YOUR_BILLING_ACCOUNT_ID> |
This cloud foundation is configured to support:
-
ISO27001
-
PCI
-
GDPR
-
EUCS
-
CIS
Before deploying: This is an example reference. Replace
<YOUR_ORG_ID>,<YOUR_BILLING_ACCOUNT_ID>, theacmebank.comdomain, and theacmebankproject prefix with your own values. SeeDEPLOYMENT_GUIDE.mdfor the full prerequisite checklist.
Every value in this bundle was derived deterministically from the discovery answers plus the selected frameworks (PCI DSS, ISO 27001, CIS, EUCS, GDPR), with DORA's resilience obligations reflected in the DR and logging choices. This trace names the rule that fired for each headline control and the file where it landed. ✅ = in the IaC as generated · 📋 = documented posture, to be finished by your team.
| # | Control | What fired | Where it landed |
|---|---|---|---|
| 1 | ✅/📋 PCI scope segmentation | PCI DSS scoping — each workload isolated as one project per environment, all enclosed in a VPC Service Controls perimeter with restricted services derived from actual API enablement; a dedicated CDE folder is the documented next hardening step | vpcsc/datasets/default/perimeters/main.yaml, project-factory/projects/ |
| 2 | ✅ EU region lock | GDPR Art. 44–49 + EUCS data sovereignty → gcp.resourceLocations allow-list in:eu-locations, enforced at the organization, plus a Frankfurt interconnect facility |
org-setup/.../org-policies/gcp.resourcelocations.yaml |
| 3 | ✅/📋 CMEK for every data service | PCI Req 3 + EUCS CRY-01/02 + GDPR Art. 32(1)(a) → one CMEK key per service, wired into every workload project; CIS GCP 1.10 → 90-day rotation (the strictest framework wins). Ships at SOFTWARE protection with an ARCHITECT TODO to raise to HSM | security/.../keyrings/kr-europe-west9.yaml, CMEK_WIRING.md |
| 4 | ✅/📋 Centralized egress | Advanced profile → hub-and-spoke with default internet routes deleted everywhere and Cloud NAT only in the hub, so all egress converges there; an inline inspection appliance (NGFW/IDS) is left to the network team | networking/datasets/hub-and-spokes-peerings/ |
| 5 | ✅ Immutable long-retention audit logs | PCI Req 10 + EUCS logging → 10-year (3650-day) retention with a locked audit-logs bucket, Data Access audit logs on, and three aggregated org sinks |
§6 below (Logging & Monitoring) |
| 6 | ✅ DLP for cardholder data | PCI DSS Req 3 → PAN inspection template deployed with the security dataset | security/.../dlp/inspect-templates/pci-cardholder-detection.yaml |
| 7 | ✅/📋 MFA + privileged access | ISO 27001 A.5.15 + PCI Req 8 → groups-based IAM (six admin groups, no per-user grants), key access scoped per keyring, service-account key creation denied org-wide; MFA and just-in-time elevation are enforced in Cloud Identity (IdP-side, documented) | org-setup/datasets/main/defaults.yaml, §2 below |
| 8 | ✅ Dual-region resilience | Warm-standby DR (EUCS availability + PCI continuity) → every VPC gets europe-west4 subnets at a +128 CIDR offset and the DR region carries a full replica keyring | networking/.../vpc-prod/subnets/europe-west4.yaml, security/.../keyrings/kr-europe-west4.yaml |
The AWS port of this same bank profile is
AWS-PCI-EUCS-Bank-Example —
one spec, two clouds.
This bundle is one wizard session's output, not a hand-crafted repo. You can generate a landing-zone artifact for your own requirements with Merlin Studio — app.merlin-studio.cloud. It is open: no signup, no email, guest mode starts immediately. Pick your own frameworks, regions and workloads and compare what fires against this example.
- Compile-Time AI for GCP Landing Zones — how the compile-time approach works: LLMs at design time, deterministic generation at run time.
