Question

An enterprise is onboarding to Google Cloud. Their organization has three departments (Finance, Engineering, Marketing), and each department runs separate production and non-production workloads. Security requires that department administrators can apply IAM policies and organization policy constraints to all of their own projects, but must NOT be able to affect projects belonging to other departments. The security team also wants to apply a baseline set of organization policies across the entire company. Which resource hierarchy design best meets these requirements?

Accepted Answer

Create one folder per department under the organization node, then create prod and non-prod sub-folders (or projects) within each department folder, granting department admins roles at their department folder.

Answer

Place all projects directly under the organization node and grant each department administrator IAM roles scoped to individual project resources.

Answer

Create a single 'Departments' folder under the organization, place all projects inside it, and grant every department admin the Folder Admin role on that folder.

Answer

Create separate organizations for each department and use VPC Service Controls to isolate them, granting admins the Organization Admin role in their respective organizations.