GCP Infrastructure Provisioning Guide

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

The first drawing for GCP

GCP in this window is a lab you can name. The lab is a project you administer, not the whole organisation. The drafts come from the Compute Engine, VPC, subnet, and firewall generators. The generators draft commands or files. They do not log into the account, and they do not create anything. You read every name before a later window applies anything.

The network is one VPC network and one subnet or the product's equivalent. A documentation prefix such as 192.0.2.0/24 stays in the note. The prefix you would apply is the one the network guide already assigned. example.com is not a name you own.

The firewall rule names its source. You do not open the rule to 0.0.0.0/0, and you do not delete the firewall to make a test pass. The line you keep has a source you can say. A draft that contains 0.0.0.0/0 is a draft you edit. Management from the whole internet is not the lab.

The virtual machine's service account is not the project owner. The gcloud configuration names this project before any create. prompt-for-this is not a key, a token, or a password. It does not go in the file, the ticket, or user-data.

One lab name, one draft you can read aloud

Write the account label, the region or location, and the lab name. Draft the network first, then the virtual machine, then the edge rule. Read the drafts in that order. If a name does not say lab, change the name before you continue.

Write the project id from a read command, not from memory. If the configuration still points at a different project, the drafts stay in the ticket.

The identity on the virtual machine is not an owner and not a root key. The CLI or Terraform profile is the one in the ticket. A read of that identity, from the CLI guide, matches before any create.

Stop after the drafts are in the ticket. Apply is a later hour, one resource at a time, in the account you wrote down. The cost guide has the size. The infrastructure guide has the language if you are using a file. This page does not apply all four generators in one sitting.

# GCP lab note. Review before you apply.
# Account: the one in the ticket. Region written.
# VPC network uses an assigned prefix, not a documentation range.
# Delete 0.0.0.0/0 from any draft.
# prompt-for-this is not a credential.
# One resource per later window.

A change you can finish

The later change creates the network in the lab, then stops. The machine waits until that network exists and the edge rule is the one you edited.

Rollback of a lab you just created is deleting that lab resource. You do not delete a shared network. You do not edit state or the console blindly to hide a mistake.

Write the account, the region, and the lab name.
Draft the network and confirm the prefix is assigned.
Draft the edge rule and remove 0.0.0.0/0.
Draft one virtual machine at a lab size.
Confirm the identity is not an owner.
Save the drafts. Do not apply them in the writing hour.
Hand the first create to its own window.

Mistakes that outlive the command

GCP fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.

Applying four drafts in one hour.
A documentation prefix typed into the account.
A 0.0.0.0/0 rule kept because the generator wrote it.
An owner or root credential in the file.
The wrong account, noticed after a create.
A production name used as the lab.
User-data or metadata that contains a secret.
The largest size as the first machine.
The default network assumed, or the project owner used as the virtual machine identity.
No second admin before you change a lockout setting.
Calling the draft a finished environment.

Decisions to write down before the window

One decision for GCP: The account in the note is the lab account. The region is written. The prefix is assigned, not a documentation range. The edge source is a name. 0.0.0.0/0 is absent from the draft you will keep. The machine size is a lab size. The identity is not an owner. No credential is in the file or the ticket. Apply is a later window. One resource will be created first, the network. The gcloud project matches the ticket before any create. And a second person can say which account this is.

The hour you stop

Write the account, the project or subscription, the region, and the clock time before you change anything for GCP. If this account is serving people and you do not have a way back, this hour is a plan. A plan you can read tomorrow is a success. A change you cannot undo is not.

Use a lab account, a lab project, or a lab subscription you administer. You do not point a CLI, a pipeline, or a browser tool at an account you do not run. The tools on this site run in the browser. They draft text. They do not log in, and they do not scan.

prompt-for-this is a reminder that a secret is missing. It is not an access key, a token, a password, or a kubeconfig you save. The real secret stays in the password store or the platform's secret store. If a file, a log, a ticket, or a pipeline still contains a live secret, stop and rotate it. Then delete the copy.

One change. A network, a virtual machine, a policy, and a pipeline do not share a window. If two things move and the outcome is wrong, you will not know which one did it. The rollback is the previous file, the previous plan, or the resource you can delete because it was only a lab.

A second person reads the scope aloud: which account, which region, which name. If they cannot find it in the ticket, the ticket is not ready. Silence is not agreement.

Documentation addresses stay in the note. 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24, and 2001:db8::/32 are not prefixes you type into a production network. example.com is not your zone. A generated file that opens 0.0.0.0/0 is a file you edit before it is applied. A source you can name is the rule you keep.

Do not apply a draft you have not read. A cost estimate, a policy, a manifest, and a Terraform plan are reading material. Apply, a resize of a live machine, and a delete of a bucket are later decisions with their own proof. Read the names. Then decide.

Keep the previous file. A generator draft is not the previous file. The previous file is what you put back if the new one is wrong. You practised the path back, including the serial console or a second admin, before you changed a network or a lockout setting.

If a step fails twice, stop. The failure is the result. Adding a command from a forum beside a half-applied stack produces an account nobody can explain. Rebuild the lab from the copy you kept.

When the checks pass, the next account waits until someone else can repeat the proof from the notes. GCP is done for this window when the proof is written, not when a CLI printed a success line.

This page is a planning guide. It is not a vendor manual, not an official standard, not legal advice, and not an audit opinion. If an auditor must see the decision, they see the ticket and the evidence, not this paragraph.

Hand the finished note to the neighbouring guide that owns the next step, and leave this account alone until that guide has its own window.

GCP checks before the first create

Confirm this before you call the change done: The account and region are in the ticket. The lab name is obvious. The prefix is the assigned one. No 0.0.0.0/0 remains. No credential is in the draft. The size is a lab size. The identity was read and it matches, or create has not started. A second person read the account line. The hostname in the prompt matches the hostname in the ticket for GCP. The result line includes the time and the person, not only the command. You can point at the rollback value without searching a chat history. And done is a sentence a second person can repeat: the proof for GCP happened, and the next host is not started early. If one of those fails, stop.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar.