Resource hierarchy, regions/zones and Cloud IAM — Google Cloud Platform (GCP) for .NET and Full Stack Developers

1. Resource hierarchy, regions/zones and Cloud IAM

Basic★ Must knowLesson 1 of 9

text

Organisation (company.com)
 └── Folders (Production, Non-production, Teams)
      └── Projects (shop-prod, shop-dev)   ← billing, APIs, quotas and resources live in projects
           └── Resources (Cloud Run services, Cloud SQL instances, buckets)

Region (e.g. asia-south1 Mumbai, asia-east1 Taiwan, us-central1) contains zones (asia-south1-a/b/c). Resources are zonal (VMs, disks), regional (Cloud Run, regional Cloud SQL, regional GKE) or multi-regional/global (Cloud Storage multi-region, global load balancer, BigQuery multi-region).
Cloud IAM: grant roles (collections of permissions) to principals (Google accounts, groups, service accounts, workforce/workload identity) on a resource; policies inherit down the hierarchy.
- Basic roles (Owner/Editor/Viewer) — too broad for production.
- Predefined roles (roles/run.invoker, roles/cloudsql.client, roles/storage.objectViewer) — use these.
- Custom roles when needed.
Service accounts are identities for workloads (a Cloud Run service runs as a service account); use Workload Identity Federation for GitHub Actions/AWS/Azure to avoid service account keys.

bash

gcloud projects add-iam-policy-binding shop-prod \
  --member="serviceAccount:shop-api@shop-prod.iam.gserviceaccount.com" --role="roles/cloudsql.client"