Google Cloud Getting Started: Projects, IAM, and the gcloud CLI
Introduction
In Google Cloud, almost everything starts with a project: it is the unit that owns resources, billing, and permissions. This lesson explains projects and IAM roles, installs the gcloud command-line tool, and walks through creating a project, enabling an API, and configuring your terminal.
Prerequisites
- A Google account
- The cost management lesson recommended
Step-by-Step Guide
Step 1: Understand the resource hierarchy
Resources belong to projects. Projects can sit inside folders, and folders and projects belong to an organization if you have one. A project has a human-friendly name, a globally unique project ID that you use in commands and cannot change, and a numeric project number. Billing is linked to a project through a billing account, and most services need billing enabled to work.
Step 2: Create a project and set a budget
In the console, create a new project and note its project ID. Link a billing account, then open Billing and create a budget with email alerts at several thresholds before you create any resources. Free trial credits and free-tier terms change, so read the current terms for your account.
Step 3: Install gcloud and initialize it
Install the Google Cloud CLI from Google's documentation. gcloud init walks you through signing in and choosing or creating a project and default region. gcloud auth login signs in again later, and gcloud auth application-default login creates credentials that local code and client libraries use.
gcloud --version
gcloud init
gcloud auth login
gcloud auth application-default login # for local code using client librariesStep 4: Select your project and enable an API
Set the active project so commands apply to it, and check the configuration. Each Google Cloud service must be enabled in a project before you can use it, and you do that by enabling its API.
gcloud projects list
gcloud config set project YOUR_PROJECT_ID
gcloud config list
gcloud services enable storage.googleapis.comStep 5: Understand IAM roles
Access is granted by assigning a role to a principal, such as a user or service account, on a resource. Basic roles such as Owner, Editor, and Viewer are very broad. Prefer predefined roles for a specific service, such as Storage Object Admin, or custom roles, so identities have only the access they need. Do not share your personal credentials with applications; give each application its own service account.
FAQs
- What is the difference between the project name, ID, and number?
- The name is a display label you can change. The ID is globally unique, permanent, and used in commands and APIs. The number is an automatically assigned numeric identifier used internally.
- Why does a command say an API is not enabled?
- Services are off by default in a project. Enable the API with gcloud services enable, wait a moment, and retry, and make sure billing is linked if the service requires it.
Summary
Projects own resources, billing, and permissions in Google Cloud. Create one, set a budget, run gcloud init, select the project, enable the APIs you need, and grant narrow predefined roles instead of broad basic ones.
Related tutorials
- Google Cloud Storage Basics: Buckets, Objects, and Access Control
- Azure Blob Storage Basics: Accounts, Containers, and Secure Access
- Azure Getting Started: Subscriptions, Resource Groups, and the Azure CLI
- Amazon S3 Basics: Buckets, Objects, Versioning, and Safe Sharing
- AWS Getting Started: Secure Your Account, Set Up Access, and Use the CLI
Comments
Log in or create a free account to join the discussion.