MARK MIRCHANDANI: With almost 500 sessions at Next 2019,
it's understandable that you couldn't get to them all.
So if you didn't see best practices, GCP resource
organization, and access management,
then stay tuned, because here's the rewind.
[MUSIC PLAYING]
Regardless if you're new to Google Cloud
Platform or a longtime user, it's
important to keep all your GCP resources organized.
We don't just mean resources like VMs,
but actually at the project and organization level.
In this talk, Max and Greg go over
what these different resources are and best practices
for organizing them.
It's important to consider the setup since almost a third
of billing support cases that we handle end up being
resource management related.
If you're not sure how your resources are configured,
you may find yourself dealing with confusing invoices, access
issues, or even potential disruption of service.
The best way to avoid these issues is
to make sure everything is set up to match your needs.
Let's take a look at the resource hierarchy.
Here's an overview of the different resources.
We'll step into each area and talk about different things
to consider.
Your domain and organization are like an umbrella
for everything in the cloud.
The domain is done through G Suite or Cloud Identity,
and helps you manage users.
Organizations let you manage all of the GCP resources
through the console.
Together, these make sure you have a way to manage everything
from a high level, especially helpful for situations
when someone may have lost access to a low level
resource like a project.
You'll have a super admin for the domain
and an organizational admin for your organization, which
could be the same person.
Make sure to consider who should be the admin in each case,
such as the org admin being a more
senior technical member in charge of all the cloud
projects.
It's also key to make sure everyone knows
who the admins for these are and to keep all the rolls up
to date.
Try to aim for a reasonable level of redundancy
to avoid any single points of failure.
Billing accounts are under the organization and control
how you pay for anything the associated projects use.
They have their own set of roles and permissions,
such as the billing account users,
who can see how much each project is spending and link
projects to a billing account.
Only a billing account admin can remove projects
from the billing account and set budgets.
Again, it's important to know who your billing admin is,
because they're needed if you ever want
to contact billing support.
In most cases, you'll only need one billing account
per organization, which will also
help keep things simple when looking at what
you're paying per project.
Don't forget to enable BigQuery Export as soon as possible,
so you can further analyze what you're paying for.
Now, the payments profile actually sits outside the cloud
and is used for paying anything in Google, such as Chrome
licenses.
You may want to have the same admin for both your payments
profile and your billing account.
But you can customize who has access to edit information
or only have read only access.
Just like your billing account, we typically recommend only
having one payment profile.
Making sure the right people have access
and getting notifications can go a long way
in avoiding any fire drills.
You should also add a secondary payment method
and review the roles here on a regular basis
to avoid any potential problems.
Anything done in GCP will be done
from a project, which are basically
like groupings of direct cloud resources,
such as Kubernetes clusters.
These projects can exist under folders as well as be labeled,
so you have full customization over your hierarchy.
In fact, we recommend trying to match
your company's environment.
So maybe you'd have a folder for each team
or different folders for dev and prod.
You should use naming conventions
that are familiar to your team for projects and labels,
so everyone knows what each project is for.
Labels can help group those together.
Each project also has its own role management,
so you can ensure only trusted people can
edit resources inside of a project
or even create new projects.
This is a quick overview of the resource hierarchy,
but there's plenty more specifics and best practices
to check out, which you can read through in the guide
and checklist linked here.
Max and Greg go into a deeper dive for each area
during the talk, cover more best practices,
and walk through an example of what
a company might consider for their resources as they grow.
If you'd like to see the full talk,
check out the link in the description below.
And don't forget to subscribe to the Cloud YouTube channel
for more great "Next Rewind" content.
Thanks for watching.
[MUSIC PLAYING]