GCP resource hierarchy

Overview

Scenario:

• A company size of 200 people seperated into 10 teams.
• Administer can have the company-wide policy to limit GCP account.
• Easy way to switch user to the other team.
• Single login page for user to login
• Each team wants its own access to its resources.
• Also, different environment for specific purpose.
• Sometimes, they need temporarily cooperation between teams.
• For auditing, bills should be seperated by each team.

Solution:

• Google Group to grouping user by team or functionality.
• Nesting group to organize members within the team.
• GCP folder to have hiearchy architecture.
• Set IAM role by Google Group email
• Set Organization Policy on GCP folder limit resource.
• Using seperated GCP folder for different enviroment, producion, staging… .

Organization

Nested Google Group

## IAM relationship between Google Group and Google project

<div class="mermaid">
graph LR
		A[Team A Google Group] -- Folder Admin/Owner -->AF[Team A folder]
		A1[Team A production Google Group] -- Folder Admin/Owner -->A1F[Team A production folder]
		A2[Team A production Google Group] -- Folder Admin/Owner -->A2F[Team A staging folder]
		P[playground Google Group] -- Folder Admin/Owner -->PF[Team B playground folder]
</div>

## Terraform

- [Seed project](https://femrtnz.medium.com/automating-gcp-projects-with-terraform-d571f0d94742) (Not Recommanded)

Create service account per GCP project as Terraform repo's credential.

- [one-to-one mapping between Terraform repo and GCP project](https://registry.terraform.io/providers/hashicorp/google/latest/docs)

<div class="mermaid">
graph LR;
		A[A GCP project] --> AT[A Terraform repo];
		AT[A Terraform repo] --> A[A GCP project];
		B[B GCP project] --> BT[B Terraform repo];
		BT[B Terraform repo] --> B[B GCP project];
</div>