[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6995QP11M7Y4PDCQYHT0ZM8":3,"skill-same:01M6995QP11M7Y4PDCQYHT0ZM8":87},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":46,"commitSha":47,"skillDirectory":48,"forksCount":49,"repositoryHtmlUrl":50,"repositoryHomepageUrl":6,"ownerHtmlUrl":51,"ownerBlogUrl":52,"ownerDescription":53,"updatedAt":54,"install":55,"resources":68},"01M6995QP11M7Y4PDCQYHT0ZM8","google-cloud-recipe-foundation-builder",null,"Deploys a baseline landing zone foundation for a Google Cloud Organization, establishing security guardrails using Organization Policies, resource hierarchy folders and projects, billing association, and centralized logging and monitoring. Deploys Google Cloud's recommended security controls and architecture. Use when setting up a new Google Cloud Organization or establishing a secure, enterprise-grade landing zone foundation.\nDon't use for individual project onboarding (use google-cloud-recipe-onboarding or product-specific skills instead).","google\u002Fskills","google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","01M698VYEFDM0VJBZDYYJ2T83S","Google","01M698WR0H76ENHE587T9EJT89",24235,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fgoogle-cloud-recipe-foundation-builder\u002FSKILL.md",[],[19,9,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"google cloud","google cloud recipe foundation builder","recipe","cloud","foundation","builder","when","hierarchy","billing","project","organization","up","projects","Guardrails","monitoring","product","secure","architecture","security","2026-11-10 10:12:30",false,"---\nname: google-cloud-recipe-foundation-builder\nmetadata:\n  version: \"1.0.1\"\n  category: GettingStarted\ndescription: >-\n  Deploys a baseline landing zone foundation for a Google Cloud Organization, establishing security guardrails using Organization Policies, resource hierarchy folders and projects, billing association, and centralized logging and monitoring. Deploys Google Cloud's recommended security controls and architecture.\n  Use when setting up a new Google Cloud Organization or establishing a secure, enterprise-grade landing zone foundation.\n\n  Don't use for individual project onboarding (use google-cloud-recipe-onboarding or product-specific skills instead).\n---\n\n# Google Cloud Recipe: Foundation Builder\n\n> [!WARNING] This skill is currently in a preview state. It will deploy a secure\n> foundation, but does not have all advanced features. Users who want more\n> options should visit\n> [Google Cloud Setup](https:\u002F\u002Fdocs.cloud.google.com\u002Fdocs\u002Fenterprise\u002Fcloud-setup).\n\nThis skill guides the setup of a secure, enterprise-grade Google Cloud landing\nzone foundation. It establishes baseline security controls, organizes the\ninitial resource hierarchy, and configures centralized audit logging and\ncross-environment monitoring.\n\n## Attribution\n\n**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you\nMUST read [Usage Attribution](references\u002Fattribution.md). For commands executed\ndirectly in the terminal (never in generated scripts, Terraform, or user code),\nprefix `gcloud` with\n`CLOUDSDK_METRICS_REQUEST_ATTRIBUTION=\"agent-skills\u002F1.0 (skill:google-cloud-recipe-foundation-builder)\"`\nand append `agent-skills\u002F1.0 (skill:google-cloud-recipe-foundation-builder)` to `User-Agent` headers.\n\n## Overview\n\nThe recipe provisions the following core components at the organization root:\n\n*   **Security Guardrails**: Enforces 17 baseline Google Cloud Organization\n    Policies to secure the environment (13 Boolean, 4 List constraints).\n*   **Resource Hierarchy**: Establishes 4 folders (`Common`, `Production`,\n    `Non-Production`, `Development`) and provisions corresponding projects\n    sequentially with globally unique ID prefixes (`logging-`, `prod-`,\n    `non-prod-`, `dev-` followed by a shared suffix).\n*   **Billing & API Enablement**: Links all projects to your billing account and\n    activates critical logging\u002Fmonitoring services.\n*   **Centralized Logging & Monitoring**: Deploys a global, centralized log\n    bucket with 30-day retention, configures an organization-wide audit log\n    sink, and sets up a cross-environment metrics scope.\n\n--------------------------------------------------------------------------------\n\n## Clarifying Questions\n\nBefore executing this recipe, the agent **must** gather the following details:\n\n1.  **Organization ID**: Run `gcloud organizations list` to retrieve the\n    available organizations, present them to the user, and ask them to select\n    the target **Organization ID**.\n2.  **Billing Account ID**: Run `gcloud billing accounts list\n    --filter=open=true` to retrieve only the active (open) billing accounts,\n    present them to the user, and ask them to select the active **Billing\n    Account ID**.\n3.  **Project ID Suffix**: Ask if the user has a preferred prefix or target\n    suffix for Project IDs (default uses prefix + a shared random 8-character\n    string, e.g., `prod-ab12cd34`).\n4.  **Log Bucket Region**: Ask for the target region for resources if they want\n    to override the default `global` log bucket location.\n\n--------------------------------------------------------------------------------\n\n## Prerequisites\n\nEnsure the following prerequisites are met before beginning the deployment:\n\n*   **GCP Identity**: You must have a Google Cloud Organization resource set up.\n*   **Administrative IAM Roles**: The identity executing these commands must\n    hold the required administrative permissions. If any step fails with a\n    `Permission Denied` error, the agent will attempt to self-remediate by\n    granting the corresponding recommended role as detailed in **Phase 2: Error\n    Recovery & Lazy Role Remediation Strategy**.\n*   **Tools**: The `gcloud` CLI must be installed, authorized with the above\n    identity, and configured for use.\n\n--------------------------------------------------------------------------------\n\n## Steps to Complete the Recipe\n\n### Phase 1: Pre-flight Confirmation\n\nIdentify the target organization and obtain explicit user approval before making\nchanges.\n\n1.  **Identify and Discover Organization**: Verify the target organization. If\n    only the display name is known, list organizations to find the ID. Then,\n    retrieve the organization metadata to dynamically calculate the **Directory\n    Customer ID** and **Domain Name**:\n\n    ```bash\n    # List to find ID if needed\n    gcloud organizations list\n\n    # Describe the organization to retrieve metadata\n    gcloud organizations describe [ORGANIZATION_ID]\n    ```\n\n    *Calculate values:*\n\n    *   **Domain Name** (`[ORG_NAME]` \u002F `[YOUR_DOMAIN]`): Use the `displayName`\n        value from the output (e.g., `my-business.com`).