Question

Your company is bootstrapping a new Google Cloud organization. Leadership wants three environment tiers (dev, staging, prod) that each contain multiple product teams. Security requires that production-specific org policy constraints (e.g., restricting external IP addresses) apply automatically to all production projects, while dev teams should have looser constraints. Product teams should be able to create their own projects without waiting on the platform team, but only within their assigned space. Which resource hierarchy design best meets these requirements?

Accepted Answer

Create top-level folders for each environment (dev, staging, prod), nest a folder per product team under each environment folder, attach environment-specific org policies at the environment folders, and grant teams Project Creator on their team folders.

Answer

Create a single flat structure with all projects directly under the organization node, and apply org policies individually to each production project as it is created.

Answer

Create top-level folders per product team, nest environment folders under each team, and apply the production org policies at the organization node so they cover everything.

Answer

Grant every product team Owner at the organization level so they can self-manage projects and org policies for their environments.