- Setting Up a GCP Landing Zone for Organizations with Strict Regulatory Requirements — the regulated-industry design decisions behind a foundation like this one.
acmebank.com (<YOUR_ORG_ID>)
│
├── 📁 Production
│ └── Purpose: Environment
├── 📁 Staging
│ └── Purpose: Environment
├── 📁 Development
│ └── Purpose: Environment
├── 📁 Shared Services
│ └── Purpose: Shared Services
├── 📁 Security
│ └── Purpose: Security
├── 📁 Networking
│ └── Purpose: Networking
├── 📁 Data Platform
│ └── Purpose: Data
├── 📁 Sandbox
│ └── Purpose: Sandbox
| Folder | Purpose | Description |
|---|
| Production | Environment | Production workloads |
| Staging | Environment | Pre-production testing |
| Development | Environment | Development |
| Shared Services | Shared Services | Common infrastructure |
| Security | Security | Security tooling |
| Networking | Networking | Hub networks and connectivity |
| Data Platform | Data | Analytics and data services |
| Sandbox | Sandbox | Experimentation |
| Project Name | Folder | Purpose | APIs |
|---|
| prj-seed-kms | Security | Kms | cloudkms.googleapis.com |
Configured environments: Development, Staging, Production
| Group Name | Purpose | Roles |
|---|
| gcp-organization-admins@acmebank.com | Org Admin | roles/resourcemanager.organizationAdmin |
| gcp-billing-admins@acmebank.com | Billing Admin | roles/billing.admin |
| gcp-network-admins@acmebank.com | Network Admin | roles/compute.networkAdmin, roles/compute.securityAdmin |
| gcp-security-admins@acmebank.com | Security Admin | roles/iam.securityAdmin, roles/accesscontextmanager.policyAdmin |
| gcp-audit-viewers@acmebank.com | Audit Viewer | roles/iam.securityReviewer, roles/logging.viewer |
| gcp-support-admins@acmebank.com | Support Admin | roles/cloudsupport.techSupportEditor |
| Name | Project | Purpose | Roles |
|---|
| terraform-org-sa | prj-seed-terraform | Terraform Org | roles/resourcemanager.organizationAdmin, roles/iam.organizationRoleAdmin, roles/orgpolicy.policyAdmin, roles/billing.admin |
| terraform-network-sa | prj-seed-terraform | Terraform Network | roles/compute.networkAdmin, roles/compute.securityAdmin, roles/dns.admin |
| terraform-security-sa | prj-seed-terraform | Terraform Security | roles/iam.securityAdmin, roles/accesscontextmanager.policyAdmin, roles/securitycenter.admin |
| cicd-deploy-sa | prj-seed-cicd | Cicd | roles/clouddeploy.operator, roles/cloudbuild.builds.editor, roles/artifactregistry.writer |
| security-scanner-sa | prj-seed-security | Security Scanner | roles/iam.securityReviewer, roles/securitycenter.sourcesViewer |
| Attribute | Value |
|---|---|
| Architecture Type | Hub and Spoke |
| VPC Name | Project | Routing Mode | Purpose |
|---|
| vpc-hub | prj-network-hub | GLOBAL | Hub |
| vpc-prod | prj-network-prod | GLOBAL | Production |
| vpc-dev | prj-network-dev | GLOBAL | Non Production |
| Subnet | VPC | Region | CIDR | Private Google Access |
|---|
| sb-hub-europe-west9 | vpc-hub | europe-west9 | 10.0.0.0/20 | Yes |
| sb-prod-europe-west9 | vpc-prod | europe-west9 | 10.1.0.0/20 | Yes |
| sb-dev-europe-west9 | vpc-dev | europe-west9 | 10.2.0.0/20 | Yes |
| sb-hub-europe-west4 | vpc-hub | europe-west4 | 10.128.0.0/20 | Yes |
| sb-prod-europe-west4 | vpc-prod | europe-west4 | 10.129.0.0/20 | Yes |
| sb-dev-europe-west4 | vpc-dev | europe-west4 | 10.130.0.0/20 | Yes |
| Attribute | Value |
|---|---|
| Connectivity Type | Partner Interconnect |
| VPN Type | HA VPN | | Routing | Dynamic |
| Network Name | CIDR Ranges |
|---|
| on-prem-network | 10.100.0.0/16 |
| Setting | Value |
|---|---|
| Inbound Forwarding | Enabled |
14 organization policies configured:
| Constraint | Enforcement | Scope |
|---|
| compute.skipDefaultNetworkCreation | enforce | organization |
| compute.requireOsLogin | enforce | organization |
| compute.requireShieldedVm | enforce | organization |
| compute.disableSerialPortAccess | enforce | organization |
| compute.vmExternalIpAccess | deny_all | organization |
| compute.disableNestedVirtualization | enforce | organization |
| storage.uniformBucketLevelAccess | enforce | organization |
| storage.publicAccessPrevention | enforce | organization |
| sql.restrictPublicIp | enforce | organization |
| sql.restrictAuthorizedNetworks | enforce | organization |
| iam.disableServiceAccountKeyCreation | enforce | organization |