\n    *   **Customer ID** (`[DIRECTORY_CUSTOMER_ID]`): Use the\n        `owner.directoryCustomerId` value from the output (e.g., `C01234567`).\n\n2.  **Present Blueprint Summary**: Present the exact details of the blueprint to\n    the user and request confirmation to proceed:\n\n    > **Proposed Foundation Deployment Summary for Organization: `[ORG_NAME]`\n    > (`[ORGANIZATION_ID]`)**\n    >\n    > *   **Security:** Enforce 17 baseline Organization Policies (13 Boolean, 4\n    >     List).\n    > *   **Folders:** Create 4 folders sequentially (`Common`, `Production`,\n    >     `Non-Production`, `Development`).\n    > *   **Projects:** Create 4 projects sequentially with unique IDs\n    >     (`logging-[SUFFIX]`, `prod-[SUFFIX]`, `non-prod-[SUFFIX]`,\n    >     `dev-[SUFFIX]`).\n    > *   **Billing:** Link all projects to Billing Account\n    >     `[BILLING_ACCOUNT_ID]`.\n    > *   **APIs:** Enable Logging and Monitoring APIs on the central project.\n    > *   **Centralized Logging:** Deploy a `global` log bucket\n    >     `[ORG_NAME]-logging` (30-day retention), configure an\n    >     organization-level sink\n    >     `[ORGANIZATION_ID]-logbucketsink-[RANDOM_HEX]`, and establish\n    >     cross-project metrics scopes.\n    >\n    > Do you wish to proceed with this deployment? (Yes\u002FNo)\n\n> [!IMPORTANT] **Pause execution** and wait for explicit user approval before\n> moving to Phase 2. If the user declines, abort the operation.\n\n### Phase 2: Error Recovery & Lazy Role Remediation Strategy\n\nTo ensure deployment continues smoothly on clean organizations without requiring\ncomplex upfront permission checks (which require a quota project), the agent\n**must** adopt a \"lazy recovery\" approach.\n\nInstead of testing permissions in advance, the agent will attempt to execute\neach step in the recipe. If a step fails with a `Permission Denied` error, the\nagent will attempt to self-remediate by granting the corresponding recommended\nadministrative group of roles to the deployment identity and retrying the\noperation.\n\n> [!IMPORTANT] When asked about pre-deployment readiness, prerequisites, or\n> checks to run, the agent **must** explicitly explain that the landing zone\n> deployment adopts a lazy role remediation strategy rather than upfront\n> testing, detailing all of the following in its response: 1. Confirm it will\n> execute deployment commands directly, catching any Permission Denied\n> errors. 2. Confirm it will attempt to self-remediate on failure by running the\n> exact commands `gcloud organizations add-iam-policy-binding` or `gcloud\n> billing accounts add-iam-policy-binding` to grant the entire administrative\n> group of roles to the active identity, and then retry the failed deployment\n> command. 3. List the core administrative groups that it will attempt to grant\n> (Organization Admin Group, Billing Admin Group, and Security Admin Group)\n> mapped to their key roles. 4. Confirm it will halt execution and request\n> manual administrator intervention if the self-remediation grant command fails.\n\n#### Remediation Protocol\n\nFor any command that fails due to missing permissions:\n\n1.  **Identify Required Admin Group**: Determine which administrative group is\n    responsible for the failed action. Refer to the\n    [Administrative IAM Reference](references\u002Fadmin-iam.md#core-administrative-groups--roles)\n    for details.\n2.  **Attempt Self-Remediation**: Grant **all** roles belonging to that\n    administrative group to the active authenticated account sequentially. Refer\n    to the\n    [Administrative IAM Reference Remediation Guide](references\u002Fadmin-iam.md#remediation)\n    for the copy-pasteable script commands:\n\n    *   **For Organization\u002FFolder level failures (Org Admin Group or Security\n        Admin Group)**: Run `gcloud organizations add-iam-policy-binding`\n        sequentially for each role in the group.\n    *   **For Billing level failures (Billing Admin Group)**: Run `gcloud\n        billing accounts add-iam-policy-binding` sequentially for each role in\n        the group.\n\n3.  **Halt on Remediation Failure**:\n\n    *   If the grant commands succeed, immediately retry the failed deployment\n        command.\n    *   If any of the grant commands fail (e.g., due to lack of `setIamPolicy`\n        admin rights), **halt execution** and instruct the user to ask their\n        Organization\u002FBilling Administrator to manually grant the entire\n        administrative group of roles.\n\n#### Phase-Specific Remediation Mapping\n\n*   **Phase 3: Security Guardrails (Org Policies)**:\n    *   If `gcloud org-policies set-policy` fails: Attempt to grant the entire\n        **Organization Admin Group** (9 roles) at the organization level.\n*   **Phase 4: Resource Hierarchy (Folders & Projects)**:\n    *   If `gcloud resource-manager folders create` or `gcloud projects create`\n        fails: Attempt to grant the entire **Organization Admin Group** (9\n        roles) at the organization level.\n*   **Phase 4: Billing Link**:\n    *   If `gcloud billing projects link` fails: Attempt to grant the entire\n        **Billing Admin Group** (3 roles) at the billing account level, and\n        ensure the active identity is granted the **Organization Admin Group**\n        (which contains `roles\u002Fbilling.user`) at the organization level.\n*   **Phase 5: Centralized Logging & Monitoring**:\n    *   If `gcloud logging sinks create` fails at org level: Attempt to grant\n        the entire **Logging\u002FMonitoring Admin Group** (2 roles:\n        `roles\u002Flogging.admin`, `roles\u002Fmonitoring.admin`) and the **Security\n        Admin Group** (9 roles) at the organization level.\n\n### Phase 3: Security Guardrails (Org Policies)\n\nApply 17 baseline security controls at the organization root.\n\n> [!CAUTION] Applying `iam.allowedPolicyMemberDomains` first can lock out the\n> deployment identity if it resides in an unallowed domain. Ensure the\n> deployment identity is safe before enforcing this policy.\n\n1.  Generate the YAML configuration files for the 17 policies. Refer to the\n    [Organization Policies Reference](references\u002Forg-policies.md) for the exact\n    YAML templates for both Boolean and List constraints.