A company is migrating various applications to Google Cloud and wants to ensure that all new projects automatically inherit a specific set of IAM policies and resource location constraints. They also need to delegate project creation permissions to individual teams while maintaining central control over these inherited policies. How should they structure their Google Cloud environment?
- AUse a single billing account for all projects and apply policies using Cloud Deployment Manager templates.
- BImplement a custom script to apply policies after project creation and assign 'Project Editor' role to teams.
- CCreate individual projects, apply policies directly to each project, and grant 'Project Creator' role globally.
- DCreate an organization, define policies at the folder level, and grant 'Project Creator' role at the folder level.
Show answer & explanationAnswer & explanation
Correct answer: D. Create an organization, define policies at the folder level, and grant 'Project Creator' role at the folder level.
By using an organization with folders, policies can be defined at the folder level and inherited by all projects within that folder. Granting the 'Project Creator' role at the folder level allows teams to create projects that automatically adhere to the inherited policies, providing both delegation and central control.
Why the other options are wrong
- A. A single billing account doesn't directly manage policy inheritance or delegated project creation. Deployment Manager templates can apply policies but don't inherently provide the hierarchical inheritance structure for new projects.
- B. A custom script is reactive (after creation) and less robust than native hierarchical policy enforcement. 'Project Editor' is too broad if the goal is only creation.
- C. Applying policies directly to each project is manual and doesn't ensure automatic inheritance or central control.
GCP Resource Hierarchy & Policy Inheritance
Google Cloud's resource hierarchy (Organization > Folders > Projects > Resources) allows policies set at higher levels to be inherited by lower-level resources, enabling centralized control and delegated management.
- Policies flow down the hierarchy.
- Folders are key for organizing projects and applying policies.
- Organization is the root of the hierarchy.
Memory trick: Hierarchy is key: Organize with folders, then policies flow down, and creators build within.