What's changed: Created Associate Cloud Engineer Chapter 1 (Domain 1 "Setting up the environment": resource hierarchy and IAM = org/folder/project/policy inheritance/Cloud Identity/Cloud IAM (member/role/resource, basic/predefined/custom, least privilege); managing billing, APIs, quotas = billing account and linking/budgets and alerts/billing export/enabling APIs/quotas).
1.1Resource hierarchy and IAM
Understand the Google Cloud resource hierarchy (organization, folders, projects) and policy inheritance, the project as the basic unit of billing/permissions/resources, managing users and groups with Cloud Identity, and Cloud IAM—who gets which role on which resource—with the principle of least privilege.
Associate Cloud Engineer is for practitioners who deploy, operate, and manage access on Google Cloud. The foundation of everything is governance via the resource hierarchy and Cloud IAM. First, understand "where to place what, and who is allowed to do what."
1.1.1Resource hierarchy
Google Cloud resources are organized as Organization → Folder → Project → resources. A Project is the basic unit of billing, permissions, and resources, and every resource belongs to a project. IAM policies and Organization Policies are inherited from parent to child down this hierarchy, enabling consistent governance. Folders group projects by department or environment (prod/test).
1.1.2Cloud Identity and members
Identities of people and systems are managed in Cloud Identity. You create users and groups and can federate with an external identity provider via SAML SSO and Directory Sync / GCDS. In IAM, granting to groups rather than individual users is recommended, simplifying changes when people move roles. Acting principals (members/principals) include users, groups, and service accounts used by apps and services (covered in Chapter 5).
1.1.3Cloud IAM
| Element | Meaning | Example |
|---|---|---|
| Member (principal) | Who is acting | User, group, service account |
| Role | A set of permissions | Basic / predefined / custom |
| Resource | The target (scope) | Project, bucket, VM |
Cloud IAM defines "which member gets which role on which resource" via an IAM policy (bindings). Roles include basic roles (Viewer/Editor/Owner)—too broad and discouraged in production—predefined roles curated per service, and custom roles bundling only needed permissions. The principle is least privilege—grant only the minimum. In practice: "avoid basic roles; grant predefined roles to groups."
Common: requirement → term. E.g., "basic unit of billing/permissions/resources" = Project; "inherit governance via Org→Folder→Project" = resource hierarchy/Organization Policy; "manage users/groups, federate external IdP" = Cloud Identity/SAML SSO/GCDS; "who gets which role on which resource" = IAM policy; "only the minimum" = least privilege; "avoid broad roles in prod" = predefined/custom over basic roles.
Watch the mix-ups: (1) basic roles (Viewer/Editor/Owner = broad) are discouraged in prod—use predefined/custom. (2) Grant to groups (per-user is hard to manage). (3) Policies inherit downward, and a parent grant cannot be revoked at a child (denies use separate Deny policies). (4) The project is the basic unit—every resource belongs to one.
1.1.4Section summary
- Resource hierarchy = Org → Folder → Project; the project is the basic unit; policies inherit downward
- Cloud Identity manages users/groups and federates external IdPs (SAML SSO/GCDS); grant to groups
- Cloud IAM = member × role × resource; avoid basic roles, use predefined/custom for least privilege
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. What is the basic unit that groups billing, permissions, and resources in Google Cloud?
Q2. To avoid overly broad permissions in production, which IAM role choice is most appropriate?
Q3. Which feature of the Google Cloud resource hierarchy efficiently applies consistent control org-wide?
Q4. When granting IAM permissions, which approach is recommended to ease management?
Q5. Which Google Cloud service manages users and groups and federates external IdPs via SAML SSO?
Q6. Which correctly lists the three elements of an IAM policy?