\n2.  Apply each organization policy sequentially using the `gcloud org-policies`\n    tool:\n\n    ```bash\n    gcloud org-policies set-policy [POLICY_FILE_NAME].yaml\n    ```\n\n### Phase 4: Resource Hierarchy\n\n#### 1. Folder Creation\n\nCheck if target folders exist to avoid duplication. The agent must check for all\n4 folders: for any folder that already exists (e.g., if `Common` or `Production`\nare already present), the agent must locate and reuse them; for any folder that\nis missing (e.g., if `Non-Production` or `Development` are not present), the\nagent must proceed to sequentially create them:\n\n> [!IMPORTANT] When explaining how existing resources (folders and projects) are\n> handled to prevent duplication, the agent **must** explicitly name the\n> remaining missing folders (`Non-Production` and `Development`) and confirm\n> that it will proceed to sequentially create only these missing folders and\n> projects.\n\n```bash\n# Check and Create \"Common\" Folder\ngcloud resource-manager folders list --organization=[ORGANIZATION_ID] --filter=\"display_name=Common\"\n# If not present:\ngcloud resource-manager folders create --display-name=\"Common\" --organization=[ORGANIZATION_ID]\n\n# Check and Create \"Production\" Folder\ngcloud resource-manager folders list --organization=[ORGANIZATION_ID] --filter=\"display_name=Production\"\n# If not present:\ngcloud resource-manager folders create --display-name=\"Production\" --organization=[ORGANIZATION_ID]\n\n# Check and Create \"Non-Production\" Folder\ngcloud resource-manager folders list --organization=[ORGANIZATION_ID] --filter=\"display_name=Non-Production\"\n# If not present:\ngcloud resource-manager folders create --display-name=\"Non-Production\" --organization=[ORGANIZATION_ID]\n\n# Check and Create \"Development\" Folder\ngcloud resource-manager folders list --organization=[ORGANIZATION_ID] --filter=\"display_name=Development\"\n# If not present:\ngcloud resource-manager folders create --display-name=\"Development\" --organization=[ORGANIZATION_ID]\n```\n\n#### 2. Project Creation and Billing Link\n\nCheck if target projects already exist in the folders by matching their display\nnames. If not present, generate a shared 8-character random suffix (e.g.,\n`ab12cd34`) and create the projects sequentially, linking billing and enabling\nAPIs immediately:\n\n```bash\n# Check if \"central-logging-monitoring\" project exists in Common folder\ngcloud projects list --filter=\"parent.id=[COMMON_FOLDER_ID] AND parent.type=folder AND name=central-logging-monitoring\"\n\n# If not present: Create, link billing, and enable APIs\ngcloud projects create logging-[SUFFIX] --name=\"central-logging-monitoring\" --folder=[COMMON_FOLDER_ID]\ngcloud billing projects link logging-[SUFFIX] --billing-account=[BILLING_ACCOUNT_ID]\ngcloud services enable compute.googleapis.com logging.googleapis.com monitoring.googleapis.com --project=logging-[SUFFIX]\n\n# Check if \"production\" project exists in Production folder\ngcloud projects list --filter=\"parent.id=[PRODUCTION_FOLDER_ID] AND parent.type=folder AND name=production\"\n\n# If not present: Create, link billing, and enable APIs\ngcloud projects create prod-[SUFFIX] --name=\"production\" --folder=[PRODUCTION_FOLDER_ID]\ngcloud billing projects link prod-[SUFFIX] --billing-account=[BILLING_ACCOUNT_ID]\ngcloud services enable compute.googleapis.com run.googleapis.com container.googleapis.com artifactregistry.googleapis.com firestore.googleapis.com pubsub.googleapis.com aiplatform.googleapis.com cloudaicompanion.googleapis.com apphub.googleapis.com designcenter.googleapis.com discoveryengine.googleapis.com iam.googleapis.com config.googleapis.com cloudbuild.googleapis.com cloudasset.googleapis.com cloudkms.googleapis.com cloudresourcemanager.googleapis.com --project=prod-[SUFFIX]\n\n# Check if \"non-production\" project exists in Non-Production folder\ngcloud projects list --filter=\"parent.id=[NON_PRODUCTION_FOLDER_ID] AND parent.type=folder AND name=non-production\"\n\n# If not present: Create, link billing, and enable APIs\ngcloud projects create non-prod-[SUFFIX] --name=\"non-production\" --folder=[NON_PRODUCTION_FOLDER_ID]\ngcloud billing projects link non-prod-[SUFFIX] --billing-account=[BILLING_ACCOUNT_ID]\ngcloud services enable compute.googleapis.com run.googleapis.com container.googleapis.com artifactregistry.googleapis.com firestore.googleapis.com pubsub.googleapis.com aiplatform.googleapis.com cloudaicompanion.googleapis.com apphub.googleapis.com designcenter.googleapis.com discoveryengine.googleapis.com iam.googleapis.com config.googleapis.com cloudbuild.googleapis.com cloudasset.googleapis.com cloudkms.googleapis.com cloudresourcemanager.googleapis.com --project=non-prod-[SUFFIX]\n\n# Check if \"development\" project exists in Development folder\ngcloud projects list --filter=\"parent.id=[DEVELOPMENT_FOLDER_ID] AND parent.type=folder AND name=development\"\n\n# If not present: Create, link billing, and enable APIs\ngcloud projects create dev-[SUFFIX] --name=\"development\" --folder=[DEVELOPMENT_FOLDER_ID]\ngcloud billing projects link dev-[SUFFIX] --billing-account=[BILLING_ACCOUNT_ID]\ngcloud services enable compute.googleapis.com run.googleapis.com container.googleapis.com artifactregistry.googleapis.com firestore.googleapis.com pubsub.googleapis.com aiplatform.googleapis.com cloudaicompanion.googleapis.com apphub.googleapis.com designcenter.googleapis.com discoveryengine.googleapis.com iam.googleapis.com config.googleapis.com cloudbuild.googleapis.com cloudasset.googleapis.com cloudkms.googleapis.com cloudresourcemanager.googleapis.com --project=dev-[SUFFIX]\n```\n\n> [!NOTE] **Agentic Parallelism Option**: While the manual runbook enforces\n> sequential project execution to avoid terminal race conditions, an AI agent\n> with multi-agent orchestration capability may optionally spawn subagents to\n> provision the 4 projects in parallel once folder IDs are resolved.\n\n### Phase 5: Centralized Logging and Monitoring\n\nConfigure centralized audit logging and cross-project monitoring scope in the\n`logging-[SUFFIX]` project.\n\nRefer to the\n[Centralized Logging and Monitoring Reference](references\u002Flogging-monitoring.md)\nfor the detailed step-by-step commands to:\n\n1.  Create the central log bucket.\n2.  Create the organization-wide log sink.\n3.  Grant required IAM permissions to the log sink.\n4.  Configure the cross-project monitoring metrics scope.