Projects, IAM, and Resource Hierarchy

Every resource in GCP belongs to a project, and every project exists within a resource hierarchy. Understanding this hierarchy and how Identity and Access Management (IAM) works is fundamental to securing and organising your cloud environment.

---

The Resource Hierarchy

GCP organises resources in a four-level hierarchy:

Organisation (example.com)
  |
  |-- Folder: Engineering
  |     |-- Project: web-app-prod
  |     |-- Project: web-app-dev
  |
  |-- Folder: Finance
  |     |-- Project: billing-system
  |
  |-- Project: shared-networking

Levels

Level	Description
Organisation	The root node, tied to a Google Workspace or Cloud Identity domain
Folders	Optional grouping mechanism for projects (can be nested)
Projects	The core organisational unit — all resources belong to a project
Resources	The actual GCP resources (VMs, buckets, databases, etc.)

Projects

A project is the fundamental unit in GCP: