Projects in Google Cloud Platform | GCP Project Structure | GCP Training | Edureka Rewind

Key Takeaways

hello everyone this is dhruv from at Eureka and I welcome you all to this session where I will be talking about projects in Google Cloud platform so without any further Ado let's take a look at today's agenda so we will start session by first having an overview of a project in Google Cloud platform and understanding how to create and manage a project and what are the access control for a project we will then move forward to understand how to move a project in a resource hierarchy and how to migrate projects between organizations finally we will then see a demo of project governance on Google Cloud platform so first let's understand what is a project in Google Cloud platform so project in a Google Cloud platform organizes all your resources a project consists of a set of users a set of apis and billing authentication and monitoring settings for those apis like for example all of your cloud storage buckets and objects along with user permissions for accessing them reside in a project let's Now understand how to create and manage projects in Google Cloud platform before we begin keep in mind that in order to interact with Google Cloud resources you must provide the identifying project information for every request so the following are used to identify your project first as a project name which is a human readable name for your project the project name isn't used by any Google apis you can edit the project name at any time during or after project creation project names do not need to be unique now the next one is a project ID which is a customizable unique identifier for a project so you can see this in the project name my sample project is given which is the project name then the second thing is Project ID which is a customizable unique identifier for your project the project ID is a unique user assigned ID that can be used by Google apis if you do not specify a project ID during project creation a project ID is assigned automatically the project ID must be a unique string of 650 lowercase letters digits or hyphens it must start with a letter and cannot have a trailing hyphen you cannot change a project ID once it has been created cannot reuse the project ID that is in use or one that has been used for a deleted widget some words are restricted from use in Project IDs if you see restricted words in the project name such as Google or SSL the generated project ID excludes these words now the last one is a project number which is an automatically generated unique identifier for a project the project number and project ID are unique across Google Cloud if another user owns a project ID for their project you won't be able to use the same project ID you can and reuse the project ID of a deleted project as well so when you choose your project ID don't include any sensitive information in your names like you can see here the project ID is given as a my sample project 191923 and project number this is just a for example I have showed you project number that is also automatically assigned now let's get started with understanding how to create a project this permission is included in the project Creator resource manager project Creator role which is granted by default to the entire domain of a new organization and to free trial users as well if you do not specify the parent resource a parent resource is selected automatically based on the user accounts domain you can create a new project using the cloud console the Google Cloud command line tool or the project create methods as well so to create a new project to follow the easy steps like go to the manage Resource page in the Google Cloud console on the select organization drop down list at the top of the page select the organization in which you want to create a project if you are a free trial user skip this step as this list does not appear then click create project in the new project window that appears enter a project name and select billing account is applicable a project name can contain exclamation points and must be between 4 and 30 characters then enter the parent organization of folder in the location box that resource will be the hierarchical parent of the new project when you have finished entering new project details click create also you can create a project using a service account you can use a service account to automate project creation like user accounts service accounts can be granted permission to create projects within an organization and service accounts are not allowed to create projects outside of an organization and must specify parent resource when creating a project service accounts can create a new object using the gcloud tool or the projects.create method so now let's understand how to manage a project so the first step is to like manage project quotas so if you have fewer than 30 projects remaining in your quota notification displays the number of projects remaining in your quota on the new project page once you have reached your project limit to create more projects you must request a project limit increase alternatively you can schedule some projects to be deleted after 30 days on the manage resource page projects that users have a soft deleted account against your quota so these projects get fully deleted after 30 days only now the second thing is identifying projects so to interact with the Google Cloud resources you must provide the entertaining project information for your request the project is identified by its project ID and project number as I have like already explained you what is Project ID and project number and how to get them also you can like get an existing project you just have to go to the project list and choose your existing project then you can also like go for listing projects which can be done in two ways that is a list all projects under resource or search for a project for managing the project the updating of the projects can also be done like you can update projects using the cloud console or the projects.patch method currently the only fees that can be updated are the project name and labels you cannot change the project ID value that you use with the Google Cloud command line tool or API request next thing is written down or can you can say like creating the projects so you can shut down projects using the cloud console or the projects.delete method a project must have a life cycle state of active to be shut down in the way this method immediately marks a project to be deleted a notification email will be sent to user who initiated the delete operation in the technical category contracts that are listed in essential contacts project that is marked for deletion is not usable if the project has a billing account associated with it that Association is broken and isn't restrained if the project delete operation is canceled after approximated 30 days the project is fully redeleted at the end of it day period the project and all of its resources are deleted and cannot be recovered until it is deleted the project counts towards your project Twitter if you have set up billing for a project it might not be completely deleted until the current billing cycle ends and your account is successfully charged the number and types of services in use can also affect when the system permanently deletes a project if the process to shut down a project fails you can go for troubleshooting project duration in the last thing in