GCP Overview
An overview of GCP's architecture
Last updated
An overview of GCP's architecture
This page provides a high-level overview of core GCP services from a security perspective. These services are key to building comprehensive security coverage across your environment, but this list is not exhaustive.
GCP Organization
└── Folders (optional)
└── Projects(s)
└── Resource(s)Google Cloud organizes resources through a hierarchy rooted at the Organization node. A GCP Organization is provisioned when the first user from a Google Workspace or Cloud Identity domain signs up for GCP, and is tied to that identity domain. Projects can be placed directly under the Organization root or optionally organized into Folders. Folders provide logical grouping of projects and can be leveraged for Organization Policies as a preventive control, IAM bindings for access management at scale, and more. Having an Organization provides features such as:
Centralized visibility and management across all projects
Organization Policy enforcement via the Organization Policy Service
Hierarchical IAM management across folders and projects
Projects are the primary resource container in GCP, with their own API enablement, billing linkage, and IAM bindings. Because IAM bindings applied at the org or folder level automatically propagate to all projects beneath them, a single over-privileged grant higher in the hierarchy can expose the entire project tree below it. Projects remain the recommended unit of workload separation, where environments (dev/prod) and security functions (logging, auditing) are placed into dedicated projects or folder hierarchies. The Organization Admin role in GCP IAM and the Super Admin role in Cloud Identity are the highest-privilege identities in a GCP organization. The Super Admin controls the identity domain itself and can grant the Organization Admin role, making it the deeper of the two risks. A compromise of either is effectively a compromise of the entire organization. Google recommends treating Super Admin access as a break-glass procedure, using dedicated hardened accounts accessed only in emergencies, and distributing day-to-day management of specific services through scoped IAM role assignments at the folder or project level, governed by Organization Policies.
Last updated