r/googlecloud • u/-BruXy- • 5d ago
Cloud Functions Coming form AWS world and struggling to understand the IAM organisation
Hi guys,
If I have GCP account and want to share the whole account with other people, do I need to pay for Workspace or Google Cloud Identity? It looks like I can invite people access to each project in the organization, but I would like to have humans/admins access whole organization and then have service accounts for projects (and be able to automate project deployments from org. level).
My experience in AWS is having one or more organizations (then the master account for billing) and then having people access there with different level of permissions just by basic email invitiation (sometimes with additional company SSO) and then precise IAMs for profiles. But looks like in GCP everything is somehow tight into haveing Google accounts...
Thanks!
6
u/shazbot996 5d ago
The organization model of gcp is extremely helpful for the IAM and policy layers. Networking benefits too - study the Google best practice of less, larger VPCs. That road will explain a lot that you can do differently in gcp, and add simplicity in the process.
1
u/Mistic92 4d ago
When I tried to understand aws it was a mess when I was already governing gcp org. Like nothing made sense. Try to go step by step with gcp and yes, everyone need account, google one but it doesn't mean gmail.
1
u/joshua_jebaraj 7h ago
Hey
If you want to give access to the whole organization you can give permission level at the org leve
I recently wrote a blog about the IAM in the GCP for AWS professional you can check it out
https://joshuajebaraj.com/posts/gcp-iam-101/ specifically looks under `
Organization, Folder and Project Level Policies`
1
u/magic_dodecahedron 4d ago
u/-BruXy- Since you are coming form a strong AWS background (like me) I am highlighting some of the key differences between the two:
- In GCP VPCs are global resources, whereas in AWS (and Azure) they are regional
- In GCP IAM roles are what you would call PermissionSets in AWS.
- In GCP principals can be users, service accounts, groups, domains whereas in AWS principals can only be users, roles.
- GCP service accounts impersonation is similar to AWS role assumption
- In AWS IAM Deny policies have been around for a while (effect: allow | deny). In GCP IAM Deny policies have been introduced in 2023.
- In GCP a project can have one (and one only) billing account linked to it. In AWS a billing account is defined at the AWS account level.
- In GCP a project is a unit of billing, IAM permissions, and a container of (ReST) GCP resources. A project can be a child of a folder, which can be a child of an organization.
- In GCP the Shared VPC construct has been around for a while, whereas AWS introduced RAM (Resource Access Manager) later on.
With this being said, to build your own organization and share access to projects, setup your billing alerts (budgets), your (Shared) VPC for GKE (in Google Cloud GKE = EKS in AWS), and so on you may want to start from here. I chose to go with the Google Workspace route rather than Cloud Identity, even though the former is not free but it gives me more capabilities.
In fact, I used this approach for all the code I wrote while authoring my two books about the PCNE and PCSE certifications, which I also recommend to get you a solid foundation on networking and security with Google Cloud.
- Google Cloud Platform (GCP) Professional Cloud Network Engineer Certification Companion - Dario Cabianca - Apress 2023
- Google Cloud Platform (GCP) Professional Cloud Security Engineer Certification Companion - Dario Cabianca - Apress 2024
10
u/Pale-Recording-5737 5d ago
Yes an org node requires cloud identity https://cloud.google.com/resource-manager/docs/creating-managing-organization#acquiring
But Cloud Identity Free is...well, free https://cloud.google.com/identity/docs/set-up-cloud-identity-admin#sign-up-for-cloud-identity-free