# Google Cloud Landing Zone for AI Workloads — Reference Architecture **Publisher:** Earp Strategic Consulting, LLC **Scope:** Google Cloud organization foundation hardened for generative-AI and ML workloads on Vertex AI in regulated industries. **Status:** Reference architecture. Adapt names, regions and address space to your organization; every value below is an example. --- ## 1. Design principles 1. **Constraints at the organization node.** Organization policies are set at the top and inherited; folder-level exceptions are reviewed code with an owner and an expiry. 2. **Perimeters around data.** VPC Service Controls perimeters enclose projects that hold sensitive data and Vertex AI, preventing exfiltration through Google APIs even with valid credentials. 3. **Private by default.** Workloads reach Google APIs over Private Google Access and Private Service Connect; no external IPs on VMs. 4. **Identity is the perimeter.** People authenticate through Cloud Identity (or Workforce Identity Federation); workloads use service accounts with no downloadable keys. 5. **Everything is code, and every model call is on the record.** Terraform deploys the foundation; an inference gateway writes a hash-chained ledger entry per model call. --- ## 2. Resource hierarchy ``` Organization (example.com) ├── fldr-common │ ├── prj-c-logging # aggregated log sinks, log buckets with retention locks │ ├── prj-c-security # Security Command Center, KMS key projects, Secret Manager │ ├── prj-c-billing-export │ └── prj-c-network-hub # Network Connectivity Center hub, Cloud Interconnect / HA VPN ├── fldr-production │ ├── prj-p-shared-vpc-host # Shared VPC host for production │ └── prj-p- # service projects ├── fldr-nonproduction │ ├── prj-n-shared-vpc-host │ └── prj-n- ├── fldr-ai # optional: dedicated folder for Vertex AI workloads │ └── prj-p--ai # service projects inside a VPC-SC perimeter └── fldr-sandbox # no Shared VPC attachment, budget-capped, auto-expiry ``` Projects are the unit of workload isolation, IAM and billing: one project per workload per environment. --- ## 3. Identity | Control | Implementation | |---|---| | Workforce identity | Cloud Identity synced from the corporate IdP, or Workforce Identity Federation for IdP-native access without syncing users | | Access model | Google Groups mapped to predefined or custom IAM roles at folder or project level; no basic roles (Owner/Editor) on production | | Privileged access | Privileged Access Manager (or an approval workflow) for time-bound elevation to admin roles | | Workload identity | Dedicated service accounts per workload; GKE Workload Identity Federation; CI uses Workload Identity Federation (OIDC) | | Key hygiene | Org policy `iam.disableServiceAccountKeyCreation` enforced; no user-managed service-account keys | | Super admins | Two dedicated super-admin accounts with hardware security keys, not used for daily work, with alerting on sign-in | --- ## 4. Network ### 4.1 Topology - **Shared VPC** per environment: a host project owns the VPC; service projects attach and use designated subnets. - **Network Connectivity Center** hub in `prj-c-network-hub` with VPC spokes for each Shared VPC and hybrid spokes for Cloud Interconnect / HA VPN. - **Egress** through Cloud NAT with Secure Web Proxy or Cloud Next Generation Firewall policies enforcing FQDN allow-lists; VMs have no external IPs (org policy). - **Ingress:** global external Application Load Balancer with Cloud Armor security policies (preconfigured WAF rules, rate limiting, adaptive protection). - **Private connectivity:** Private Service Connect endpoint for Google APIs (`all-apis` or `vpc-sc` bundle) and PSC endpoints for Vertex AI online prediction; Private Google Access on all subnets. - **DNS:** Cloud DNS private zones for `googleapis.com` resolving to the PSC endpoint, shared through DNS peering. ### 4.2 Example CIDR plan | Scope | Region A | Region B | |---|---|---| | Hub / hybrid transit | 10.8.0.0/22 | 10.9.0.0/22 | | Production Shared VPC (primary ranges) | 10.16.0.0/14 | 10.24.0.0/14 | | Non-production Shared VPC (primary ranges) | 10.32.0.0/14 | 10.40.0.0/14 | | GKE pod secondary ranges (pool) | 100.64.0.0/12 | 100.80.0.0/12 | | GKE service secondary ranges (pool) | 100.96.0.0/16 | 100.97.0.0/16 | | PSC endpoints (global internal addresses) | 10.255.255.0/28 | — | | Sandbox (not attached) | 172.28.0.0/14 | — | Standard AI workload allocation within the production Shared VPC: | Subnet | Size | Purpose | |---|---|---| | `sb-p--app` | /24 | Cloud Run (Direct VPC egress) / GKE nodes | | `sb-p--gke-pods` (secondary) | /20 | GKE pods | | `sb-p--gke-svc` (secondary) | /24 | GKE services | | `sb-p--psc` | /28 | PSC endpoint for Vertex AI online prediction | --- ## 5. Security baseline - **Security Command Center** (Premium or Enterprise tier as required) activated at the organization level: Security Health Analytics, Event Threat Detection, Container Threat Detection and posture findings. - **Logging:** aggregated