managing a project is restoring a project project owners can restore a deleted project within a 30-day recovery period that starts when the project is shut down restoring your project returns it to the state it was in before it was shut down so some resources such as cloud storage or Pub sub resources are deleted before the 30-day period ends and may not be fully reportable to like restore project using the cloud console you just have to go to the manager sources in the Google or console and in the project picker at the top of the page select your organization below the list of organization folders and print let's click the resource of pending deletion and then check the box for the project you want to restore then click just ReStore in the dialog that appears confirm that that you want to like please do the project now that we have understood how to manage and create a project let's understand how we can provide access control for projects using intd and access management so Google Cloud offers identity and access management which lets you give more granular access to specific Google Cloud resources and prevents unwanted access to other resources so IAM lets you adopt the security principle of least privilege so you grant only the necessary access to your resources IM lets you control who has what access to which Resources by setting IAM policy which grants specific rules that contain certain permissions so the first thing in Access Control is permissions and roles so to control access to resources Google Cloud requires that accounts making API requests have appropriate IAM roles IEM rules include permissions that allow users to perform specific actions on Google Cloud resources for example the resource manager organizations list permission allows a user to list the organizations they own while resource manager projects delete allow a user to delete a project you don't directly give users permission instead you grant them roles which have one or more permissions bundled with them you get these roles on a particular resource but they also apply to all of that resources descendants in the resource array so let's understand it briefly so fastest permissions so to manage projects the caller must have a role that includes these following permission the role is granted on the organization or folder that contains the projects so you can see the method and required permissions for it you can see for create permission there is a resource projects create you can see all these same but you can see the third last one which is resource manager projects dot testimpermissions that doesn't require any permission then there are user predefined roles as well so I am predefined roles allow you to carefully manage is the set of permissions that your users have access to the following table is the predefined rows that you can use to Grant access to a project each role includes description of what the role does and the permissions included in that role so you can see the role in the name for it then also the description like you can see for role name project Creator you can see that it provides access to create new projects once a user creates a project they are automatically granted the owner rule for that project then you can see the permissions for it the specific permission for it like the source management.organizations.get to get the permissions similarly for project pay later and Project Mobile project IM admin specific permissions are there and you can see the descriptions also for it and then there are basic rules these rules are very powerful and include a large amount of permissions across all Google or services like you can see for owner editor and viewer these are like if you see in resources they are the highest roles you can see like how for owner all permissions for all resource they're given then for editor create and update access for all the sources and then with the viewer role you can like get and list access for all the sources also like you can create custom rules so in addition to the predefined roles described in the topic you also create custom roles that are collections of permissions that you tailor to your needs then the second thing in Access Control is the project level so you can like Grant roles to users at the project level using the Google Cloud console the resource manager API in the Google Cloud command line tool so there's a default rule also like when you create a project you are granted the owner roll up for the project to provide you full control as a Creator this default role can be like changed as normal in an IM policy as well then there are like VPC service controls so VPC service controls can provide like additional security when using the resource manager API so VPC service controls improves your ability to mitigate the risk of data exfiltration from Google cloud services such as cloud storage and bigquery you can can use VPC service control to create parameters that protect the resources and data of services that you explicitly specify now let's move on to understand how to move a project within the resource hierarchy so the project resource is the base level organizing entity in a Google Cloud organization projects are created in organizations and can be placed under folders organization resource itself forming the resource hierarchy you can move project resources within your resource hierarchy but should consider the policy implications of the move before you make it so when you move a project any identity and access management policies or organization policies that are directly attached will move with it however a project in your resource ID is also affected by the policies that it inherits from parent resources so if a project inherits an IIM role that provides user permissions to use a particular service users will not have access to that service at the destination unless it would inherit the permission at the destination as well so like for example consider a service account has the storage object Creator role bound to a user or a folder you can consider the folder as fold array so the service account has permissions to upload data to cloud storage in any project in folder a if you move one of these projects to folder B which does not have the same inherited permission the service account for that project loses the ability to upload data resulting in a service outage these same considerations apply if organization policies are defined at the source and destination folders like IM policies organization policies are inherited consequently you must ensure that your organization policies are consistent between source and destination folders to move a project you need the following IM rules like having the resourcemanager.projects update permission on the project which typically comes from having either the project editor or project owner rules on the project so the second permission is have the resource manager project move permission on both the source folder and the destination folder this permission is typically part of the project owner project iterator or folder admin or folder mover rules if the resource is not enough folder you will need the permission on organization node you can follow this step to move a project so in the Google Cloud console go to the manage Resource page select the organization from the organization drop down on the top left of the page third is the like click on your projects row to select your project role from the list of resources note that you