Question

Your organization is adopting Infrastructure as Code and you must create the very first Terraform bootstrap configuration that will provision the foundational resource hierarchy (folders, shared VPC host project, and org-level policies) for a brand-new Google Cloud organization. No projects, service accounts, or remote state backends exist yet. Following Google's recommended bootstrapping approach, how should you initially execute this first Terraform run and set up ongoing automation?

Accepted Answer

Run the first apply locally using a highly privileged human identity with Organization Administrator, then have Terraform create a dedicated seed project, a bootstrap service account, and a GCS remote state bucket, and migrate state and future runs to CI/CD using that service account.

Answer

Create a seed project manually in the console and grant the Compute Engine default service account org-level Owner, then configure Terraform Cloud to run all applies as that default service account from the start.

Answer

Store the initial Terraform state on the local workstation permanently and continue running all org-level applies from an engineer's laptop to avoid the complexity of a remote backend.

Answer

Enable Config Controller first at the organization node and let it provision the seed project and hierarchy automatically, since Terraform cannot create org-level resources before any project exists.