# Getting started with Vespa Cloud Enclave in GCP

[](/en/operations/enclave/gcp-getting-started.html.md "View as Markdown") 

Setting up Vespa Cloud Enclave requires:

1. Registration at [Vespa Cloud](https://console.vespa-cloud.com), or use a pre-existing tenant.
2. Running a [Terraform](https://www.terraform.io/) configuration to provision necessary GCP resources in the project.
3. Registration of the GCP project in Vespa Cloud.
4. Deployment of a Vespa application.

### 1. Vespa Cloud Tenant setup

Register at [Vespa Cloud](https://console.vespa-cloud.com) or use an existing tenant. Note that the tenant must be on a [paid plan](https://vespa.ai/pricing/).

### 2. Configure GCP Project

 **Note:** We recommend using a _dedicated_ project for your Vespa Cloud Enclave. Resources in this project will be fully managed by Vespa Cloud.

One project can host all your Vespa applications, there is no need for multiple tenants or projects.

The project you intend to use for Vespa Cloud Enclave must be prepared for deploying Vespa applications. Use [Terraform](https://www.terraform.io/) to set up the necessary resources using the [modules](https://registry.terraform.io/modules/vespa-cloud/enclave/google/latest) published by the Vespa team.

Modify the [multi-region example](https://github.com/vespa-cloud/terraform-google-enclave/blob/main/examples/multi-region/main.tf) for your deployment.

If you are unfamiliar with Terraform: It is a tool to manage resources and their configuration in various cloud providers, like AWS and GCP. Terraform has published a [GCP](https://developer.hashicorp.com/terraform/tutorials/gcp-get-started) tutorial, and we strongly encourage enclave users to read and follow the Terraform recommendations for [CI/CD](https://developer.hashicorp.com/terraform/tutorials/automation/automate-terraform).

The Terraform module we provide is regularly updated to add new required resources or extra permissions for Vespa Cloud to automate the operations of your applications. In order for your enclave applications to use the new features you must re-apply your terraform templates with the latest release. The [notification system](../notifications.html) will let you know when a new release is available.

### 3. Onboarding

Once the GCP project is configured, contact [support@vespa.ai](mailto:support@vespa.ai) stating which tenant should be on-boarded to use Vespa Cloud Enclave. Also include the [GCP Project ID](https://cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects) to associate with the tenant.

 **Note:** Wait for confirmation from the Vespa team that onboarding is complete before deploying an application in the next step.

### 4. Deploy a Vespa application

By default, all applications are deployed on resources in Vespa Cloud accounts. To deploy in your enclave account, update [deployment.xml](../../reference/applications/deployment.html) to reference the GCP project you onboarded:

```
<deployment version="1.0" cloud-account="gcp:a-project-id">
    <dev />
</deployment>
```

Useful resources are [getting started](../../basics/deploy-an-application.html) and [migrating to Vespa Cloud](../../learn/migrating-to-cloud) - put _deployment.xml_ next to _services.xml_.

## Next steps

After a successful deployment to the [dev](../environments.html#dev) environment, iterate on the configuration to implement your application on Vespa. The _dev_ environment is ideal for this, with rapid deployment cycles.

For production serving, deploy to the [prod](../environments.html#prod) environment - follow the steps in [production deployment](../production-deployment.html).

## Enclave teardown

To tear down a Vespa Cloud Enclave system, do the steps above in reverse order:

1. [Undeploy the application(s)](../deleting-applications.html)
2. [Undeploy the Terraform changes](https://developer.hashicorp.com/terraform/cli/commands/destroy)

It is important to undeploy the Vespa application(s) first. There will be a delay between when the application is deleted and all its supporting cloud resources are removed. After running the Terraform, Vespa Cloud cannot manage the resources allocated, so you must clean up these yourself.

## Troubleshooting

**Identities restricted by domain**: If your GCP organization is using [domain restriction for identities](https://cloud.google.com/resource-manager/docs/organization-policy/restricting-domains) you will need to permit Vespa.ai GCP identities to be added to your project. For Vespa Cloud the organization ID to allow identities from is: _1056130768533_, and the Google Customer ID is _C00u32w3e_.

 Copyright © 2026 - [Cookie Preferences](#)

### On this page:

- [Getting started with Vespa Cloud Enclave in GCP](#page-title)
- [1. Vespa Cloud Tenant setup](#1-vespa-cloud-tenant-setup)
- [2. Configure GCP Project](#2-configure-gcp-project)
- [3. Onboarding](#3-onboarding)
- [4. Deploy a Vespa application](#4-deploy-a-vespa-application)
- [Next steps](#next-steps)
- [Enclave teardown](#enclave-teardown)
- [Troubleshooting](#troubleshooting)