Professional Cloud Security EngineerEnsuring complianceMedium
A consulting firm needs to manage client environments on Google Cloud. Each client has its own project, and the firm wants to logically group these projects by client and then by environment (e.g., 'Client A Dev', 'Client A Prod'). They also need to delegate administrative permissions efficiently so that Client A's administrators can manage all projects under 'Client A' but cannot see or modify anything related to 'Client B'. Which Resource Manager features should they leverage?
- AProjects and Service Accounts
- BFolders and IAM Policies
- COrganizations and Billing Accounts
- DLabels and Network Tags
Show answer & explanationAnswer & explanation
Correct answer: B. Folders and IAM Policies
Folders in Resource Manager provide a way to group projects hierarchically, allowing for logical organization. IAM policies can then be applied at the folder level, ensuring that permissions are inherited by all projects within that folder, enabling efficient delegation while maintaining strict separation between client environments.
Why the other options are wrong
- A. Projects are the base unit, but without folders, grouping and delegating permissions efficiently across multiple projects for a client is harder. Service Accounts are for machine identities, not hierarchical organization.
- C. Organizations are the top-level node, and Billing Accounts manage billing, neither directly addresses the granular grouping of projects *within* an organization or permission delegation at the client/environment level as effectively as folders.
- D. Labels and Network Tags are for metadata and network configuration, not for hierarchical organization or IAM delegation.
Resource Manager Folders & IAM Inheritance
Folders in Google Cloud's Resource Manager allow hierarchical grouping of projects, enabling IAM policies to be applied at a higher level and inherited by all contained resources.
- Provides logical grouping for projects.
- Facilitates centralized management of IAM policies.
- Enables delegation of administrative responsibilities efficiently.
Memory trick: Folders are like filing cabinets, and IAM is the key to each drawer.