[MUSIC PLAYING]
JEEVANA HEGDE: Hi, everyone.
I'm Jeevana Hegde, a customer engineer at Google Cloud.
And welcome back to the "Technical Guide for Startups,"
where we are helping startups for technical enablement
to start, build and grow their businesses successfully
and sustainably on Google Cloud.
In our previous video, we introduced you to the series,
and now we're on to the second episode, which
is all about getting started on Google Cloud.
In this video, we are going to be covering
how to create a Google Cloud account so you get started
on the Google Cloud platform, get
a brief overview of the resource hierarchy,
understand why an organization is important
and how to create one, how to create a folder,
how to create a project, and do an entire run-through
of the Google Cloud console so we
get the fundamentals in place.
And finally, we will be going over identity and access
management for building your security fundamentals,
and wrap up with some actionable next steps.
So without any further ado, let's get on
to exploring the Google Cloud platform together.
Before jumping onto the demonstration,
there's something you need to keep in mind.
Once you create your account, you actually
need to activate it in order to use it.
And for this, you'll be required to put in your payment details.
By default, you're provided with $300 of credit.
And this is more than sufficient in case
you're just planning to experiment or practice
for a certification.
Once those credits are over, you will
have to manually upgrade to a payment tier
to continue working.
So don't worry, as you are not auto charged
once your trial expires.
But in any case, it's always good to know
that you have to deallocate, delete, and stop the resources
that you do not require.
Now let's go with the absolute fundamental step,
which is creating your Google Cloud account.
To start off, I've opened an incognito window,
which makes it convenient in case
you're working with different accounts.
And then, open up the console.cloud.google.com.
Now, we either create a new account
or we can simply sign into an existing one.
If you have it, just put in your credentials and log in.
Now, here, let's go over how to create a new one.
Click on Create account and choose
for myself or my business, but know that the steps are pretty
much the same in any case.
Fill in the details, like the name, email address,
create a new one if you have to.
And also set a strong password.
Once you're done, click on Next.
You're then asked to fill in the phone number,
and a verification code is sent to it.
So put in this code when prompted.
Once you have all of that verified,
your Google Cloud platform opens up, but with the pop up.
All you have left to do is select your country now
and agree to the terms of service.
Click on the check box and click on agree and continue.
Congratulations, now you have yourself your Google Cloud
account.
But, like I already mentioned, you now need to activate it.
So let's go ahead and do that.
This is a three-step method.
Select your country and tell us what describes
your organization the best.
I'd probably go ahead here and say startup,
and click on Continue.
And when you do, you are asked to verify the phone number
that you want to be contacted in case of any support
issues, et cetera.
And then, go to the final step.
And finally, all you have to do is confirm your account type,
fill in your business name, fill in your payment method
and your card details, et cetera,
and understand all the information in detail.
And all you have to do is click on Start my free trial.
Now that we've begun our journey by creating an account,
let's go over understanding what the resource
hierarchy on Google Cloud is.
A resource hierarchy helps us understand
how your resources are going to be organized, which
is extremely crucial when your organization is scaling out,
and is a great foundation to understanding inheritance
of access control and organization policies
for your resources.
To the bottom most of the hierarchy,
we have all our resources, which are essentially
all the products and services, like your Compute Engine
instances, machine learning APIs, databases,
and everything else.
This is where your application really stands.
Resources can only be parented by projects.
And this becomes the first coping mechanism in your Google
Cloud resource hierarchy.
You need to have at least one project
to get started with building your resources.
It is a best practice that you segregate your projects based
on your environment, such as development, test,
and production.
This way, the flow is kept clean, easy to manage,
debugged, and scaled.
Right above projects we have folders.
These folders can contain other projects, as well as folders.
This provides an additional grouping mechanism
to help keep your resources and accesses restricted
maybe department-wise, team-wise, and so on.
Maybe you wouldn't want to research team's resources
to be accessed by the other departments.
So you can keep them isolated, yet under one roof.
And that one roof is an organization.
This is the umbrella for your entire company
and acts as the root node.
It is a prerequisite for you to have an organization in order
to use folders.
Now that we have a broad understanding
of the entire resource hierarchy,
let's try and understand an organization
in a little more detail and why it's so important.
Organizations provide central visibility and control
over every resource that belongs to that organization.
The IAM access control policies applied to an organization
apply throughout the hierarchy to all the resources.
It is not required or mandatory to have an organization,
but some features of resource manager
will not be usable without one.
If you are a Google Workspace or Cloud Identity
user, when you create a Google Cloud project,
an organization is automatically provisioned.
