Resource Hierarchy & Governance

Concept

Resource Hierarchy & Governance is a core part of building production systems on Google Cloud. This page introduces the concepts, shows how the pieces fit together, and walks through hands-on examples using the Console, the gcloud CLI, Python client libraries, and Terraform.

Problem it solves. Teams reach for Resource Hierarchy & Governance when they need a well-understood, managed way to solve this class of problem on GCP without operating undifferentiated infrastructure themselves.

Limitations

• Service quotas and limits apply — always check current documentation
• Regional availability and launch stage vary by feature
• Cost scales with usage; model it before committing

Interactive architecture

flowchart TD
  ORG[Organization] --> F1[Folder: prod]
  ORG --> F2[Folder: non-prod]
  ORG --> SEC[Folder: security]
  F1 --> P1[Project: app-prod]
  F1 --> P2[Project: data-prod]
  F2 --> P3[Project: app-dev]
  SEC --> P4[Project: logging]
  SEC --> P5[Project: shared-vpc-host]
  classDef gcp fill:#e8f0fe,stroke:#4285f4,color:#174ea6;
  class ORG,F1,F2,SEC,P1,P2,P3,P4,P5 gcp;

flowchart TD
  ORG[Organization] --> F1[Folder: prod]
  ORG --> F2[Folder: non-prod]
  ORG --> SEC[Folder: security]
  F1 --> P1[Project: app-prod]
  F1 --> P2[Project: data-prod]
  F2 --> P3[Project: app-dev]
  SEC --> P4[Project: logging]
  SEC --> P5[Project: shared-vpc-host]
  classDef gcp fill:#e8f0fe,stroke:#4285f4,color:#174ea6;
  class ORG,F1,F2,SEC,P1,P2,P3,P4,P5 gcp;

How it works

The sections below break Resource Hierarchy & Governance down into request/event flow, authentication and authorization, the internal actions Google Cloud performs, and the failure and monitoring signals you should watch in production.

1. 1 · Request or event arrivesEntry point (load balancer, trigger, or API)

   Traffic reaches Resource Hierarchy & Governance through a defined entry point with TLS termination and, where relevant, Cloud Armor protection.

   ⚠ 429/5xx if quotas or backends are exhausted 📈 Request count, latency, and error-rate metrics 💰 Ingress is generally free; egress and requests are billed
2. 2 · AuthenticationIAM / identity layer

   The caller's identity (user, service account, or federated workload) is verified before any work is done.

   ⚠ 401/403 on invalid or missing credentials 📈 Cloud Audit Logs (Admin & Data Access)
3. 3 · AuthorizationIAM policy evaluation

   IAM checks whether the principal holds a role granting the required permission on the resource, honoring inheritance and deny policies.

   ⚠ 403 PERMISSION_DENIED 📈 Policy Analyzer, audit logs
4. 4 · Service performs the workResource Hierarchy & Governance

   The service executes the requested action, reading or writing data and emitting structured logs and traces.

   ⚠ Retryable vs non-retryable errors; watch for partial failure 📈 Structured logs, Cloud Trace spans 💰 Compute/storage/IO billed per the pricing model
5. 5 · Response / acknowledgementCaller

   A result is returned synchronously, or an acknowledgement/notification is emitted for asynchronous flows.

   📈 SLI dashboards, error budgets

Hands-on example

Cloud Console

1. Open the Cloud Console and navigate to the Resource Hierarchy & Governance section
2. Enable the required API(s) for your project
3. Create the resource with least-privilege settings
4. Verify it appears and note its identifiers

Code

# Set project context
gcloud config set project MY_PROJECT

# Enable required APIs (replace with the service's API)
gcloud services enable SERVICE.googleapis.com

# Create / describe the resource (see per-service docs for exact flags)
# gcloud <group> create NAME --region=us-central1

# Verify
# gcloud <group> describe NAME --region=us-central1

# Uses Application Default Credentials (no service-account keys).
# pip install google-cloud-<service>
from google.cloud import <service>  # replace with the concrete client

def main() -> None:
    client = <service>.Client()
    # ... call the API using the client, letting ADC handle auth ...
    print("connected")

if __name__ == "__main__":
    main()

terraform {
  required_providers {
    google = { source = "hashicorp/google", version = "~> 6.0" }
  }
}

provider "google" {
  project = var.project_id
  region  = var.region
}

# resource "google_..." "this" {
#   name     = "example"
#   # least-privilege, private-by-default configuration
# }

Troubleshooting

• 403 → check IAM roles and the caller's identity
• Connectivity failures → check VPC, firewall, and Private Google Access
• Unexpected cost → check billing exports and Recommender

Production considerations

What interviewers expect you to know

Common mistakes

• Granting overly broad IAM roles (e.g. project-level Owner/Editor)
• Using service-account keys where Workload Identity Federation would work
• Exposing services publicly when they should be private
• Choosing the wrong compute or storage primitive for the access pattern
• Retrying without backoff, or ignoring idempotency
• Ignoring quotas, dead-letter handling, and structured logging
• Leaving demo resources running and ignoring data-transfer costs
• Mixing production and development in one project

Knowledge check