\n\n--------------------------------------------------------------------------------\n\n## Validation Logic & Checklist\n\nEvaluate the deployment against the following verification checks:\n\n-   [ ] **Security Policies**: Run `gcloud org-policies list\n    --organization=[ORGANIZATION_ID]` and verify all 17 target policies are\n    enforced or correctly configured.\n-   [ ] **Resource Folders**: Verify folders `Common`, `Production`,\n    `Non-Production`, and `Development` exist under the organization root.\n-   [ ] **Billing Linkage**: Run `gcloud billing projects list` and assert that\n    all 4 newly created projects are linked to your billing account.\n-   [ ] **Log Bucket & Retention**: Verify the log bucket `[ORG_NAME]-logging`\n    exists in project `logging-[SUFFIX]`, is located in `global`, and has a\n    retention period of exactly 30 days.\n-   [ ] **Log Sink Routing**: Run `gcloud logging sinks describe` at the\n    organization level and confirm the sink routes cloud audit logs to the\n    global bucket and holds standard `writerIdentity` credentials.\n-   [ ] **Metrics Scope Linkage**: Run `gcloud beta monitoring metrics-scopes\n    describe` and assert that the `dev`, `non-prod`, and `prod` projects appear\n    in the monitored list of the central `logging` project.\n\n--------------------------------------------------------------------------------\n\n## Links\n\n*   [Google Cloud Resource Hierarchy Documentation](https:\u002F\u002Fcloud.google.com\u002Fresource-manager\u002Fdocs\u002Fcreating-managing-organization)\n*   [Google Cloud Organization Policies Overview](https:\u002F\u002Fcloud.google.com\u002Fresource-manager\u002Fdocs\u002Forganization-policy\u002Foverview)\n*   [Centralized Audit Logging Best Practices](https:\u002F\u002Fcloud.google.com\u002Farchitecture\u002Fsecurity-foundations\u002Flogging-monitoring)\n*   [Cloud Monitoring Metrics Scopes Configuration](https:\u002F\u002Fcloud.google.com\u002Fmonitoring\u002Fsettings\u002Fmultiple-projects)\n*   [Gcloud Logging Sinks CLI Reference](https:\u002F\u002Fcloud.google.com\u002Fsdk\u002Fgcloud\u002Freference\u002Flogging\u002Fsinks)\n*   [Google Cloud Landing Zones Guide](https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Flanding-zones)\n*   [Google Cloud Security Foundations Blueprint](https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fblueprints\u002Fsecurity-foundations)\n","# Google Cloud Recipe: Foundation Builder\n\n> [!WARNING] This skill is currently in a preview state. It will deploy a secure\n> foundation, but does not have all advanced features. Users who want more\n> options should visit\n> [Google Cloud Setup](https:\u002F\u002Fdocs.cloud.google.com\u002Fdocs\u002Fenterprise\u002Fcloud-setup).\n\nThis skill guides the setup of a secure, enterprise-grade Google Cloud landing\nzone foundation. It establishes baseline security controls, organizes the\ninitial resource hierarchy, and configures centralized audit logging and\ncross-environment monitoring.\n\n## Attribution\n\n**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you\nMUST read [Usage Attribution](references\u002Fattribution.md). For commands executed\ndirectly in the terminal (never in generated scripts, Terraform, or user code),\nprefix `gcloud` with\n`CLOUDSDK_METRICS_REQUEST_ATTRIBUTION=\"agent-skills\u002F1.0 (skill:google-cloud-recipe-foundation-builder)\"`\nand append `agent-skills\u002F1.0 (skill:google-cloud-recipe-foundation-builder)` to `User-Agent` headers.\n\n## Overview\n\nThe recipe provisions the following core components at the organization root:\n\n*   **Security Guardrails**: Enforces 17 baseline Google Cloud Organization\n    Policies to secure the environment (13 Boolean, 4 List constraints).\n*   **Resource Hierarchy**: Establishes 4 folders (`Common`, `Production`,\n    `Non-Production`, `Development`) and provisions corresponding projects\n    sequentially with globally unique ID prefixes (`logging-`, `prod-`,\n    `non-prod-`, `dev-` followed by a shared suffix).\n*   **Billing & API Enablement**: Links all projects to your billing account and\n    activates critical logging\u002Fmonitoring services.\n*   **Centralized Logging & Monitoring**: Deploys a global, centralized log\n    bucket with 30-day retention, configures an organization-wide audit log\n    sink, and sets up a cross-environment metrics scope.\n\n--------------------------------------------------------------------------------\n\n## Clarifying Questions\n\nBefore executing this recipe, the agent **must** gather the following details:\n\n1.  **Organization ID**: Run `gcloud organizations list` to retrieve the\n    available organizations, present them to the user, and ask them to select\n    the target **Organization ID**.\n2.  **Billing Account ID**: Run `gcloud billing accounts list\n    --filter=open=true` to retrieve only the active (open) billing accounts,\n    present them to the user, and ask them to select the active **Billing\n    Account ID**.\n3.  **Project ID Suffix**: Ask if the user has a preferred prefix or target\n    suffix for Project IDs (default uses prefix + a shared random 8-character\n    string, e.g., `prod-ab12cd34`).\n4.  **Log Bucket Region**: Ask for the target region for resources if they want\n    to override the default `global` log bucket location.\n\n--------------------------------------------------------------------------------\n\n## Prerequisites\n\nEnsure the following prerequisites are met before beginning the deployment:\n\n*   **GCP Identity**: You must have a Google Cloud Organization resource set up.\n*   **Administrative IAM Roles**: The identity executing these commands must\n    hold the required administrative permissions. If any step fails with a\n    `Permission Denied` error, the agent will attempt to self-remediate by\n    granting the corresponding recommended role as detailed in **Phase 2: Error\n    Recovery & Lazy Role Remediation Strategy**.\n*   **Tools**: The `gcloud` CLI must be installed, authorized with the above\n    identity, and configured for use.\n\n--------------------------------------------------------------------------------\n\n## Steps to Complete the Recipe\n\n### Phase 1: Pre-flight Confirmation\n\nIdentify the target organization and obtain explicit user approval before making\nchanges.\n\n1.  **Identify and Discover Organization**: Verify the target organization. If\n    only the display name is known, list organizations to find the ID. Then,\n    retrieve the organization metadata to dynamically calculate the **Directory\n    Customer ID** and **Domain Name**:\n\n    ```bash\n    # List to find ID if needed\n    gcloud organizations list\n\n    # Describe the organization to retrieve metadata\n    gcloud organizations describe [ORGANIZATION_ID]\n    ```\n\n    *Calculate values:*\n\n    *   **Domain Name** (`[ORG_NAME]` \u002F `[YOUR_DOMAIN]`): Use the `displayName`\n        value from the output (e.g., `my-business.com`).\n    *   **Customer ID** (`[DIRECTORY_CUSTOMER_ID]`): Use the\n        `owner.directoryCustomerId` value from the output (e.g., `C01234567`).\n\n2.  **Present Blueprint Summary**: Present the exact details of the blueprint to\n    the user and request confirmation to proceed:\n\n    > **Proposed Foundation Deployment Summary for Organization: `[ORG_NAME]`\n    > (`[ORGANIZATION_ID]`)**\n    >\n    > *   **Security:** Enforce 17 baseline Organization Policies (13 Boolean, 4\n    >     List).\n    > *   **Folders:** Create 4 folders sequentially (`Common`, `Production`,\n    >     `Non-Production`, `Development`).\n    > *   **Projects:** Create 4 projects sequentially with unique IDs\n    >     (`logging-[SUFFIX]`, `prod-[SUFFIX]`, `non-prod-[SUFFIX]`,\n    >     `dev-[SUFFIX]`).\n    > *   **Billing:** Link all projects to Billing Account\n    >     `[BILLING_ACCOUNT_ID]`.\n    > *   **APIs:** Enable Logging and Monitoring APIs on the central project.\n    > *   **Centralized Logging:** Deploy a `global` log bucket\n    >     `[ORG_NAME]-logging` (30-day retention), configure an\n    >     organization-level sink\n    >     `[ORGANIZATION_ID]-logbucketsink-[RANDOM_HEX]`, and establish\n    >     cross-project metrics scopes.\n    >\n    > Do you wish to proceed with this deployment? (Yes\u002FNo)\n\n> [!IMPORTANT] **Pause execution** and wait for explicit user approval before\n> moving to Phase 2. If the user declines, abort the operation.\n\n### Phase 2: Error Recovery & Lazy Role Remediation Strategy\n\nTo ensure deployment continues smoothly on clean organizations without requiring\ncomplex upfront permission checks (which require a quota project), the agent\n**must** adopt a \"lazy recovery\" approach.\n\nInstead of testing permissions in advance, the agent will attempt to execute\neach step in the recipe. If a step fails with a `Permission Denied` error, the\nagent will attempt to self-remediate by granting the corresponding recommended\nadministrative group of roles to the deployment identity and retrying the\noperation.\n\n> [!IMPORTANT] When asked about pre-deployment readiness, prerequisites, or\n> checks to run, the agent **must** explicitly explain that the landing zone\n> deployment adopts a lazy role remediation strategy rather than upfront\n> testing, detailing all of the following in its response: 1. Confirm it will\n> execute deployment commands directly, catching any Permission Denied\n> errors. 2. Confirm it will attempt to self-remediate on failure by running the\n> exact commands `gcloud organizations add-iam-policy-binding` or `gcloud\n> billing accounts add-iam-policy-binding` to grant the entire administrative\n> group of roles to the active identity, and then retry the failed deployment\n> command. 3. List the core administrative groups that it will attempt to grant\n> (Organization Admin Group, Billing Admin Group, and Security Admin Group)\n> mapped to their key roles. 4. Confirm it will halt execution and request\n> manual administrator intervention if the self-remediation grant command fails.\n\n#### Remediation Protocol\n\nFor any command that fails due to missing permissions:\n\n1.  **Identify Required Admin Group**: Determine which administrative group is\n    responsible for the failed action. Refer to the\n    [Administrative IAM Reference](references\u002Fadmin-iam.md#core-administrative-groups--roles)\n    for details.\n2.  **Attempt Self-Remediation**: Grant **all** roles belonging to that\n    administrative group to the active authenticated account sequentially. Refer\n    to the\n    [Administrative IAM Reference Remediation Guide](references\u002Fadmin-iam.md#remediation)\n    for the copy-pasteable script commands:\n\n    *   **For Organization\u002FFolder level failures (Org Admin Group or Security\n        Admin Group)**: Run `gcloud organizations add-iam-policy-binding`\n        sequentially for each role in the group.\n    *   **For Billing level failures (Billing Admin Group)**: Run `gcloud\n        billing accounts add-iam-policy-binding` sequentially for each role in\n        the group.\n\n3.  **Halt on Remediation Failure**:\n\n    *   If the grant commands succeed, immediately retry the failed deployment\n        command.\n    *   If any of the grant commands fail (e.g., due to lack of `setIamPolicy`\n        admin rights), **halt execution** and instruct the user to ask their\n        Organization\u002FBilling Administrator to manually grant the entire\n        administrative group of roles.\n\n#### Phase-Specific Remediation Mapping\n\n*   **Phase 3: Security Guardrails (Org Policies)**:\n    *   If `gcloud org-policies set-policy` fails: Attempt to grant the entire\n        **Organization Admin Group** (9 roles) at the organization level.\n*   **Phase 4: Resource Hierarchy (Folders & Projects)**:\n    *   If `gcloud resource-manager folders create` or `gcloud projects create`\n        fails: Attempt to grant the entire **Organization Admin Group** (9\n        roles) at the organization level.\n*   **Phase 4: Billing Link**:\n    *   If `gcloud billing projects link` fails: Attempt to grant the entire\n        **Billing Admin Group** (3 roles) at the billing account level, and\n        ensure the active identity is granted the **Organization Admin Group**\n        (which contains `roles\u002Fbilling.user`) at the organization level.\n*   **Phase 5: Centralized Logging & Monitoring**:\n    *   If `gcloud logging sinks create` fails at org level: Attempt to grant\n        the entire **Logging\u002FMonitoring Admin Group** (2 roles:\n        `roles\u002Flogging.admin`, `roles\u002Fmonitoring.admin`) and the **Security\n        Admin Group** (9 roles) at the organization level.\n\n### Phase 3: Security Guardrails (Org Policies)\n\nApply 17 baseline security controls at the organization root.\n\n> [!CAUTION] Applying `iam.allowedPolicyMemberDomains` first can lock out the\n> deployment identity if it resides in an unallowed domain. Ensure the\n> deployment identity is safe before enforcing this policy.\n\n1.  