Organization, folders, and project boundaries
Translating enterprise environment patterns into GCP without losing clarity around ownership and separation.
Lab
Current GCP platform work and technical focus.
Ongoing work around GCP identity, hierarchy, BigLake governance, storage design, and how enterprise platform standards carry cleanly into a second cloud.
IdentityGovernanceEnvironment design
Focus areas
What the current GCP build is centered on.
Identity and safe platform access
Service accounts, remote state, Workload Identity Federation, and least-privilege bootstrap design.
Silver in object storage, Gold in BigQuery
Testing where governed storage access should remain external and where warehouse materialization adds value.
BigLake policies in practice
Applying governed access patterns directly inside the GCP build while the platform design continues to mature.
Execution lanes
Where the current work is being driven.
The GCP build is not one vague track. It is moving through a few deliberate workstreams with clear platform responsibilities.
Foundation control plane
Focus repos: terraform-foundation-gcp and platform-docs-gcp
Org hierarchy, projects, and environment discipline
Building a clean project-per-environment shape so platform boundaries stay explicit from the start.
Identity model
Focus repos: terraform-bootstrap-gcp and internal auth docs
Federated access, remote state, and safe operator workflows
Treating bootstrap identity and least-privilege access as platform architecture, not setup trivia.
Storage and serving boundary
Current emphasis: Silver storage, Gold serving, and policy boundaries
Governed object storage, BigLake access, and BigQuery serving
Defining where external governed access should remain in storage and where warehouse-native tables should take over.
Current decisions
Platform decisions being worked through directly.
These are active architecture decisions inside the build, not abstract prompts. Each one affects how the platform gets separated, governed, and made operable across environments.
How should enterprise GCP environments be separated cleanly?
One project per environment, reusable logic, and no quiet hardcoded drift across dev, staging, and prod.
How should a local machine connect safely to cloud systems?
Not just browser login, but also CLI auth, ADC, impersonation, and federated CI/CD access.
What should stay in storage and what should move into the warehouse?
Choosing between object-storage access and native warehouse tables based on governance, cost, and consumer needs.
Engineering discipline
Standards applied across the build.
No manual shortcuts where IaC belongs
If the setup belongs in Terraform, the lab should treat it that way from the start.
Keep the reasoning visible
The useful artifact is not only the working state, but also the explanation behind it.
Build for multiple environments
The same logic should deploy across environments through controlled inputs, not ad hoc edits.
Keep the writing clear without lowering standards
The documentation should stay accessible and precise while remaining faithful to enterprise practice.