What problem does it solve? Setting up a new Google Cloud Organization securely requires manually configuring dozens of organization policies, building a resource hierarchy, linking billing, and wiring centralized audit logging — a slow, error-prone process that often skips critical security guardrails. ## Core Features & Use Cases - Baseline Security Guardrails: Enforces 17 recommended Organization Policies (13 Boolean, 4 List constraints) covering public access prevention, service account key restrictions, OS Login, and domain restrictions. - Resource Hierarchy Provisioning: Creates 4 folders (Common, Production, Non-Production, Development) and 4 billing-linked projects with required APIs enabled. - Centralized Logging & Monitoring: Deploys a global log bucket with 30-day retention, an organization-wide audit log sink, and a cross-project monitoring metrics scope. - Lazy IAM Remediation: Detects Permission Denied failures and self-remediates by granting the appropriate administrative role group, halting for manual intervention if remediation fails. - Use Case: A platform engineer setting up a brand-new Google Cloud Organization can run this recipe to establish a secure, enterprise-grade landing zone in one guided session instead of weeks of manual console work. ## Quick Start Ask the agent to set up a secure Google Cloud landing zone foundation for your organization, providing your Organization ID and billing account when prompted.
