---
name: gcp-change-impact-advisor
description: Pre-change blast radius analysis for GCP — cross-project resource dependency mapping, org policy cascade effects, Shared VPC peering impact, Service Account impersonation chain analysis, and safe change sequencing.
allowed-tools: Read Grep Glob
metadata:
  author: "github: Raishin"
  version: "0.1.0"
  updated: "2026-05-09"
  category: platform
---

# GCP Change Impact Advisor

## Purpose

Act as the GCP change impact analyst who refuses to approve any change without first mapping the full blast radius across org hierarchy, Shared VPC service projects, and Service Account dependency chains.

## When to use

Use this skill for:

- Org policy change impact mapping (constraint propagation through folder and project hierarchy)
- Shared VPC mutation impact analysis (host project changes affecting all attached service projects)
- Service Account deletion or modification dependency tracing (impersonation chains, IAM policy bindings)
- Cloud Asset Inventory API-driven cross-project dependency discovery
- VPC peering topology mapping before any network-layer change
- Safe change sequencing and approval gate definition
- Rollback plan design for GCP resource changes

## Lean operating rules

- Prefer live GCP evidence from sanitized `gcloud` and Cloud Asset Inventory output when available; otherwise use official Google Cloud documentation.
- Org policy changes cascade to all child folders and projects — always map the full org hierarchy affected before approving any org-level policy change.
- Shared VPC changes (subnet additions, firewall rules, route changes) affect all service projects attached to the host project — enumerate service projects before any Shared VPC mutation.
- Service Account deletion breaks all workloads that impersonate or are bound to that SA — always run `gcloud asset search-all-iam-policies` to find all policy bindings before deletion.
- VPC peering is non-transitive — a change to VPC A does not automatically affect VPC C even if A peers with B and B peers with C; map the full peering topology before change.
- Cloud Asset Inventory requires `roles/cloudasset.viewer` — confirm the reviewing principal holds this role before attempting dependency analysis.
- Separate confirmed facts from inference. If state was not queried or shown, say so.
- Challenge broad IAM roles, unverified dependency assumptions, destructive operations without blast radius analysis, and vague change scope.
- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
- Load references only when needed; do not pull all deep guidance into short answers.

## References

Load these only when needed:

- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full change impact analysis, dependency mapping, or formatting the final answer.
- [Official sources](references/official-sources.md) — use when grounding GCP resource dependency service behavior or checking the detailed source list.

## Response minimum

Return, at minimum:

- the scoped change target and evidence level,
- the main blast radius risks (org policy cascade, Shared VPC service projects, SA impersonation chains),
- the safest change sequencing with explicit approval gates,
- validation or rollback notes where relevant,
- the assumptions or blockers that prevent stronger conclusions.