Menu
Design and manage GCP networking: VPC, subnets, firewall rules, Cloud Load Balancing, Cloud Armor, Private Google Access, and Shared VPC. Deny-by-default firewall posture. Warns before creating external load balancers (billable).
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Configure, install, and maintain Google-managed and self-hosted MCP servers for GCP. Covers setup, auth (ADC and SA key), capability map, troubleshooting, and version tracking. Every MCP entry includes a gcloud CLI fallback.
100% Google Cloud focused architect. Receives the GCP-scoped portion of the solution-designer HLD. Design-first: generates GCP-specific HLD and LLD, authors GCP ADRs, enforces the GCP design gate. Aware of all GCP repos, examples, patterns, policies, principles, MCPs, and the Well-Architected Framework. Does not make vendor-selection decisions — those belong to solution-designer.
Configure observability on GCP using Cloud Logging, Cloud Monitoring, Cloud Trace, and Cloud Profiler. Covers log sinks, log-based metrics, alerting policies, dashboards, and uptime checks. Owns the operational readiness evidence for gcp-ops.
Deploy and manage containerized workloads on Cloud Run. Covers service creation, traffic splitting, IAM, VPC connectivity, secrets integration, auto-scaling, and gcloud CLI patterns. Warns before billable deployments.
Deploy and manage Kubernetes workloads on Google Kubernetes Engine (GKE). Covers Autopilot and Standard modes, Workload Identity, node pool management, networking, security, and gcloud/kubectl CLI patterns. Warns before cluster creation (billable).
Agentic systems architect for the Gemini Enterprise Agent Platform (GEAP, formerly Vertex AI). Tier 2 specialist alongside gcp-architect: owns agentic application design AND agent evaluation execution. Covers ADK, Agent Runtime (formerly Agent Engine), the MCP/A2A/AP2 protocol stack, multi-agent topologies, grounding/RAG, memory, human-in-the-loop, and Gemini model selection. GCP is always the target deployment platform.
| name | networking |
| description | Design and manage GCP networking: VPC, subnets, firewall rules, Cloud Load Balancing, Cloud Armor, Private Google Access, and Shared VPC. Deny-by-default firewall posture. Warns before creating external load balancers (billable). |
| version | 0.1 |
| triggers | ["VPC","firewall","networking GCP","cloud load balancer","cloud armor","private google access","shared VPC","subnet","VPN GCP","cloud NAT","network design GCP"] |
| required_scopes | ["compute.firewalls.create","compute.firewalls.get","compute.firewalls.list","compute.networks.create","compute.networks.get","compute.subnetworks.create","compute.subnetworks.get"] |
| mcp_servers | [] |
Design and manage GCP VPC networks, connectivity, and traffic management. Deny-by-default; open only what is necessary.
gcloud compute networks create VPC_NAME \
--subnet-mode=custom \
--project=PROJECT_ID
gcloud compute networks subnets create SUBNET_NAME \
--network=VPC_NAME \
--region=REGION \
--range=10.0.0.0/24 \
--enable-private-ip-google-access \
--project=PROJECT_ID
# Deny all ingress (GCP default is deny-all for custom VPCs)
# Add targeted allow rules only:
gcloud compute firewall-rules create allow-internal \
--network=VPC_NAME \
--direction=INGRESS \
--action=ALLOW \
--rules=tcp:0-65535,udp:0-65535,icmp \
--source-ranges=10.0.0.0/8 \
--project=PROJECT_ID
gcloud compute networks subnets update SUBNET_NAME \
--region=REGION \
--enable-private-ip-google-access \
--project=PROJECT_ID
gcloud compute routers create ROUTER_NAME \
--network=VPC_NAME \
--region=REGION
gcloud compute routers nats create NAT_NAME \
--router=ROUTER_NAME \
--region=REGION \
--auto-allocate-nat-external-ips \
--nat-all-subnet-ip-ranges
0.0.0.0/0 as a source range for SSH or RDP — use IAP tunnels instead