Now without any further ado, let's jump onto the demo.
I'm doing so by creating a Cloud Identity account.
The link to this is in the description box below.
Now click on Next.
Put in your business name and select the number of employees
present in your company.
I'm picking 100 to 299 for the purpose of this demo.
And then click on Next.
Select your business location and business phone number.
Moving on, provide your current email address.
I'm just going to go ahead and type in a mock email
address here.
And then add in your business' domain name address.
Once you've added this, you're asked
to verify it and confirm, just to be sure.
Once you confirm it, the next step
is to put in the account administrator's full name.
You can change who you give this rule to even once it's created.
So know that you don't necessarily
have to be the permanent one in charge,
even though you're creating it right now.
Anyway, we are quickly moving on to the next step.
It's for you to pick a username and a very strong password
for your Cloud Identity account.
And then click on Next.
The last few steps would be for you
to choose whether or not you want
to educate your users regarding Workspace apps, new features,
et cetera.
I'm just going to say no, thank you for now and move on.
The final step is simply for you to confirm
that you're not a robot, and then click on
agree and Create Account.
Congratulations!
Now you have yourself a Cloud Identity account,
which also means you have an organization for you to get
started with.
Now that we have an organization,
we can create a folder.
So let's go ahead and try that.
Click here and you can see which organization is open.
Now click on these three dots and select Manage resources.
This takes you to where you can see a hierarchy very clearly.
But remember, you need the right access controls
in the first place to be able to view all of this,
and we'll come to that in just a bit.
Now let's create our folder.
I'm going to quickly give it a name.
Let me call demo-startups-jeevana.
So maybe all my demos are going to be
present under this folder.
And now I can browse where I want
to be creating this folder.
Let me directly say this is going
to be under the organization, and then click on Create.
Now we just wait a couple of seconds,
and when we have the refresh notification pop up here,
we simply refresh the screen.
And that's it.
We have our folder here.
Now quickly from where we left off, let's create
a project, because otherwise, you can't really
provision any resources.
Let's try to create this and see what happens.
Click on Create Project to create a new one.
As you can see, it's already given me
a name and a project ID.
The project ID needs to be a globally unique one.
And it's not necessary for the project name and ID to match,
but it's a best practice to do so,
as it's just easier to fetch in the future.
And the project ID cannot be changed once it's created.
Let me just try and type in a unique name here,
maybe technical guide demos.
So if I'll remove the demos from this,
you can see it adds a new variables automatically
for the project ID to make it globally unique.
But let's leave it at technical guide demos
and then browse the location where you
want to create this project.
Let's create this under the folder
which we had created earlier, and then click on Create.
Oh, wait a minute.
Do we see an error here?
Well, that is expected.
And that's because I don't have the right permissions yet
to be able to create this project.
You need the resource manager project's create permission
to be able to do so.
And this permission is included in the project create role.
So let's quickly head on to IAM and provision that.
We'll see IAM in a little more detail
in just a couple of minutes.
When you come here, you can already
see the permissions available for a couple of users.
Let's just try and add a new role and provision it
to myself.
Luckily, I have the permission to give myself the permission
to be able to do so.
If not, someone else would have to do it for me.
Anyway, I'm selecting project creator here and saving it.
Now you can see that I have the permission that I need,
so let's just go back and create the project.
There are a bunch of ways where you can go and land in the same
creating the new project page.
So maybe going here and clicking on your project, or going back
and doing what we did before through the Manage Resources
page.
I'm just going to go ahead and give it this name,
browse the location, and now click on Create.
This alarm bell here will give us
a notification when the project is ready and notifications
throughout.
There shouldn't be any error now, so let's just wait.
Now let me quickly refresh the page and expand the folder.
And here you go.
Your project has now been created.
It's that easy.
Now that we have a project to work with,
let's get a broad understanding of the Google Cloud platform
console.
Always important to keep in mind that you
need the required permissions to access
any resource via the console or the command line interface.
I'm selecting a project.
And your landing page is your dashboard.
The dashboard gives you an overview
of your project, some project information, resources
you probably have provisioned, monitoring details,
billing details, et cetera.
You can also customize what you see on your dashboard
by clicking on the Customize option.
Let's say I don't want the project details and monitoring
details to show up.
So I'm just going to switch the toggle buttons
and click on Done.
And as you can see, it's gone.
The next basic feature is to the top left corner here.
It opens up the navigation menu.
It has all the products and resources
that you can provision.
And for convenience, it's segregated
based on different categories, such as compute, serverless,
storage, databases, and more.
An additional feature which comes in handy
is to pin the resources that you use frequently.
You can further unpin it by clicking on the same icon.
Another feature is if you're in another product page,
all you have to do is click on Home
to get back to your dashboard.
Click on this to view the organization
name you're working in.
You have a list of recent projects
you're working on here.
You can also star a couple of important projects.
So let's see I star the other project.
And you can see them on the start tab.
To view all the projects and folders, click on all.
You can further expand or deflate them.
Now if I want to switch between two projects, all I have to do
is select the new project I want to work with,
and it's really that simple to switch.
The three dots on top here will take you
to these respective pages, and the new project,
as you've already seen, is to create a new project.
Right next to that we have the search bar,
which is an easy way to find anything on the Google Cloud
platform.
Moving back, this icon can be used to activate your Cloud
Shell terminal.
This way, you can type in your commands
instead of clicking your way through resources.
You can also click on Open editor
to get a full page terminal.
Coming back, clicking on this question mark
here will act as the help tool by guiding you
to a couple of resources.
The bell icon we discussed earlier
is to view your notifications.
You can go through the project settings
and different utilities by clicking here.
Click on the extreme right top corner
to manage the account with which you're logging in.
So you can add an account or sign out here.
For starters, this should help.
The more you work on the platform,
the more you familiarize yourself with it.
So get started without any delay.
It's important to understand three sections when
we talk about identity and access management,
or IAMs on Google Cloud.
The who, does what, and on what.
The who is essentially the identity part of the IAMs.
The who talks about whether it's a single user, multiple users
separately, or multiple users together.
Multiple users together is what is referred to as a group,
and this is what it is recommended.
The does what is the access or set of access controls
the user has on a particular set of resource or so.
For example, something like an admin role
would allow you to create, modify, delete,
add other roles, et cetera.
Whereas a viewer role for a resource
would only allow you to read from it
and not modify or delete it.
And finally, we have the on what,
which talks about which resource these obligations are put on.
So let's say a user has only been granted access
to a particular Cloud SQL database.
This does not allow the user to access anything apart
from this particular Cloud SQL database.
Here is an example to understand it as a whole.
There are a group of users who are granted the access of Cloud
SQL Viewer role, and this grants them access to the Cloud SQL.
Here are some best practices regarding IAMs.
Leverage and understand the resource hierarchy.
Use projects to group resources that
share the same trust boundary.
Check the policy granted on each resource
and make sure you understand the inheritance.
Use the principle of least privilege, which means,
don't over-provision any of the permissions
that a user does not require.
Ground rules to Google Groups rather than individuals.
This way, when new members are added,
they don't have to be permitted all of those permissions again.
They just need to simply be added to the group.
And finally, use predefined role whenever possible,
as opposed to basic roles, which gives us way too much access.
And customize roles where you need to pick
and choose from a particular set of permissions,
which can be hard to maintain.
Let's go over a very short demonstration for IAM.
Let's head to the console.
Click on IAM in admin, which has also been pinned here,
and make sure you're in IAM.
This is the IAM dashboard, where you
can see a bunch of different permissions
that have already been assigned.
I can add a new role by either editing here,
by adding a new role, or I can go ahead and click on Add here.
As I want to add it for the same member, which is myself,
I'm just going to go ahead and edit here, and add a new role.
Let's see, BigQuery viewer.
As you can see, this has come up,
which means now I can access and view the data from BigQuery.
Now I can go ahead and delete this.
And as you can see, it's gone.
What next?
A couple of resources have been added in the description box
below for you to check out for you to get
more details on these concepts.
And that brings us to the end of this video, where
we went to work creating a new Google Cloud account,
did an overview of the resource hierarchy.
We learned how to create an organization, a folder,
and a project.
We did an entire run-through of the Google Cloud console.
We understood in brief what IAM is and wrapped it up
with a quick demo for IAM.
In the next episode, you'll learn
about serverless application deployment
and be introduced to App Engine, Cloud Run, and Cloud Functions.
There'll be a section where we deep dive into Cloud Run
and look at performance and cost optimization.
We'll also run you through a sample e-commerce application
architecture so you know what a general architecture looks
like.
And wrap it up with a customer success story
as to how it's actually benefited a Google Cloud
customer.
Stay tuned for all the exciting content that we have for you.
Don't forget to like and subscribe
to our YouTube channel.
Click on the bell icon to get notified every time
a video has been posted.
And we will see you very, very soon in our next video.