GCP for DevOps — Multi-Project Strategy

Multi-Project Strategy

Enterprise GCP environments use multiple projects organized in a resource hierarchy. This section covers how to structure projects, folders, and shared resources for scalable DevOps operations.

Enterprise Resource Hierarchy

Enterprise GCP Hierarchy:
┌──────────────────────────────────────────────────────────┐
│  Organization: example.com                                │
│  ├── Folder: Shared Infrastructure                       │
│  │   ├── Project: shared-networking                      │
│  │   ├── Project: shared-monitoring                      │
│  │   └── Project: shared-security                        │
│  ├── Folder: Production                                  │
│  │   ├── Project: prod-web-app                           │
│  │   ├── Project: prod-api-services                      │
│  │   └── Project: prod-data-platform                     │
│  ├── Folder: Staging                                     │
│  │   ├── Project: staging-web-app                        │
│  │   └── Project: staging-api-services                   │
│  ├── Folder: Development                                 │
│  │   ├── Project: dev-team-alpha                         │
│  │   └── Project: dev-team-beta                          │
│  └── Folder: Sandbox                                     │
│      ├── Project: sandbox-alice                          │
│      └── Project: sandbox-bob                            │
└──────────────────────────────────────────────────────────┘

Create the Folder Structure

# Create top-level folders
$ gcloud resource-manager folders create \
    --display-name="Shared Infrastructure" \
    --organization=123456789012
Created folder [folders/111111111111].

$ gcloud resource-manager folders create \
    --display-name="Production" \
    --organization=123456789012
Created folder [folders/222222222222].

$ gcloud resource-manager folders create \
    --display-name="Staging" \
    --organization=123456789012
Created folder [folders/333333333333].

$ gcloud resource-manager folders create \
    --display-name="Development" \
    --organization=123456789012
Created folder [folders/444444444444].

# Create projects in folders
$ gcloud projects create shared-networking-001 \
    --folder=111111111111 \
    --name="Shared Networking"
Created project [shared-networking-001].

Shared VPC Architecture

A Shared VPC allows a host project to share its network with service projects:

Shared VPC Architecture:
┌────────────────────────────────────────────────────────┐
│  Host Project: shared-networking                        │
│  ┌─────────────────────────────────────────────────┐   │
│  │  Shared VPC                                      │   │
│  │  ├── Subnet: web (10.0.1.0/24)                  │   │
│  │  ├── Subnet: app (10.0.2.0/24)                  │   │
│  │  ├── Subnet: data (10.0.3.0/24)                 │   │
│  │  ├── Cloud NAT                                   │   │
│  │  └── Firewall rules                              │   │
│  └─────────────────────────────────────────────────┘   │
│         │                │               │              │
│  ┌──────▼────────┐ ┌────▼──────────┐ ┌─▼────────────┐ │
│  │Service Project│ │Service Project│ │Service Project│ │
│  │prod-web-app   │ │prod-api       │ │prod-data     │ │
│  │Uses: web      │ │Uses: app      │ │Uses: data    │ │
│  │subnet         │ │subnet         │ │subnet        │ │
│  └───────────────┘ └───────────────┘ └──────────────┘ │
└────────────────────────────────────────────────────────┘

# Enable Shared VPC in the host project
$ gcloud compute shared-vpc enable shared-networking-001

# Attach service projects
$ gcloud compute shared-vpc associated-projects add prod-web-app \
    --host-project=shared-networking-001

$ gcloud compute shared-vpc associated-projects add prod-api-services \
    --host-project=shared-networking-001

# List associated projects
$ gcloud compute shared-vpc list-associated-resources shared-networking-001
RESOURCE_ID          RESOURCE_TYPE
prod-web-app         PROJECT
prod-api-services    PROJECT

Organization Policies for Governance

# Restrict VM external IPs (production projects only)
$ gcloud resource-manager org-policies set-policy \
    --folder=222222222222 \
    policy.yaml

# policy.yaml
# constraint: constraints/compute.vmExternalIpAccess
# listPolicy:
#   allValues: DENY

# Restrict resource locations to specific regions
$ gcloud resource-manager org-policies set-policy \
    --organization=123456789012 \
    location-policy.yaml

# location-policy.yaml
# constraint: constraints/gcp.resourceLocations
# listPolicy:
#   allowedValues:
#     - in:us-central1-locations
#     - in:us-east1-locations

Cross-Project IAM Strategy

Role	Scope	Who
Organization Admin	Organization	Platform team leads
Folder Admin	Per folder (Prod/Staging/Dev)	Environment owners
Project Owner	Per project	Service team leads
Network Admin	Host project	Network team
Viewer	All projects	Read-only audit team
DevOps Engineer	Service projects	DevOps team members

Landing Zone with Cloud Foundation Toolkit

The Cloud Foundation Toolkit (CFT) provides Terraform modules for enterprise landing zones:

# Example: Using CFT project factory module
module "project_factory" {
  source  = "terraform-google-modules/project-factory/google"
  version = "~> 15.0"

  name                 = "prod-web-app"
  org_id               = "123456789012"
  folder_id            = "222222222222"
  billing_account      = "01ABCD-EFGH56-789012"
  default_service_account = "deprivilege"
  
  activate_apis = [
    "compute.googleapis.com",
    "container.googleapis.com",
    "monitoring.googleapis.com",
  ]

  labels = {
    environment = "production"
    team        = "web"
    cost_center = "eng-1234"
  }
}

Best Practices

Practice	Description
One service per project	Isolates blast radius and billing
Shared networking	Centralize VPC management in host project
Folder-based policies	Apply org policies at the folder level
Consistent labeling	Enforce labels via org policies
Centralized logging	Aggregate logs to a shared project
Separate billing	Per-environment or per-team billing accounts

Next → Well-Architected Framework