Creating and managing organization resources

The organization resource is the root node in the Google Cloud resource hierarchy and is the hierarchical super node of projects. This page explains how to acquire and manage an organization resource.

Before you begin

Read an overview of the organization resource.

Getting an organization resource

An organization resource is available for Google Workspace and Cloud Identity customers:

• Google Workspace: Sign up for Google Workspace.
• Cloud Identity: Sign up for Cloud Identity.

Once you have created your Google Workspace or Cloud Identity account and associated it with a domain, your organization resource will be automatically created for you. The resource will be provisioned at different times depending on your account status:

• If you are new to Google Cloud and have not created a project yet, the organization resource will be created for you when you log in to the Google Cloud console and accept the terms and conditions.

• If you are an existing Google Cloud user, the organization resource will be created for you when you create a new project or billing account. Any projects you created previously will be listed under "No organization", and this is normal. The organization resource will appear and the new project you created will be linked to it automatically.

  You will need to move any projects you created under "No organization" into your new organization resource. For instructions on how to move your projects, see Migrating projects into an organization resource.

The organization resource that is created will be linked to your Google Workspace or Cloud Identity account with the project or billing account you created set as a child resource. All projects and billing accounts created under your Google Workspace or Cloud Identity domain will be children of this organization resource.

• For information about how to migrate pre-existing projects, see Migrating existing projects.

Each Google Workspace or Cloud Identity account is associated with exactly one organization resource. An organization resource is associated with exactly one domain, which is set when the organization resource is created.

When the organization resource is created, we communicate its availability to the Google Workspace or Cloud Identity super admins. These super admin accounts should be used carefully because they have a lot of control over your organization resource and all the resources underneath it. For this reason, we recommend against using Google Workspace or Cloud Identity super admin accounts for day-to-day management of your organization resource. For more information about using Google Workspace or Cloud Identity super admin accounts in Google Cloud, see Super Admin Best Practices.

To actively adopt the organization resource, the Google Workspace or Cloud Identity super admins need to assign the Organization Administrator (roles/resourcemanager.organizationAdmin) Identity and Access Management (IAM) role to a user or group. For steps on setting up your organization resource, see Setting up your organization resource.

• When the organization resource is created, all users in your domain are automatically granted Project Creator (roles/resourcemanager.projectCreator) and Billing Account Creator (roles/billing.creator) IAM roles at the organization resource level. This enables users in your domain to continue creating projects with no disruption.
• The Organization Administrator will decide when they want to start actively using the organization resource. They can then change the default permissions and enforce more restrictive policies as needed.
• If the organization resource is available and you don't have the IAM permissions to view it, you can still create projects and billing accounts. These are automatically created under the organization resource, even if you can't see it.

Getting your organization resource ID

The organization resource ID is a unique identifier for an organization resource and is automatically created when your organization resource is created. Organization resource IDs are formatted as decimal numbers, and cannot have leading zeroes.

You can get your organization resource ID using the Google Cloud console, the gcloud CLI, or the Cloud Resource Manager API.

gcloud organizations list

GET https://cloudresourcemanager.googleapis.com/v3/organizations:search{query=domain:altostrat.com}

Setting up your organization resource

If you're a Google Workspace or Cloud Identity customer, an organization resource is provided to you automatically.

The Google Workspace or Cloud Identity super administrators are the first users who can access the organization resource upon creation. All other users or groups will be able to use Google Cloud as before. They'll be able to see the organization resource, but they'll only be able to modify it after the correct permissions are set.

The Google Workspace or Cloud Identity super administrators and the Google Cloud Organization Administrator are key roles during the setup process and for lifecycle control for the organization resource. The two roles are generally assigned to different users or groups, although this depends on the organization resource's structure and needs.

Google Workspace or Cloud Identity super administrator responsibilities, in the context of Google Cloud organization resource setup are:

• Assigning the Organization Administrator role to some users
• Being a point of contact in case of recovery issues
• Controlling the lifecycle of the Google Workspace or Cloud Identity account and organization resource as explained under Deleting an organization resource

The Organization Administrator, once assigned, can assign Identity and Access Management roles to other users. The responsibilities of the Organization Administrator role are:

• Defining IAM policies and granting IAM roles to other users.
• Seeing the structure of the Resource Hierarchy

Following the principle of least privilege, this role does not include the permission to perform other actions, such as creating folders or projects. To get these permissions, an Organization Administrator must assign additional roles to their account.

Having two distinct roles ensures separation of duties between the Google Workspace or Cloud Identity super administrators and the Google Cloud Organization Administrator. This is often a requirement as the two Google products are typically managed by different departments in the customer’s organization.

To begin actively using the organization resource, follow the steps below to add an Organization Administrator:

Adding an Organization Administrator

As explained in Acquiring an organization resource, upon creation, all users in the domain are granted Project Creator and Billing Account Creator roles at the organization resource level by default. This ensures that no disruption is caused to Google Cloud users when the organization resource is created. As the Organization Administrator takes control, they might want to remove these organization-level permissions to start locking down access at a finer granularity (for instance, at the folder or project level). Note that, because IAM policies are inherited down the hierarchy, having the Project Creator role assigned to the entire domain (domain:mycompany.com) at the organization resource level implies that every user in the domain can create projects anywhere in the hierarchy.

Creating projects in your organization resource

...

project = crm.projects().create(
    body={
        'project_id': flags.projectId,
        'name': 'My New Project',
        'parent': {
            'type': 'organization',
            'id': flags.organizationId
         }
}).execute()

...

Viewing projects in an organization resource

Users can only view and list projects they have access to via IAM roles. The Organization Administrator can view and list all projects in the organization resource.

gcloud projects list --filter 'parent.id=[ORGANIZATION_ID] AND \
    parent.type=organization'

...

filter = 'parent.type:organization parent.id:%s' % flags.organizationId
projects = crm.projects().list(filter=filter).execute()

...

Deleting an organization resource

The organization resource is bound to your Google Workspace or Cloud Identity account.

If you would prefer not to use the organization resource, we recommend restoring the organization resource's IAM policy to the original state using the following steps:

1. Add your domain to the Project Creator and Billing Account Creator roles.
2. Remove all other entries in the organization resource's IAM policy.

This will allow your users to continue to create Projects and Billing Accounts while allowing the Google Workspace or Cloud Identity super admins to recover central administration later.

If you delete your Google Workspace account, it will delete your organization resource and all resources associated with it. Therefore, if you want to delete your organization resource, you can do so by deleting your Google Workspace account. For Cloud Identity users, cancel all other Google services, then delete your Google account. This is potentially a very damaging action that might be impossible to fully reverse, so it is recommended to only take this action if you are certain there are no resources in active use.