1: Setting up a cloud solution environment

Learning Objectives

By the end of this chapter, you will be able to:

• Design and create a resource hierarchy of Organization, Folders, and Projects, and lay down the VPC scaffolding under it.
• Apply Organization Policy constraints and confirm product availability across regions, dual-regions, multi-regions, and global scope.
• Grant predefined and custom IAM roles at the project level, and use Cloud Asset Inventory plus Gemini Cloud Assist to inspect what was granted.
• Manage Cloud Identity users and groups manually and through Google Cloud Directory Sync, and create one or more Cloud Billing accounts.
• Enable APIs in a project and link the project to a Cloud Billing account.
• Provision Google Cloud Observability components and build billing budgets and alert policies.
• Inspect quotas, request increases, and route Cloud Billing exports to BigQuery for analysis.
• Stand up a Standalone Cloud Identity Organization for a workload that lacks a corporate domain.

Executive Summary

• The resource hierarchy is the single biggest lever for blast radius control: IAM, Organization Policy, billing, and VPC all flow from where you place a resource in the Organization, Folder, Project tree.
• Cloud Identity sits beneath the Organization and supplies the principals (users, groups, service accounts) that IAM bindings reference. Without a Cloud Identity or Workspace tenant, no Google Cloud Organization can exist.
• Cloud Billing accounts are separate from projects; one billing account funds many projects, but a project carries exactly one billing account at any moment.
• Quotas live at the project, region, and sometimes user level; they are the silent ceiling that causes deploys to fail with RESOURCE_EXHAUSTED long before cost limits do.

Assumptions

• You have administrative access to a sandbox Google Cloud Organization or Standalone tenant, the gcloud CLI installed locally, and a verified domain you control for Cloud Identity exercises.
• Service names follow current Google Cloud branding (Cloud Storage, Cloud Run, Compute Engine, Gemini Enterprise Agent Platform). Where a service kept its proper name (BigQuery, Bigtable, Spanner, AlloyDB, Dataproc, Dataflow, Looker), that name is used verbatim.
• Regions are referenced by their canonical IDs (for example us-central1, europe-west4). All examples use the fictional Organization domain acme-glide.example so commands are copy-paste safe.