| iam.disableServiceAccountKeyUpload | enforce | organization |
| gcp.detailedAuditLoggingMode | enforce | organization |
| gcp.resourceLocations | allow_list | organization |
| Setting | Value |
|---|---|
| Default Retention Period | 3650 days |
| Bucket Name | Retention (Days) | Locked |
|---|
| audit-logs | 3650 | Yes |
| security-logs | 365 | Yes |
| Setting | Value |
|---|---|
| Logging Project | prj-seed-logging |
| Aggregated Sinks | 3 configured |
| Aspect | Value |
|---|---|
| DR Region | europe-west4 |
| DR-region subnets | sb-hub-europe-west4, sb-prod-europe-west4, sb-dev-europe-west4 |
| DR-region KMS keyring | kr-europe-west4 (per-service CMEK keys) |
| Audit log retention | 10 years (3650 days) |
- Cloud SQL cross-region replicas and failover policy
- GCS bucket cross-region replication or dual-region buckets
- Backup policies (snapshot frequency, cross-region copy, retention)
- Failover orchestration (manual promotion, app-layer retries)
- DR runbook and tabletop testing schedule
RPO and RTO are workload-layer outcomes. The landing zone supports a warm-standby posture (RPO: minutes, RTO: hours) but does not configure workload-specific replication.
| Budget Name | Amount | Scope |
|---|
| Organization Budget | USD 100000 | billing_account |
This wizard generated FAST factory YAML data files — structured configuration that plugs directly into Google Cloud's FAST Fabric landing zone framework.
| Attribute | Value |
|---|---|
| Output Format | FAST Factory YAML |
| Framework | Cloud Foundation Fabric (FAST) |
| Stages Generated | 5 |
| Stage | Directory | Description |
|---|
| Organization Setup | org-setup/ | Folders, IAM bindings, org policies, tags, billing |
| Networking | networking/ | VPC networks, subnets, firewall rules, DNS, VPNs |
| Security | security/ | KMS keyrings, security projects, SCC |
| Project Factory | project-factory/ | Workload projects (GKE, data, apps, compute, ops) |
| VPC Service Controls | vpcsc/ | Service perimeters, access levels, ingress/egress policies |
- Cloud Foundation Fabric repository cloned
- GCP Organization with appropriate permissions
- Terraform >= 1.7 installed
- A service account or user with Organization Admin privileges
-
Clone FAST Fabric (if not already done):
git clone https://github.com/GoogleCloudPlatform/cloud-foundation-fabric.git cd cloud-foundation-fabric/fast -
Place the generated data files into the corresponding FAST stage directories:
-
Copy
org-setup/contents into the FASTorg-setup/stage data directory -
Copy
networking/contents into the FASTnetworking/stage data directory -
Copy
security/contents into the FASTsecurity/stage data directory -
Copy
project-factory/contents into the FASTproject-factory/stage data directory -
Copy
vpcsc/contents into the FASTvpcsc/stage data directory
-
-
Deploy stages in order:
-
Stage 0: Organization Setup (
org-setup/) -
Stage 1: Networking (
networking/) -
Stage 2: Security (
security/) -
Stage 3: Project Factory (
project-factory/) -
Stage 4: VPC Service Controls (
vpcsc/)
-
-
Review and apply each stage with Terraform:
terraform init terraform plan terraform apply
The generated YAML files use FAST's factory data format with $-interpolation tokens that are resolved at terraform plan time:
$iam_principals:...— References to IAM identities$project_ids:...— References to project IDs from the FAST registry$folder_ids:...— References to folder IDs
These tokens ensure that cross-stage dependencies are resolved automatically by FAST.
- FAST Documentation: See FAST README
- Stage-specific docs: Each FAST stage directory contains its own README
- Community: r/googlecloud, Stack Overflow
-
No Warranty: These configurations are generated based on your inputs. Review thoroughly before any deployment.
-
Security Review Required: Have your security team review IAM bindings and org policies before deployment.
-
Cost Implications: Deploying this infrastructure will incur GCP charges. Review the Cost Management section.
-
Not Standalone: The YAML data files require FAST Fabric modules to deploy. They are not standalone Terraform.
-
Your Responsibility: Actual deployment, testing, and maintenance are your responsibility.
| Role | |
|---|---|
| Primary Contact | platform-team@acmebank.com |
Generated by Merlin Studio. Licensed under the Apache License, Version 2.0