Identity and Access Management (IAM) policies are designed to flow down this hierarchy. A role granted at the organization level applies to every folder and project within it. The effective policy for a resource combines all permissions granted directly to it and all permissions inherited from its parent resources. This allows for centralized control but also requires careful design to follow the principle of least privilege, granting roles at the lowest possible level.
Best practices for designing this hierarchy include using a single organization node to maintain central visibility. Creating separate "bootstrap" folders for management tools can isolate them from workloads. Standardized naming conventions across all resources also help maintain order and simplify management.
Administrative Isolation and Resource Grouping
The Organization Root
The Organization is the root node of the hierarchy, created by linking a domain through Cloud Identity or Google Workspace. It provides centralized visibility and control over all resources, making it the foundation for company-wide management.
Folders and Projects
Folders and Projects are the main tools for grouping and isolating resources. Folders are an optional layer that can contain other folders or projects, ideal for separating business units or environments like Production and Development. Projects are mandatory containers where service resources, such as virtual machines, are actually created and run.
Policy Inheritance
A core security feature is Policy Inheritance. Security rules, including IAM allow policies and Organization policies, applied at a higher level automatically apply to all child resources. This means a single rule set at a folder protects all projects inside it. Deny policies can be used at lower levels to create specific exceptions to inherited permissions.
Isolation Strategies
Designing for Administrative Isolation means using folders to create logical boundaries. For instance, separate folders for different teams or environments allow you to grant specific administrative roles without giving access to everything else. This strategy supports autonomy for distinct business units while maintaining overall governance.
Billing Management
Billing is managed by linking projects to Cloud Billing accounts. While billing is assigned per project, the resource hierarchy itself doesn't enforce this link. Using Labels (key-value pairs) on resources allows for granular cost tracking across different departments, ensuring billing responsibilities are clear even when projects are grouped for administrative purposes.
StudyCerts
StudyCerts