How to use the Serverless N-Tier Web App Designer agent skill

What is an agent skill and what does this one make the agent do?

An agent skill is a folder of instructions and reference files that an AI agent loads when a task matches the skill. This one, named google-cloud-solution-n-tier-serverless-web-app, tells the agent to follow a fixed Google Cloud pattern for building a secure web application split into several layers.

The pattern uses Cloud Run for the serverless layers and Cloud SQL for PostgreSQL as the data layer. A public Cloud Run frontend (Tier 1) receives traffic through Cloud Load Balancing and passes requests privately to internal Cloud Run application services (Tier 2 to N). Those services are not reachable from the internet. The data tier is a private Cloud SQL for PostgreSQL database with Memorystore for Redis caching, reachable only from authorised application tiers.

The agent produces architecture reports, security checklists, and Terraform (infrastructure-as-code) and gcloud commands that follow the skill's network isolation and firewall rules. The workflow has four phases: requirements discovery, solution design and IaC drafting, implementation plan and refinement, and solution validation.

• Architecture report based on the skill's output template
• Security checklist aligned with the skill's architectural rules
• Terraform draft and gcloud commands that follow the skill's network isolation rules
• Guidance on regional deployment for data residency or European sovereignty needs

Install the skill from the ZIP download

Download the skill as a ZIP file from this page. Then choose one of the two install routes below.

Option A is a personal install for Claude Code. Unzip the file into ~/.claude/skills/ so the skill is available across your projects. Option B is a project install. Unzip it into the .claude/skills/ folder inside a specific project so only that project uses it.

Option C is for the Claude apps. Upload the ZIP under Settings → Capabilities → Skills. The source does not describe the steps in more detail, so follow what the app shows you.

• Personal (Claude Code): unzip into ~/.claude/skills/
• Single project: unzip into .claude/skills/ in the project folder
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Know what you need before you start

The skill helps you design and draft. It does not provision anything by itself. To deploy what it produces you need a Google Cloud account and a project with billing enabled, plus the gcloud CLI and/or Terraform installed. Your account needs access to the Google Cloud APIs for Cloud Run, Cloud SQL, and networking.

The skill can also use the optional Google Developer Knowledge MCP Server to look up live Google Cloud documentation. This needs an AI client that supports the Model Context Protocol (MCP). The skill's documentation gives this command to start the server:

• Google Cloud account and project with billing enabled
• gcloud CLI and/or Terraform, for deployment
• Access to Google Cloud APIs for Cloud Run, Cloud SQL and networking
• Optional: an MCP-capable client for live documentation lookups

How to trigger the skill with natural requests

You do not need special syntax. The skill's description tells the agent when to use it, so ask in plain language about the kind of work you need. Requests that match the description include asking for architecture designs, security checklists, Terraform code, or deployment guidance for multi-tier serverless apps.

The skill also covers regional data residency or European sovereignty compliance, zero-trust private VPC networking, and Private Service Connect. Be specific about your workload, your region constraints, and whether you want code or only a design. The skill's workflow says that if you explicitly say you do not want code, the agent will not generate it yet.

• Design a three-tier serverless web app on Google Cloud with a private database and no public backend
• Give me a security checklist for a Cloud Run frontend that calls private Cloud Run services
• Draft Terraform for a private multi-tier Cloud Run app in an EU region for data sovereignty
• Summarise the architecture only, no code, for a review with our security team

Read the outputs and check them

The skill asks the agent to put full Terraform code and the full solution report in the chat response, and also to write them to files. The skill's architectural rules also cover Cloud NGFW firewall policies, default egress deny, and specific Cloud SQL settings such as POSTGRES_18, Enterprise Edition, Regional HA, and psc_enabled = true. You should review each of these against your own environment.

Note that the skill's files refer to a Terraform template at assets/main.tf. That file is not in the file list supplied with this skill, so the agent may not have the template to work from. Check the output for completeness before you rely on it.

• Confirm that Cloud NGFW policies replace legacy firewall rules as the skill describes
• Confirm the Cloud SQL version, edition and HA settings suit your environment
• Have your security team review the architecture report and checklist
• Validate the Terraform and firewall rules in a non-production project before applying

Safety notes: scripts and network use

The skill does not run scripts. It does use the network. The skill's attribution rules ask the agent to tag every gcloud command, REST call, or MCP request so Google can attribute usage to the skill and its version. The tag carries no user data. The attribution file gives this prefix for gcloud commands, set inline on each command:

• Do not use gcloud config set for the tag, because it would persist beyond the current task
• The tag identifies only the skill and its version
• Generated Terraform and firewall rules must be validated before applying
• The skill mandates specific settings that may not suit every environment

Tips for better results

Give the agent your region, data residency needs, and expected traffic shape at the start. The skill's design phase depends on requirements, so a clear brief produces a more useful report.

Ask for the architecture and checklist first, then ask for the Terraform. This lets your team review the design before any code is written. The skill also supports iterative changes, so you can revise the code as the conversation continues.

• Name the number of tiers you need, since the skill supports as many layers as you specify
• Say which regions you must use if data residency applies
• Review the design before asking for code
• Keep your review with a security expert in the loop