organization sink routing Admin Activity, Data Access (for sensitive services) and VPC Flow Logs to locked log buckets in `prj-c-logging`, with export to BigQuery for analysis. - **Baseline organization policies:** - `gcp.resourceLocations` — allowed regions - `iam.disableServiceAccountKeyCreation` - `iam.allowedPolicyMemberDomains` — domain-restricted sharing - `compute.vmExternalIpAccess` — deny - `compute.requireOsLogin` - `storage.publicAccessPrevention` and `storage.uniformBucketLevelAccess` - `compute.skipDefaultNetworkCreation` - `gcp.restrictNonCmekServices` for data and AI services in the AI folder - **VPC Service Controls:** one perimeter per data classification, containing the data and Vertex AI projects; access levels for corporate networks and CI identities; dry-run mode before enforcement. --- ## 6. Data - **Dataplex** for data discovery, cataloguing, data-quality scans and lineage across BigQuery and Cloud Storage; aspect tags record which data sets are approved for grounding or tuning. - **BigQuery:** column-level security with policy tags and row-level access policies; datasets in CMEK-enabled projects. - **Sensitive Data Protection** discovery scans across BigQuery and Cloud Storage feeding Dataplex tags. - **Retention:** prompt/response payloads in Cloud Storage buckets with locked retention policies; the ledger stores hashes and metadata only. - **Encryption:** Cloud KMS customer-managed keys (CMEK) in dedicated key projects, with Cloud HSM or Cloud EKM where key custody requires it. --- ## 7. AI services | Component | Configuration | |---|---| | Vertex AI | Enabled only in service projects inside the VPC-SC perimeter; CMEK for datasets, endpoints and pipelines where supported | | Model access | Model Garden and generative model usage limited to an approved list enforced through IAM and org policy where available, maintained as code | | Online prediction | Private endpoints via Private Service Connect; no public endpoints for custom models | | Inference gateway | Cloud Run or GKE service in the workload project: authenticates callers, applies quotas and guardrail checks, hashes prompt + response, writes the ledger entry | | Safety | Safety settings and filters configured per use case; blocked responses logged with request metadata | | Retrieval | Vertex AI Search or a vector store in the perimeter, sourced only from Dataplex-approved data | | Evaluation | Scheduled evaluation runs against versioned golden sets; results stored with the model version in the workload project | --- ## 8. IaC module layout ``` infra/ ├── modules/ # Terraform │ ├── org-bootstrap/ # seed project, CI service account, state buckets │ ├── org-policies/ # constraints as code, with folder-level exceptions + expiry │ ├── folders/ # hierarchy and folder IAM │ ├── network-hub/ # NCC hub, Interconnect / HA VPN, Cloud DNS, PSC for Google APIs │ ├── shared-vpc/ # host projects, subnets, secondary ranges, firewall policies │ ├── project-factory/ # service projects: APIs, Shared VPC attachment, budgets, labels, IAM │ ├── vpc-sc/ # perimeters, access levels, ingress/egress rules │ ├── security/ # SCC settings, log sinks, KMS key rings │ └── vertex-ai-workload/ # Vertex AI resources, PSC endpoint, CMEK, gateway service account ├── live/ │ ├── 0-bootstrap/ 1-org/ 2-environments/ 3-networks/ 4-projects/ │ └── 5-workloads/// └── tests/ ├── policy-fixtures/ # resources expected to be denied by org policy └── plan-snapshots/ ``` CI rules: `terraform plan` posted to the PR; applies only from the main branch through Workload Identity Federation; VPC-SC changes go through dry-run for at least one full business cycle before enforcement. --- ## 9. Day-2 operations - **Project vending:** new workload = pull request to `live/4-projects/`; the project factory creates the project in the right folder, attaches it to Shared VPC, enables approved APIs, sets budgets and grants group-based access. - **Drift:** nightly `terraform plan` across every state; drift opens an issue with the diff. SCC posture findings reviewed weekly. - **Perimeter changes:** VPC-SC violations monitored from dry-run logs; ingress/egress rules changed only by pull request. - **Key rotation and revocation:** automatic Cloud KMS rotation; quarterly test disabling a CMEK key version in non-production and verifying dependent services fail closed. - **Access reviews:** quarterly review of group membership and IAM recommender findings; removal of unused roles. - **Model lifecycle:** model or version changes pass the eval gate before traffic is shifted on the endpoint. - **Cost:** budgets and alerts per project, billing export to BigQuery, and per-model usage dashboards for the inference gateway. --- *Earp Strategic Consulting — AI systems, governance and cloud architecture. This document describes a reference design; it is not a statement of compliance. Compliance frameworks are addressed through readiness mapping against your specific control set.*