must not click on the name of the project which takes you to the Project's IAM page then next you have to click on the options menu in the row and right click move then click browse to select the folder to which you want to move the project and then finally click move now that you have understood how to move a project let's Now understand how to migrate a project between organizations we will understand it quite briefly so the project resource is the base level organizing entity in a Google Organization projects are created in the organizations and can be placed under folders or the organization resource itself forming the resource hierarchy you may need to migrate projects between organize due to Acquisitions regulatory requirements and separation between business units among other things you can use the resource manager API to move projects across organizations or to another place in the resource hierarchy of its current organization the resource manager API also lets you roll back the migration moving the project back to its original place in the resource hierarchy note that it generally takes less than a minute for the project move to complete after moving a project it may take several minutes to reflect this change in the Google Cloud console so in migrating projects first we need to create a migration plan so the most important thing to consider during a project move is how the migration will impact the services running inside the project the resource manager API treats the project resource and all services running underneath it as a single unit meaning that no configuration changes will be applied inside the project while migration will not make a direct configuration changes to the project the change in the resource hierarchy is likely to have an impact on the function of the project and its running Services inherited policies such as identity and access management or organization policies will not move with the project during migration while migration will not make direct configuration changes to the project change in the resource hierarchy is likely to have an impact on the function of the project and its running services so invited policies such as intd and access management or organization policies will not move with the project during migration only policies and serve accounts that are attached directly to the resource this may cause unintended Behavior after the migration is complete so the second thing in creating a migration plan is verification of policy so when you migrate your project it will no longer inherit the policies from its current place in the resource hierarchy and will be subject to the effective policy evaluation at its destination so we recommend making sure that the effective policies at the Project's destination match as much as possible in the policies that the project had in its source location so any policy that is applied directly to the project will still be attached after the migration is complete so applying policies directly to the project is a good way to to verify that the correct policies are applied from the moment the move is complete identity and access management policies and organization policies are inherited through the resource hierarchy and can block a service from functioning if not set properly determine the effective policy at the Project's destination in your resource hierarchy to ensure the policy aligns with your governance objectives so the third thing is the manage encrypted keys so you should verify if your project has a customer managed encrypted key or other Cloud Key Management Service enabled on it cryptographic keys are owned by the project and a user with owner access to that project will therefore be able to manage and perform cryptographic operations on keys in Cloud KMS in that project ID now the next thing is the preview features so you can enable preview features on organizations folders or projects if you have enabled an alpha or beta feature on the project to be moved this feature should continue to function after the migration if the preview feature is private and not allow listed for the destination organization you you will not be able to make any configuration changes after the move is complete now the next thing is the rollback plan so if you discover that something is not working on any of the projects you have migrated you can move them back to their original location in order to do that you need to have the necessary IM permissions and set the required organization policies so that you can run the project migration in Reverse now the last thing is the dedicated Import and Export folders so policy inheritance can cause unintended effects when you are migrating a project both in the source and destination organizations you can mitigate this risk by creating specific folders to hold any projects for export and import and ensuring that the same policies are inherited by the folders in both organization you can also set permissions on these folders that will be inherited to the projects moved within them helping to accelerate the project migration process when planning a migration consider setting up a dedicated Source folder first to do this create a folder for each organization to which you plan to export projects then set an organization policy on the folders each with the constraints or resource manager allowed export destination constraint set to the single organization to which you want to export widgets after you have completed your project migration you should remove these dedicated folders as well so after creating a migration plan assign permissions as well note that when assigning permissions related to a Cross organization migration you must designate the roles on the same memory email address in both the source and the destination organizations you need the following permissions to move a project between organizations like to gain these permissions ask your administrator to Grant the suggested role at the appropriate level of the resource hierarchy so the first is Project move permission so on the project resource that you want to move and its parent resource you need the project mover role or another role that includes the following permissions are the V1 resource manager API so the permissions required for the resource you are moving are like resourcemanager.projects.update and for or permission required for the parent resource will be sourcemanager.project dot move so on the destination resource the permission you need to depend on the resource to which you are moving the project if the destination resource is a folder you need the project mover role or another role that includes the resource manager project move permission if the destination source is an organization you need the project Creator role or another role that includes the resource manager project create permission now the second thing is the organization policy permissions so on the source and destination organizations you must have the roles organization policy admin role which grants permission to create and manage organization policies now after assigning permissions you need to configure organization policies as well to move a project resource to a new organization you must first apply an organization policy that will Define the organization to which the project can be moved you must also set an organization policy in the destination that defines the organizations from which projects can be imported note that if you do not set the following