The case
Everything in the same drawer. Test, store and accountant in the same place.
Isaac decided to move the store to Google Cloud. In one week, he created the real store, a test environment and a folder of reports for the accountant, all mixed together.
The accountant could see the store's servers. The cost of the test and the cost of production arrived on a single line. And no one could tell, by looking at a resource, who it belonged to.
This post builds on Cloud Fundamentals, Regions and Zones and Security and Shared Responsibility in the Cloud. From here on, the track's posts use Google Cloud products.
The problem
Without organization, everything gets mixed up
Creating resources is easy. The hard part is answering three questions, months later:
- Who can change what? Permissions are the same for everyone.
- How much does each part cost? The bill becomes a single list.
- What is test and what is production? A mistake in one affects the other.
The solution
The resource hierarchy
Google Cloud organizes everything into a tree of four levels:
- Organization (organization): the root, which represents the company.
- Folders (folders): group projects and other folders, by team, environment or area.
- Projects (projects): the work container. Every resource belongs to one project.
- Resources (resources): the VMs, the buckets, the databases.
The project is the central piece. It gathers the resources, the APIs enabled (each service has to be enabled in the project before it is used) and the link to billing. Every project has a name, a project ID that is unique worldwide (and never changes) and a number.
The permissions (IAM, as we saw in Security and Shared Responsibility in the Cloud) follow the tree: a permission granted on a folder applies to the projects and resources inside it. This is inheritance. Without an explicit permission, access is denied.
Don't mix them up
Project × billing account
Exams love to ask who pays and who groups.
Project
“Where do the resources and APIs live?”
- Example
- The store-prod project, with the store's VM and bucket.
- Focus
- Groups resources and sets the access boundary.
Billing account
“Who pays the expenses?”
- Example
- A company card, which pays for the store's projects and the test one.
- Focus
- Pays for one or more projects. A project without an active billing account doesn't use paid services.
Underneath
The global infrastructure
Under the hierarchy lies the physical infrastructure, with the concepts of Regions and Zones:
- Regions (regions): geographic areas, such as São Paulo (
southamerica-east1). Google Cloud has more than 40 regions. - Zones (zones): within each region, usually three or more, such as
southamerica-east1-a. A resource lives in a zone or in a region, depending on the service. - Edge locations (edge locations): hundreds of points that bring content closer to the user, as we saw in Latency.
- Private global network: traffic between Google's regions travels over Google's own fiber, not over the public internet.
Some services, such as storage and data analytics, also have multi-region locations: the data is replicated across several regions in the same area.
In practice
Three ways to use it
Console
The web interface. Good for exploring, creating resources and looking at the bill.
At the store: Isaac opens the dashboard to see the month's cost.
Cloud Shell and gcloud
A terminal in the browser, with the gcloud command-line tool already installed.
At the store: creating a VM with one command, without installing anything.
APIs
Everything the console does is also possible through an API, to automate it.
At the store: a script that creates the test environment.
How Isaac would organize the store:
| What he needs | How to solve it |
|---|---|
| Separate production and test | One project for each environment, in different folders |
| The accountant sees only the reports | Read permission only on his project, not on the organization |
| Know the cost of each environment | One project per environment, with the same billing account |
| Give access to all production projects | Grant the permission on the Production folder |
Key terms
Six terms to remember
Tap a card to see the definition.
Quick test
Three questions, exam style
01
A permission is granted to a folder. Who does it apply to?
02
In Google Cloud, which unit groups the resources, the enabled APIs and the link to billing?
03
How many zones does a Google Cloud region usually have?
For Google Cloud, almost everything starts with the project: that is where the resources, the APIs and the billing live, and the hierarchy above it decides who accesses what. With Isaac's store organized into folders and projects, the next step on the track is to get it running: Compute Engine, computing on Google Cloud.