Generate the YAML configuration files for the 17 policies. Refer to the\n    [Organization Policies Reference](references\u002Forg-policies.md) for the exact\n    YAML templates for both Boolean and List constraints.\n2.  Apply each organization policy sequentially using the `gcloud org-policies`\n    tool:\n\n    ```bash\n    gcloud org-policies set-policy [POLICY_FILE_NAME].yaml\n    ```\n\n### Phase 4: Resource Hierarchy\n\n#### 1. Folder Creation\n\nCheck if target folders exist to avoid duplication. The agent must check for all\n4 folders: for any folder that already exists (e.g., if `Common` or `Production`\nare already present), the agent must locate and reuse them; for any folder that\nis missing (e.g., if `Non-Production` or `Development` are not present), the\nagent must proceed to sequentially create them:\n\n> [!IMPORTANT] When explaining how existing resources (folders and projects) are\n> handled to prevent duplication, the agent **must** explicitly name the\n> remaining missing folders (`Non-Production` and `Development`) and confirm\n> that it will proceed to sequentially create only these missing folders and\n> projects.\n\n```bash\n# Check and Create \"Common\" Folder\ngcloud resource-manager folders list --organization=[ORGANIZATION_ID] --filter=\"display_name=Common\"\n# If not present:\ngcloud resource-manager folders create --display-name=\"Common\" --organization=[ORGANIZATION_ID]\n\n# Check and Create \"Production\" Folder\ngcloud resource-manager folders list --organization=[ORGANIZATION_ID] --filter=\"display_name=Production\"\n# If not present:\ngcloud resource-manager folders create --display-name=\"Production\" --organization=[ORGANIZATION_ID]\n\n# Check and Create \"Non-Production\" Folder\ngcloud resource-manager folders list --organization=[ORGANIZATION_ID] --filter=\"display_name=Non-Production\"\n# If not present:\ngcloud resource-manager folders create --display-name=\"Non-Production\" --organization=[ORGANIZATION_ID]\n\n# Check and Create \"Development\" Folder\ngcloud resource-manager folders list --organization=[ORGANIZATION_ID] --filter=\"display_name=Development\"\n# If not present:\ngcloud resource-manager folders create --display-name=\"Development\" --organization=[ORGANIZATION_ID]\n```\n\n#### 2. Project Creation and Billing Link\n\nCheck if target projects already exist in the folders by matching their display\nnames. If not present, generate a shared 8-character random suffix (e.g.,\n`ab12cd34`) and create the projects sequentially, linking billing and enabling\nAPIs immediately:\n\n```bash\n# Check if \"central-logging-monitoring\" project exists in Common folder\ngcloud projects list --filter=\"parent.id=[COMMON_FOLDER_ID] AND parent.type=folder AND name=central-logging-monitoring\"\n\n# If not present: Create, link billing, and enable APIs\ngcloud projects create logging-[SUFFIX] --name=\"central-logging-monitoring\" --folder=[COMMON_FOLDER_ID]\ngcloud billing projects link logging-[SUFFIX] --billing-account=[BILLING_ACCOUNT_ID]\ngcloud services enable compute.googleapis.com logging.googleapis.com monitoring.googleapis.com --project=logging-[SUFFIX]\n\n# Check if \"production\" project exists in Production folder\ngcloud projects list --filter=\"parent.id=[PRODUCTION_FOLDER_ID] AND parent.type=folder AND name=production\"\n\n# If not present: Create, link billing, and enable APIs\ngcloud projects create prod-[SUFFIX] --name=\"production\" --folder=[PRODUCTION_FOLDER_ID]\ngcloud billing projects link prod-[SUFFIX] --billing-account=[BILLING_ACCOUNT_ID]\ngcloud services enable compute.googleapis.com run.googleapis.com container.googleapis.com artifactregistry.googleapis.com firestore.googleapis.com pubsub.googleapis.com aiplatform.googleapis.com cloudaicompanion.googleapis.com apphub.googleapis.com designcenter.googleapis.com discoveryengine.googleapis.com iam.googleapis.com config.googleapis.com cloudbuild.googleapis.com cloudasset.googleapis.com cloudkms.googleapis.com cloudresourcemanager.googleapis.com --project=prod-[SUFFIX]\n\n# Check if \"non-production\" project exists in Non-Production folder\ngcloud projects list --filter=\"parent.id=[NON_PRODUCTION_FOLDER_ID] AND parent.type=folder AND name=non-production\"\n\n# If not present: Create, link billing, and enable APIs\ngcloud projects create non-prod-[SUFFIX] --name=\"non-production\" --folder=[NON_PRODUCTION_FOLDER_ID]\ngcloud billing projects link non-prod-[SUFFIX] --billing-account=[BILLING_ACCOUNT_ID]\ngcloud services enable compute.googleapis.com run.googleapis.com container.googleapis.com artifactregistry.googleapis.com firestore.googleapis.com pubsub.googleapis.com aiplatform.googleapis.com cloudaicompanion.googleapis.com apphub.googleapis.com designcenter.googleapis.com discoveryengine.googleapis.com iam.googleapis.com config.googleapis.com cloudbuild.googleapis.com cloudasset.googleapis.com cloudkms.googleapis.com cloudresourcemanager.googleapis.com --project=non-prod-[SUFFIX]\n\n# Check if \"development\" project exists in Development folder\ngcloud projects list --filter=\"parent.id=[DEVELOPMENT_FOLDER_ID] AND parent.type=folder AND name=development\"\n\n# If not present: Create, link billing, and enable APIs\ngcloud projects create dev-[SUFFIX] --name=\"development\" --folder=[DEVELOPMENT_FOLDER_ID]\ngcloud billing projects link dev-[SUFFIX] --billing-account=[BILLING_ACCOUNT_ID]\ngcloud services enable compute.googleapis.com run.googleapis.com container.googleapis.com artifactregistry.googleapis.com firestore.googleapis.com pubsub.googleapis.com aiplatform.googleapis.com cloudaicompanion.googleapis.com apphub.googleapis.com designcenter.googleapis.com discoveryengine.googleapis.com iam.googleapis.com config.googleapis.com cloudbuild.googleapis.com cloudasset.googleapis.com cloudkms.googleapis.com cloudresourcemanager.googleapis.com --project=dev-[SUFFIX]\n```\n\n> [!NOTE] **Agentic Parallelism Option**: While the manual runbook enforces\n> sequential project execution to avoid terminal race conditions, an AI agent\n> with multi-agent orchestration capability may optionally spawn subagents to\n> provision the 4 projects in parallel once folder IDs are resolved.\n\n### Phase 5: Centralized Logging and Monitoring\n\nConfigure centralized audit logging and cross-project monitoring scope in the\n`logging-[SUFFIX]` project.\n\nRefer to the\n[Centralized Logging and Monitoring Reference](references\u002Flogging-monitoring.md)\nfor the detailed step-by-step commands to:\n\n1.  Create the central log bucket.\n2.  Create the organization-wide log sink.\n3.  