Project Factory

Automated project/account creation — Azure · AWS · GCP

Concept

A Project Factory automates the creation of new projects/accounts/subscriptions with standardized guardrails, networking, IAM, and billing — ensuring every new workload starts compliant.

Automation
Azure Blueprints / Terraform
AWS Control Tower / Account Factory
GCP Project Factory (Terraform-based) / Cloud Foundation Toolkit
Default Guardrails
Azure Policy assignments
SCP + Guardrails (preventive/detective)
Org Policy constraints + IAM Deny
Networking Setup
VNet + Hub-Spoke template
AWS Control Tower VPC template
Shared VPC + subnet allocation
IAM Default
Reader + Contributor default
Admin + ReadOnly default roles
Custom baseline roles
Billing
Links to existing subscription billing
Consolidated billing via Org
Links to billing account

Terraform Project Factory (GCP)

module "project_factory" {
  source  = "terraform-google-modules/project-factory/google"
  version = "~> 15.0"

  name              = "my-new-project"
  random_project_id = true
  org_id            = "ORG_ID"
  folder_id         = "FOLDER_ID"
  billing_account   = "BILLING_ID"

  activate_apis = [
    "compute.googleapis.com",
    "container.googleapis.com",
    "cloudbuild.googleapis.com"
  ]

  labels = { environment = "dev", team = "platform" }
}

○ Azure — Azure Blueprints

Blueprint: Package of Role Assignments + Policy Assignments + Resource Group template. Assign to subscription for standardized setup.

CLI:
az blueprint assignment create --name dev-blueprint --blueprint-version v1

○ AWS — AWS Control Tower

Account Factory: Provision new accounts with pre-configured VPC, guardrails, and SSO. Uses AWS Service Catalog behind the scenes.

Terraform:
aws_organizations_account resource

○ GCP — GCP Cloud Foundation Toolkit

CFT Modules: project-factory, vpc, gke, iam modules. Designed for enterprise multi-project setups with consistent guardrails.