GCP projects and Shared VPC: designing the STACKIT landing zone

What the design has to settle

Four questions come out of a Google Cloud organisation. The run raises each one as a decision, not as a default.

• Hierarchy

  Which folders and projects exist on STACKIT, and which of the source projects share one. The run lists hierarchy and project placement as open settings of every folder and project.

• Network ownership

  Who owns the subnets that other teams use. In Shared VPC the host project owns them and service projects use them; on STACKIT each project has its own networks.

• Access

  Who may use which network. On Google Cloud this is a role on the host project or on a subnet; on STACKIT it becomes role assignments and security groups.

• Region and billing

  The draft places every unit in one STACKIT region and project. A billing account link and the Google APIs enabled in a project have no counterpart in the STACKIT project resource.

Three ways to lay it out

The first row follows the mapping the run proposes; the others are choices an architect can make instead. Facts about Shared VPC come from the Google Cloud documentation, facts about STACKIT from its network documentation.

The STACKIT documentation says projects are isolated by default and that cross-project traffic needs a Network Area or public IP connectivity. The architecture page adds that a Network Area operates within a single region; the concepts page calls it a global resource that you enable per region, with traffic between regions currently over the public internet.

A Shared VPC estate and what the run wrote for it

An estate written for this page and assessed by StackToIT on 4 November 2026: a folder, a network host project, an application project, the Shared VPC link between them, one shared subnetwork and a VM in the application project. Left: the Shared VPC blocks of the input with the shared network and subnetwork. Right: the only resource blocks the run drafted; the review comments above each block are left out here.

resource "google_compute_shared_vpc_host_project" "host" {
  project = google_project.net_host.project_id
}

resource "google_compute_shared_vpc_service_project" "app" {
  host_project    = google_compute_shared_vpc_host_project.host.project
  service_project = google_project.app_team.project_id
}

resource "google_compute_network" "shared" {
  project                 = google_project.net_host.project_id
  name                    = "shared"
  auto_create_subnetworks = false
}

resource "google_compute_subnetwork" "app" {
  project       = google_project.net_host.project_id
  name          = "app"
  network       = google_compute_network.shared.id
  region        = "europe-west3"
  ip_cidr_range = "10.30.0.0/24"
}

resource "stackit_network" "app" {
  project_id       = var.project_id
  name             = "app"
  ipv4_prefix      = "10.30.0.0/24"
  ipv4_nameservers = var.default_ipv4_nameservers
}

resource "stackit_network_interface" "worker_1" {
  project_id = var.project_id
  network_id = stackit_network.app.network_id
}

resource "stackit_server" "worker" {
  project_id        = var.project_id
  name              = "worker-1"
  machine_type      = var.worker_machine_type
  availability_zone = var.availability_zone
  boot_volume = {
    source_type           = "image"
    source_id             = var.worker_image_id
    size                  = 50
    delete_on_termination = true
  }
  network_interfaces = [stackit_network_interface.worker_1.network_interface_id]
}

• Subnet and VM are drafted

  The subnetwork becomes a STACKIT network with the same range, the VM a server with its network interface.

• Folder, projects and the Shared VPC link are not

  The run writes no block for them. Each is a manual step of the plan, with the settings that decide it listed: hierarchy, project placement, project identifier, host and service project identity.

• Everything lands in one project

  The draft creates every resource in one project and region, set by variables. The run says the source sets the project from two different places and that you must decide how the projects map.

What the run decided for each unit

Ten resources were scanned and seven became migration units. The two IAM bindings (network user on the subnet, editor on the application project) are support resources the run reviews but writes nothing for; the service project link is not a unit of its own either.

Six of the seven units sit at low confidence. Each refers to a folder or project the draft does not create, and the run notes that what such a reference becomes is not assessed; the provider is also not pinned by a lock file.

Decisions the architect owns

Each item is a manual step or open setting in execution/manual/actions.md and engineering/architect-report.md.

• Project mapping

  Decide whether the source projects become one STACKIT project or several, and confirm the project the network is created in. The run asks exactly this for the subnetwork.

• Folder and project placement

  Create the folders and projects by hand or with your own Terraform; the draft contains no block for them.

• Network Area scope

  Decide which networks join an area. Ranges of networks in an area are taken from the area’s ranges, so plan the address space first.

• Access translation

  In the example the app team holds the network user role on the subnet app only, and editor on its own project. Re-create both as STACKIT role assignments; the run lists role bindings at project level as an open setting of the application project and keeps the subnet binding for review.

• Egress path

  The run could not prove how the subnet reaches the internet, because the VM has no external address and no NAT is seen. Decide the outbound design for the new network.

• Region and residency

  Confirm the one STACKIT region for the whole estate. The run maps no Google region to a STACKIT region and asks a person to confirm that the chosen region keeps the residency europe-west3 gave; zones are chosen the same way.

Questions platform teams ask

Sources

• Google Cloud: Shared VPC
• STACKIT docs: Network Area concepts
• STACKIT docs: Core networking architecture
• STACKIT docs: Resource Manager organizations and folders