Grant required IAM permissions to the log sink.\n4.  Configure the cross-project monitoring metrics scope.\n\n--------------------------------------------------------------------------------\n\n## Validation Logic & Checklist\n\nEvaluate the deployment against the following verification checks:\n\n-   [ ] **Security Policies**: Run `gcloud org-policies list\n    --organization=[ORGANIZATION_ID]` and verify all 17 target policies are\n    enforced or correctly configured.\n-   [ ] **Resource Folders**: Verify folders `Common`, `Production`,\n    `Non-Production`, and `Development` exist under the organization root.\n-   [ ] **Billing Linkage**: Run `gcloud billing projects list` and assert that\n    all 4 newly created projects are linked to your billing account.\n-   [ ] **Log Bucket & Retention**: Verify the log bucket `[ORG_NAME]-logging`\n    exists in project `logging-[SUFFIX]`, is located in `global`, and has a\n    retention period of exactly 30 days.\n-   [ ] **Log Sink Routing**: Run `gcloud logging sinks describe` at the\n    organization level and confirm the sink routes cloud audit logs to the\n    global bucket and holds standard `writerIdentity` credentials.\n-   [ ] **Metrics Scope Linkage**: Run `gcloud beta monitoring metrics-scopes\n    describe` and assert that the `dev`, `non-prod`, and `prod` projects appear\n    in the monitored list of the central `logging` project.\n\n--------------------------------------------------------------------------------\n\n## Links\n\n*   [Google Cloud Resource Hierarchy Documentation](https:\u002F\u002Fcloud.google.com\u002Fresource-manager\u002Fdocs\u002Fcreating-managing-organization)\n*   [Google Cloud Organization Policies Overview](https:\u002F\u002Fcloud.google.com\u002Fresource-manager\u002Fdocs\u002Forganization-policy\u002Foverview)\n*   [Centralized Audit Logging Best Practices](https:\u002F\u002Fcloud.google.com\u002Farchitecture\u002Fsecurity-foundations\u002Flogging-monitoring)\n*   [Cloud Monitoring Metrics Scopes Configuration](https:\u002F\u002Fcloud.google.com\u002Fmonitoring\u002Fsettings\u002Fmultiple-projects)\n*   [Gcloud Logging Sinks CLI Reference](https:\u002F\u002Fcloud.google.com\u002Fsdk\u002Fgcloud\u002Freference\u002Flogging\u002Fsinks)\n*   [Google Cloud Landing Zones Guide](https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Flanding-zones)\n*   [Google Cloud Security Foundations Blueprint](https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fblueprints\u002Fsecurity-foundations)\n",{"name":5,"metadata":43,"description":7},{"version":44,"category":45},"1.0.1","GettingStarted","main","bb9b3f464aae37af360d079c1d863524955b0363","skills\u002Fcloud\u002Fgoogle-cloud-recipe-foundation-builder",2014,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills","https:\u002F\u002Fgithub.com\u002Fgoogle","https:\u002F\u002Fopensource.google\u002F","Google ❤️ Open Source","2026-11-14 23:31:00",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":67},[57,60,63],{"tool":58,"command":59},"npx","npx skills add google\u002Fskills --skill google-cloud-recipe-foundation-builder",{"tool":61,"command":62},"bunx","bunx skills add google\u002Fskills --skill google-cloud-recipe-foundation-builder",{"tool":64,"command":65},"pnpm","pnpm dlx skills add google\u002Fskills --skill google-cloud-recipe-foundation-builder","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fgoogle-cloud-recipe-foundation-builder\u002FSKILL.md",true,[69,75,79,83],{"path":70,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"references\u002Fadmin-iam.md","REFERENCE","参考文档",8754,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fgoogle-cloud-recipe-foundation-builder\u002Freferences\u002Fadmin-iam.md",{"path":76,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":77,"sourceHtmlUrl":78},"references\u002Fattribution.md",1954,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fgoogle-cloud-recipe-foundation-builder\u002Freferences\u002Fattribution.md",{"path":80,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":81,"sourceHtmlUrl":82},"references\u002Flogging-monitoring.md",2659,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fgoogle-cloud-recipe-foundation-builder\u002Freferences\u002Flogging-monitoring.md",{"path":84,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":85,"sourceHtmlUrl":86},"references\u002Forg-policies.md",7749,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fgoogle-cloud-recipe-foundation-builder\u002Freferences\u002Forg-policies.md",[88,123,154,183,209,233],{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":102,"publishedAt":38},"01M6998S2EZKD3GEJ7F943RZTE","sign-in-with-google-web","Implement, configure, and secure Sign In With Google (SiwG) using Google Identity Services (GIS \u002F `https:\u002F\u002Faccounts.google.com\u002Fgsi\u002Fclient`) across web architectures. Use when creating Google sign-in buttons, implementing Google One Tap with FedCM, integrating GIS in React\u002FNext.js\u002FAngular\u002FHTML, verifying ID tokens on backend runtimes (Python\u002FNode.js\u002FGo\u002FJava), enforcing Google Workspace domain restrictions (`hd`), securing client-side ID tokens via WebCrypto nonces or encrypted IndexedDB, embedding in cross-origin iframes via the Intermediate Iframe API (`https:\u002F\u002Faccounts.google.com\u002Fgsi\u002Fintermediate`), configuring Content Security Policy (CSP), COOP, and Permissions Policy (`identity-credentials-get`) headers, or handling sign-out and revocation. Don't use for legacy Google Sign-In (`gapi.auth2`), Google Cloud IAM service accounts, or Android\u002FiOS native Credential Manager.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fidentity\u002Fsign-in-with-google-web\u002FSKILL.md",[94,99],{"categoryNo":95,"categoryName":96,"taxonomyType":97,"taxonomyTypeDesc":98},"01JBSEEDCAT000000000000009","前端开发","SCENARIO","使用场景",{"categoryNo":100,"categoryName":101,"taxonomyType":97,"taxonomyTypeDesc":98},"01JBSEEDCAT000000000000010","后端与接口",[9,103,104,105,106,107,108,37,109,19,110,111,112,113,114,115,116,117,35,118,119,120,121,122],"sign in with google web","sign","with","web","android","go","google workspace","implement","policy","python","implementing","react","iam","permissions","buttons","manager","identity","architectures","domain","runtimes",{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":138,"publishedAt":38},"01M6998PHPDCAD684VW5WRG83D","dpop-adoption","Implement and debug OAuth 2.0 DPoP (RFC 9449) refresh token sender-constraining for WebCrypto, Node.js ES6, and browser runtimes integrating with Google's OAuth platform. Use when configuring non-extractable asymmetric key pairs (P-256), generating DPoP Proof JWTs for authorization code exchange and token refresh, or handling 400 use_dpop_nonce challenge retry loops at oauth2.googleapis.com\u002Ftoken. Don't use for unconstrained OAuth 2.0 flows (where refresh tokens are not bound to a client key pair), or for Google Cloud IAM \u002F service account authentication.