Learn any cloud LabsGoogle Cloud Shared VPC & Org Policies Walkthrough

Google Cloud Shared VPC & Org Policies Walkthrough

WorkspacesUnknown

Explore and validate Google Cloud Foundation Fabric Resource Manager folders, Organization Policies, and Shared VPC Host networking in a browser container workspace.

Intermediateabout 15 minutesToolsterraform

Google Cloud

Opening your lab workspace…

Steps

1
Step 1: Review Resource Manager Folders & Organization Policies
Review folders.tf and org-policies.tf. The configuration defines Platform, Corp, and Online folder hierarchies along with organizational policy constraints that enforce shielded VMs and prevent external IP exposure.
```
cat folders.tf
cat org-policies.tf
```
2
Step 2: Inspect Shared VPC Host Network & Subnets
Examine shared-vpc.tf and projects.tf to see how the Shared VPC Host project shares subnets and Cloud NAT gateways with attached service projects.
```
cat shared-vpc.tf
cat projects.tf
```
3
Step 3: Validate Cloud Foundation Fabric Terraform
Run terraform init -backend=false and terraform validate inside the terminal to verify syntax across all Foundation Fabric resource definitions.
```
terraform init -backend=false
terraform validate
```
Checked by the agent (terraform-validate): The runner checks that all Google Cloud provider blocks and folder module calls validate cleanly.

What you will learn

Review Resource Manager folder hierarchy and organization policy constraints
Examine Shared VPC Host project, subnets, and Private Service Connect configuration
Execute terraform validate to check Cloud Foundation Fabric module syntax

Before you start

Familiarity with Google Cloud project hierarchies and Shared VPC concepts
A GitHub account to authenticate with the container workspace, or local Docker

Your workspace

Opening this page starts your workspace, or resumes it where you left off. Stop and reset are in the workspace's own menu, top left inside the pane under the workspace name: Stop keeps your files for next time, and deleting the workspace resets the lab to its starting folder. Workspaces also stop by themselves after an hour of inactivity.

Only one of your workspaces runs at a time: opening a lab while another is running asks you to stop that one first. A cloud sign-in made in a workspace lasts until the workspace stops, so sign in again after it starts.

Prefer your own machine? The lab list has the Run it locally line for this lab's container image.

Resources

How labs work

Lab: A structured exercise on this site: what you will learn, what to have ready, the steps in order, and where a check can confirm your work. Each lab is listed under the provider it teaches.
Desktop: The workspace a lab opens in: VS Code in your browser, running in a container on the Hybrid Lab host with the lab’s tools installed and its folder open. You sign in with GitHub, and the workspace stops on its own after an hour of inactivity.
Agent: The job runner on the same host. It takes a file or folder you submit, runs one fixed check on it (a Terraform validate, an Ansible syntax check) in a sandbox with no network, and returns what the tool printed. Nothing you submit is executed against anything.

15-Min ScenariosBrowser TerminalZero Cloud Account Required

GitHub public identity check only (read:user scope). No repository write access.

Steps

Step 1: Review Resource Manager Folders & Organization Policies

Step 2: Inspect Shared VPC Host Network & Subnets

Step 3: Validate Cloud Foundation Fabric Terraform