mrvitej.in

Archive · GCP

GCP Basics: Projects, IAM and the gcloud CLI

How Google Cloud organises resources and access, with a first look at the command line.

1 min read

  • Google Cloud
  • gcloud CLI
  • Cloud IAM

Google Cloud’s hierarchy: Organization, Folders, Projects, Resources. The project is the main unit for billing, APIs and permissions (like an AWS account).

GCP AWS idea
Project Account
IAM role on a resource Policy attached to a principal
Service account IAM role / machine identity
Region such as asia-south1 (Mumbai) ap-south-1

APIs must be enabled per project before use.

curl https://sdk.cloud.google.com | bash
gcloud init
gcloud auth login
gcloud projects create demo-ci-2025 --name="Demo CI"
gcloud config set project demo-ci-2025
gcloud services enable compute.googleapis.com storage.googleapis.com
gcloud config set compute/region asia-south1

Access: grant roles to groups at the lowest scope, and prefer predefined roles (roles/storage.objectViewer) over the broad basic roles (Owner, Editor).

gcloud projects add-iam-policy-binding demo-ci-2025 \
  --member="group:devops@example.com" --role="roles/compute.viewer"

Link a billing account and create a budget alert before deploying anything. For automation, use service accounts with workload identity federation instead of downloaded JSON keys.