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fidentity\u002Fdpop-adoption\u002FSKILL.md",[129,130,133],{"categoryNo":100,"categoryName":101,"taxonomyType":97,"taxonomyTypeDesc":98},{"categoryNo":131,"categoryName":132,"taxonomyType":97,"taxonomyTypeDesc":98},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":134,"categoryName":135,"taxonomyType":136,"taxonomyTypeDesc":137},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[139,140,9,19,141,142,143,144,145,146,115,147,148,149,150,151,152,119,122,153,25],"dpop adoption","adoption","es6","retry","authentication","flows","challenge","code","browser","loops","at","node","token","pair","platform",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":166,"publishedAt":38},"01M6998M72TC73EEAQH4XC7EXW","retrieving-developer-knowledge","Searches, retrieves, and synthesizes official Google developer documentation across Google Cloud, AI\u002FGemini, Android, Chrome, Web, Flutter, Go, Firebase, and other Google developer platforms. Integrates with the Developer Knowledge MCP server (search_documents, get_documents, answer_query) or the Developer Knowledge REST API fallback. Use when searching for gcloud CLI commands, API syntax, IAM permissions, official documentation, architectural comparisons, or product choice overviews. Don't use for local filesystem lookups or non-Google documentation.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Fretrieving-developer-knowledge\u002FSKILL.md",[160,161,164,165],{"categoryNo":100,"categoryName":101,"taxonomyType":97,"taxonomyTypeDesc":98},{"categoryNo":162,"categoryName":163,"taxonomyType":97,"taxonomyTypeDesc":98},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":131,"categoryName":132,"taxonomyType":97,"taxonomyTypeDesc":98},{"categoryNo":134,"categoryName":135,"taxonomyType":136,"taxonomyTypeDesc":137},[167,168,169,170,19,171,172,173,174,175,176,177,178,25,179,180,181,115,182,116],"retrieving developer knowledge","knowledge","developer","MCP","mcp server","official","developer documentation","get","search","local","choice","documents","query","api","across","documentation",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":189,"publishedAt":38},"01M6998J2CZEXS9BES9S3WWFKC","migrate-to-rust","Clones, analyzes, plans, and migrates legacy codebases (C++, Fortran, Java, Python, C, Shell) from a GitHub URL or local directory to a modern, high-performance, deterministic, 100% Safe Rust architecture, tracking live telemetry across every task bucket, test failure\u002Ffix cycle, and Profile-Guided Optimization (PGO) stage, and producing a first-person AI storytelling report and interactive HTML infographic. Use when migrating a GitHub repository or local codebase to Rust, porting legacy C++, Fortran, Python, or Java workloads to memory-safe Rust, designing Struct-of-Arrays (SoA) or SIMD Rust architectures, or optimizing Rust ports with LLVM PGO. Don't use for unrelated non-Rust refactoring or single-line syntax questions.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Fmigrate-to-rust\u002FSKILL.md",[],[190,191,192,193,194,195,196,197,112,198,199,200,201,202,203,176,204,205,206,25,207,36,181,208],"migrate to rust","rust","migrate","github","memory","performance","directory","safe","ports","llvm","soa","cycle","porting","fix","arrays","infographic","high-performance","URL","unrelated",{"skillNo":210,"name":211,"nameZh":6,"description":212,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":213,"categories":214,"keywords":218,"publishedAt":38},"01M6998GCC3K29WZ82KXMB9E02","finding-google-skills","Google platform decision and setup guidance, loaded on demand from Google's skill catalog. Use when a developer is choosing or setting up part of their stack, such as where to run a service, a database, storage, messaging, authentication, analytics, ads, or AI model serving, and a Google product is a reasonable candidate - whether or not a vendor is named - or when a request names a Google product or API. Brings in the matching Google skill so the answer can weigh Google options, their trade-offs, and when they are not the right fit. Skip when the stack is already settled on another provider and no Google product is named, or the task involves no platform choice.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Ffinding-google-skills\u002FSKILL.md",[215,216,217],{"categoryNo":100,"categoryName":101,"taxonomyType":97,"taxonomyTypeDesc":98},{"categoryNo":131,"categoryName":132,"taxonomyType":97,"taxonomyTypeDesc":98},{"categoryNo":134,"categoryName":135,"taxonomyType":136,"taxonomyTypeDesc":137},[9,219,220,221,222,153,223,224,225,226,227,143,228,30,229,177,230,231,25,232,180],"finding google skills","storage","as","messaging","model","trade-offs","provider","answer","fit","catalog","decision","use","database","candidate",{"skillNo":234,"name":235,"nameZh":6,"description":236,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":237,"categories":238,"keywords":241,"publishedAt":38},"01M6998DWNHTH0BS6W1CY8ZXMP","workload-manager-basics","Use this skill to manage Google Cloud Workload Manager evaluations, rules, scanned resources, and validation results by using public client libraries and the REST API. Use when you need to inspect workload best-practice rules, create and run evaluations for Google Cloud general best practices, SAP, SQL Server, or custom organizational rules, review violations, export results to BigQuery, or automate Workload Manager through client libraries because no service-specific public CLI or MCP server is available. Don't use for general Google Compute Engine instance management, VPC configuration, or standard IAM auditing.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fworkload-manager-basics\u002FSKILL.md",[239,240],{"categoryNo":100,"categoryName":101,"taxonomyType":97,"taxonomyTypeDesc":98},{"categoryNo":131,"categoryName":132,"taxonomyType":97,"taxonomyTypeDesc":98},[242,243,118,244,9,170,245,19,171,246,247,248,249,25,250,180,115,251,252,253,254],"workload manager basics","workload","basics","cli","review","vpc","resources","inspect","you","create","libraries","server","run"]