organization policy since the migration will result in a field precondition error on the parent resource to the project you want to move certain organization policy that includes the constraints or like resource manager allowed import export destination constraint this will Define the target destination as a valid location to which you can migrate the project on the destination resource set an organization policy that includes the constraints like the resource manager allowed import sources constraint this will Define the source as a valid location from which you can migrate your project so on the destination resource certain organization policy that includes the constraints resource manager to allowed import Source constraint this will Define the source as a valid location from which you can migrate your project note that whether you are using dedicated Import and Export folders or not it is a good practice to remove these organization policies after you are done moving projects across organization you can enforce them again if you need to perform another project migration so the first thing while configuration organization policies is change the billing account for a project so Cloud billing account can be used across organizations moving a project from one organization to another won't impact billing and charges will continue against the old billing account however organization moves often also include a requirement to move to a new billing account to change the billing account for an existing project you must have the owner role on the project and the billing admin role on the destination billing account to change the billing account go to the billing page in the cloud console click the name of the billing account you want to change and under projects linked to those billing account find the name of the project to move and then click the menu button to the right then like Click Change billing and then select the new billing account then click set account follow the step and you can like change the billing account for a project chart is already incurred that have not yet been reported in the transition history will be billed in the former billing account this can include charges from up to two days prior to when the project was moved also you can move a billing account between organizations so a billing account can be moved from one organization to another although this isn't often a necessary step most existed organization will already have a billing account that should be used instead if you need to migrate an existing billing account get the billing admin role on the source and destination organizations then go to the billing page in the cloud console click on the name of the billing account you want to move at the top of the account management page click change organization then select the destination organization and then click OK the billing account is now associated with the specific organizations note if you move a billing account that has active Google Cloud Marketplace subscriptions those subscriptions are automatically canceled then the last step in migrating a project is perform the migration of course so if you have the appropriate IAM permissions in the required organization policies are imposed you can use the resource manager API to move a project resource so the following instructions are only for migrating a project from one organization to another like to migrate a project under an organization from the following command as you can see like gcloud beta project this one then you can also specify a folder as the target resource with the following command so where it will happen so you need to understand the project ID for that like projected is the ID or number the project you wish to migrate and then there's organization ID which is the ID of the organization to which you want to move the project you can only specify one target either an organization or a folder and then there is folder ID which is the ID of the folder to which you want to move the project you can only specify one target either a folder or an organization also you can roll back a migration so if you have mistakenly moved a project you can roll back the operation by performing the move again with the old source as the new destination and the old destination is the new source you must have the necessary IM permissions and organization policies enforced to allow this as if this were an entirely newer migration so now that you have a theoretical understanding of projects in GCB let's now see how it's been made practically by trying our hands on it on Google Cloud platform you can just directly go to Google platform console so this is how the Google Cloud platform console looks like so if you don't have an account on Google Cloud platform create one it's a very good platform to have your account on while making the account will ask for a credit and debit card details it will just deduct one rupee and that will also be refunded soon so here you can see like the project name project ID and project number is given dashboard on the dashboard looks right so you just have to go here this is from here you can choose your project like I have created number of projects you can also like go and create a new project from here this give the project name you can give it like a project test so you can see the project ID is getting created with this the name and then this number it cannot be changed later okay then you can also choose your organization if you do are using a free account you need to work with an organization then you can choose no organization also and create a billing account like this or you can just simply choose the organization I will choose it from here so I will just create it will take a few minutes one few minutes like 100 minutes here so you can see like it got created they will just select this project so now you can see like the project name my project is Project ID and project number everything is given here that's how easy it is to create a project in Google Cloud platform and from by making this project now you can like use all its services like you can see you have the access to use compute engine in kubernetes engine storage Services also database Services also application integration as well all these Services you can use once you create a project under the project you get the access to use these Services if you want to read the project you can just go to this settings go to the project settings you can see you can like choose the project name this one only we have created so we will just delete this project we just have to shut down for that you just have to type the name for it so project ID like this okay to shut down project there is it as a project ID so this is a project ID I'll just copy it okay paste it here and shut down so as I've told you like it takes at least one month to get the picture done so you can see today is like 22 July so by 21st August you'll get shut down that's how it's been shut down now you can see my project test is does not exist here anymore right so I hope you have understood how to create a project and how to delete the project in Google Cloud platform these are the concepts of Google Cloud platform projects so with this we come to the end of today's session of projects in Google Cloud platform I hope you had a great time learning and understanding about it and if you have any queries please feel free to leave them down in the comment section below until next time thank you