cloud-foundation-fabric

name

cloud-foundation-fabric

description

Use this skill to build Google Cloud Platform (GCP) infrastructure following the official Cloud Foundation Fabric (CFF) patterns and best practices. Trigger this whenever the user mentions writing Terraform for GCP, deploying landing zones, or creating GCP folders, projects, VPCs, IAM, GKE clusters, KMS, billing, security, or databases using CFF. This skill provides an automated CFF helper script to search modules, read module documentation/inputs/outputs, extract examples, and generate best-practice Terraform code.

GCP Cloud Foundation Fabric (CFF) Skill

This skill helps you design, generate, and maintain production-ready GCP infrastructure using Terraform, adhering strictly to Google's official Cloud Foundation Fabric (CFF) patterns.

Why Cloud Foundation Fabric?

Cloud Foundation Fabric is a Google Cloud-managed toolkit of composable Terraform modules and blueprints. It provides a modular approach to building GCP landing zones and individual resource configurations while avoiding heavy-weight, overly opinionated modules.

Core Architecture & Stages

CFF encourages dividing landing zones into clear, sequential stages:

1. 0-bootstrap: Initial organization setup, CI/CD pipelines, state buckets, and seed identities.
2. 1-resman: Folder hierarchy and organizational IAM policies.
3. 2-networking: Hub-and-spoke VPC networks, Interconnect, Cloud NAT, Cloud DNS, and firewalls.
4. 3-security: Organization-wide logging, KMS keys, VPC Service Controls, CAS, and Secret Manager.
5. 4-project-factory: Automating project creation with service account, API enablement, and IAM configuration.

---

CFF Helper CLI Tool

This skill comes with a built-in helper script ./scripts/cff_helper.py that clones and dynamically syncs the latest version of the CFF repository to its own resource directory at ./resources/gcp-cff.

CLI Command Reference:

Use run_command to execute this script in the workspace to retrieve real-time module schemas, README details, and examples:

• Update/Sync to Latest CFF Version:

  ./scripts/cff_helper.py update
  

• List All Available Modules:

  ./scripts/cff_helper.py list
  

• Search for Modules:

  ./scripts/cff_helper.py search <query>
  

• View Module Details (README summary, Variables, and Types):

  ./scripts/cff_helper.py info <module_name>
  

• Extract Examples from Module:

  ./scripts/cff_helper.py example <module_name>
  

• Generate Terraform Boilerplate:

  ./scripts/cff_helper.py generate <module_name>
  

---

GCP Infrastructure Design Principles

When designing GCP infrastructure with this skill, adhere to the following best practices:

1. Source Module Pinning

Always use the Cloud foundation fabric GitHub URL pinned to a specific version tag or release (e.g., ref=v34.0.0) in your production Terraform modules.

Prefer official releases and aim to use the latest available release version.

:

module "project" {
  source = "github.com/GoogleCloudPlatform/cloud-foundation-fabric//modules/project?ref=v34.0.0"
  # ...
}

2. State and Backend Isolation

Ensure state is stored in standard GCS buckets. Group your state files by environment/stage to limit the blast radius of changes.

3. Least Privilege IAM

• Use dedicated Service Accounts for workloads instead of user accounts.
• Grant granular, project-level roles or custom roles instead of broad admin privileges.
• Leverage CFF's extensive IAM maps support (e.g., iam variable on modules) to apply permissions inline rather than defining separate google_project_iam_member resources where possible.

4. Secure Networking

• Disable auto_create_network for all projects.
• Use Shared VPC where central networking teams manage subnets, and workload teams attach service projects.
• Integrate firewalls, Cloud NAT for outbound-only access, and Private Google Access.

5. KMS Encryption

• Encrypt data-at-rest across GCS, BigQuery, Compute, and Pub/Sub using Customer Managed Encryption Keys (CMEK) via the CFF kms or project module.

---

Workflow Checklist

1. Update local CFF repository: Run cff_helper.py update to ensure you are consulting the freshest CFF definitions.
2. Explore modules: Run cff_helper.py search <resource> and info <module> to inspect module schemas and read summaries.
3. Inspect examples: Check module examples with cff_helper.py example <module>.
4. Generate boilerplate: Run cff_helper.py generate <module> to bootstrap the Terraform block.
5. Review and customize: Adapt the generated code, add providers/backend configurations, and review against GCP security and naming best practices.