Five more day-zero considerations

Speaker notes

• The account that creates a project is automatically bound to roles/owner on it, every subsequent teammate needs an explicit grant, bind roles to groups and check the binding immediately after creation, never leave a fresh project owned only by whoever ran the create command.
• Every GCP API must be explicitly enabled per project before it can be called, regardless of IAM role, a PERMISSION_DENIED error on an otherwise correctly-permissioned call is very often actually an API enablement error, check gcloud services list --enabled before touching IAM. Quotas cap resource consumption per project and region and can be checked and increased through the console; Essential Contacts routes Google's own billing/security/technical notices to a team inbox instead of one person who might leave.
• Every project gets a default Monitoring workspace and Logging bucket automatically, the real day-zero decision is whether to route telemetry into a dedicated aggregation project instead. And every new project ships with a permissive auto-mode default VPC, never build production resources against it, a deliberate custom-mode VPC replaces it, covered in the networking chapter later in this deck.

Deck map