4

Resource Management

In this chapter, we will look at resource management and understand some of the key components, such as projects, folders, and organizations. When building your environment on Google Cloud, these components can help you do segmentation at a macro level. We will also look at organizational policy constraints, some of the pre-built constraints that are available, and how the inheritance of policy works for Identity and Access Management (IAM) and firewall rules. We will also cover Cloud Asset Inventory, which is an essential part of resource management, and its role from a security perspective. We will end the chapter with some best practices and design considerations for resource management.

In this chapter, we will cover the following topics:

• Overview of Google Cloud Resource Manager
• The resource hierarchy
• The Organization Policy Service
• Organization Policy constraints
• Policy inheritance
• Hierarchical firewall policies
• Cloud...

Overview of Google Cloud Resource Manager

Google Cloud Resource Manager acts like a container for your cloud resources, allowing you to group your resources in a hierarchical way within the project, folder, or organization. Think of Resource Manager as a high-level way to perform macro-level segmentation. This not only helps you define the entire organization’s structure but also the implementation of security guardrails that can be inherited. More on this in the Policy inheritance section.

Figure 4.1 is an example of how you can structure your organization on Google Cloud. The top-level organization is where all your other components such as folders and projects are created. Organizing your resources in a hierarchical way lets you manage aspects such as access control and other configuration settings. The same applies to IAM policies, which can be applied at different levels and are then inherited top-down.

Figure 4.1 – Organization hierarchy...

Understanding resource hierarchy

The key components that make up the resource hierarchy are as follows:

• Organization: The top-level component—all other components are linked to this.
• Folders: Used to group similar projects to consistently apply policies. These are optional but highly recommended.
• Projects: Where all the resources, such as your compute instances, databases, and others, exist.

Now, let’s look at each of these components in detail. From a certification standpoint, you will be tested on resource hierarchy and the topics covered in this chapter. It’s important to understand how to manage and create resources and apply access policies and organizational constraints. We will cover all these topics in this chapter.

Organization

This is the root node and hierarchical super-node of the project. It is closely associated with the Workspace / Cloud Identity account. It’s a single directory containing the organization’...

Applying constraints using the Organization Policy Service

The Organization Policy Service provides you with a centralized and programmatic method to apply constraints across your organization and the respective cloud resources. We often dictate requirements that need to be applied organization-wide; these constraints are non-negotiable and every resource in your cloud environment has to adhere. This is where Organization Policy Service constraints come in, giving you the ability to centrally apply these policies to avoid or mitigate misconfigurations downstream in your projects and cloud resources. This helps you create guardrails that you can define, which can be based on regulatory requirements or internal compliance. The development teams who are consuming Google Cloud services do not have to worry about applying these policies and duplicating the effort. This further reduces the number of errors that may happen as you are now centrally in control of applying organization-wide...

Asset management using Cloud Asset Inventory

Cloud Asset Inventory plays a key role in security as it gives you the ability to view your assets in near real time and also to detect the associated changes to the asset. Previously, Cloud Asset Inventory was accessible either via the CLI or Security Command Center, but with recent changes, you can now access Cloud Asset Inventory via the Google Cloud console.

Cloud Asset Inventory is a metadata inventory service that lets you search, export, monitor, and analyze metadata related to supported Google Cloud assets. All metadata information related to an asset is presented on a timeline where you can view historical information (the past five weeks) to get insights into changes to an asset. Before we look at some use cases that Cloud Asset Inventory can help with, let’s understand some key concepts.

An asset is a Google Cloud resource or a policy object. Cloud Asset Inventory collects metadata about resources, such as for Compute...

Best practices and design considerations

Some of the design considerations are to understand how the resources will be managed inside the project. Using one project might be a good idea to keep it simple, but the isolation and separation of duties will not be achieved. On the flip side, if you use too many projects, there will be a lot of overhead to manage the projects, but you will achieve the separation of duties and the isolation required.

Some of the design considerations to follow when breaking down resources and workloads into projects are as follows. Bear in mind that all considerations are correlated:

• You don’t want a misconfiguration or a compromise in one operating environment to impact the other. A key consideration is how to reduce the blast radius.
• Quotas and limits are applied at the project level. It’s undesirable for a dev/test project to consume the quota required by a prod project, or that one app consumes the quota of another.
• You...

Summary

In this chapter, we learned how to organize our Google Cloud infrastructure and manage our available resources. We discussed the basics of creating folders and projects, as well as the features available to you if you want to enforce organizational policy constraints on them. If you’re planning on using IAM or firewall rules in your infrastructure, we also went over how policy inheritance works and how it might aid in your organizational structure. We wrapped up by reviewing Cloud Asset Inventory and some best practices for managing your resources.

In the next chapter, we will do a deep dive into Cloud Identity.

Further reading

For more information on GCP compliance, refer to the following links:

• Resource Manager how-to guides: https://packt.link/RtxyV
• Best Practices: GCP Resource Organization and Access Management (Cloud Next’19): https://packt.link/Z35Ox
• Creating and managing organization policies: https://packt.link/OegQi
• Cloud Asset Inventory how-to guides: https://packt.link/MexmV
• Understanding Cloud Asset Inventory: https://packt.link/L91Io