(T-GCPAZURE-B) Module 2 - Getting Started With Google Cloud Platform

Getting Started with Google Cloud discusses resource hierarchy and identity and access management (IAM) in Google Cloud. It notes that: - Projects are the fundamental billing and identity entities in Google Cloud. They track resource usage and enable billing, permissions, and services. - Folders group projects under an organization and can contain other folders. They are used to assign shared policies. - The organization node is the root entity that organizes all projects in Google Cloud. It compares Google Cloud's project-based billing to Azure's subscription-based billing model.

Uploaded by

nicolepetrescu

Available Formats

Download as PDF, TXT or read online on Scribd

0% found this document useful (0 votes)

80 views

(T-GCPAZURE-B) Module 2 - Getting Started With Google Cloud Platform

Uploaded by

nicolepetrescu

Available Formats

Download as PDF, TXT or read online on Scribd

You are on page 1/ 57

Getting Started with

Google Cloud
Cloud security requires collaboration
● Google is responsible Responsibility On-
premises
Infrastructure
as a Service
Platform as a
Service
Managed
services
for managing its
Content
infrastructure security. Access policies

Usage
● You are responsible Deployment

for securing your data. Web application security

Identity

● Google helps you with Operations

best practices, Access and authentication

templates, products, Network security

OS, data, and content

and solutions.
Audit logging

Network
Customer-managed
Storage and encryption

Google-managed Hardware
Resource hierarchy levels define trust boundaries
● Group your resources according Org Node Company

to your organization structure.

● Levels of the hierarchy provide Dept X Dept Y Shared
infra
trust boundaries and resource
isolation. Folders
Team A Team B

Product 1 Product 2

Test Prod
Projects
Cloud Cloud
Project Project

Resources
VMs Storage
All Google Cloud services you
use are associated with a project

● Track resource and quota usage

● Enable billing
● Manage permissions and
credentials
● Enable services and APIs
Projects have three identifying attributes

Project ID Globally unique Chosen by you Immutable

Project name Need not be unique Chosen by you Mutable

Assigned by Google
Project number Globally unique Immutable
Cloud
Folders offer flexible management
● Folders group projects under an
organization. example.com
● Folders can contain projects, other
folders, or both.
● Use folders to assign policies.
Folder A Folder B

project_1 project_2 project_3 project_4 project_5

Folders offer flexible management
● Folders group projects under an
organization. example.com
● Folders can contain projects, other
folders, or both.
● Use folders to assign policies.
Folder A Folder B

project_1 project_2 project_3 project_4 project_5

The organization node organizes projects

The organization node is

the root node for Google
Cloud resources.
[email protected] example.com
Organization Admin

Create

[email protected] project_1 project_2

Project Creator
The organization node organizes projects

Notable organization
roles:

[email protected] example.com
Organization Policy
Organization Admin
Administrator: Broad
control over all cloud
resources
Create
Project Creator:
Fine-grained control of
[email protected] project_1 project_2 project creation
Project Creator
An example IAM resource hierarchy
● A policy is set on a resource.

Organization
○ Each policy contains a set example.com
of roles and role members.
● Resources inherit policies

Policy Inheritance
Project
from parent.
bookshelf bookshelf bookshelf
○ Resource policies are a
union of parent and
resource.
Compute App Cloud Cloud Cloud
● A less restrictive parent

Resources
BigQuery
Engine Engine Storage Storage Pub/Sub

policy overrides a more

restrictive resource policy.
instance_a queue_a bucket_a bucket_b topic_a dataset_a
Google Cloud and Azure billing have different levels of
flexibility
Google Cloud billing by project Azure billing by subscription
contract contract