The goal is to enable teams to deploy infrastructure independently while ensuring compliance with company practices, without requiring teams to understand the underlying details of those practices.
Option A provides deployment capability but doesn't enforce practices. The Editor role is overly broad, and using the gcloud CLI directly requires knowledge of how to configure resources compliantly.
Option B requires teams to learn all the practices, contradicting the requirement that they don't need to know the implementation details.
Option C (Organization Policies) is useful for setting constraints (e.g., disallowing public IPs, restricting regions), but it doesn't provide pre-configured, deployable components that embody best practices. Teams still need to figure out how to build compliant resources within the policy constraints.
Option D (Terraform Modules): This approach encapsulates the company's required practices within reusable infrastructure-as-code modules. Engineering teams can then use these modules as building blocks, providing only the necessary input parameters (like application name or size). The module handles the compliant implementation details internally. This allows teams to deploy independently and ensures compliance without needing deep knowledge of every practice.
Using standardized, compliant modules is a common pattern for enabling self-service infrastructure deployment while maintaining standards and governance.
References:
Terraform Modules: "Modules are containers for multiple resources that are used together... Modules allow complex resources to be abstracted away behind a clean interface." - https://developer.hashicorp.com
/terraform/language/modules
Google Cloud Architecture Framework - Security, privacy, and compliance: Recommends using IaC and pre- approved templates/modules to enforce security configurations. - https://cloud.google.com/architecture
/framework/security-privacy-compliance/define-and-enforce-security-configurations Organization Policy Service: "The Organization Policy Service gives you centralized and programmatic control over your organization's cloud resources... define constraints..." (Focuses on constraints, not providing deployable components). - https://cloud.google.com/resource-manager/docs/organization-policy/overview