Extend identity documentation to GCP

[slash-under]

No description provided.

[skuenzli]

qq: should each HE project get separate dev and prod accounts in GCP? what advantages does this have over a dev and prod GCP project within a single GCP account for the HE project?

I definitely think we should create strong isolation between environments and projects, just wondering what the right balance is. AFAIK, a GCP IAM principal:

• must be specifically granted access to resources in different projects
• may be granted permissions to call different API actions in different projects in a single account (is this true?)

[skuenzli]

Need to update/replace references to Service Control Policy and Control Tower.

[skuenzli]

Suggested several updates and a question about accounts vs projects.

[FreemanParks]

very minor changes requested. Everything else looks great!

[FreemanParks]

minor style/formatting

Suggested change

	would like provision these accounts in a standardized way with low effort and simple adoption of Cloud security and
	would like to provision these accounts in a standardized way with low effort and simple adoption of Cloud security and

[FreemanParks]

Can we clarify the level of support the devops team will provide for this?

[skuenzli]

Overall, this LGTM.

A couple of questions to consider prior to merging:

• are 'project' and 'account' used in the canonical way for GCP?
• we could use he- instead of helpful- for account/project prefixes; if you've already provisioned as helpful- I would leave it. using he- would align to AWS.

[imonthercks]

Annotating the resource hierarchy to show what types of resources are at different levels. Not sure if this is accurate or helpful, so dispose of it if not.

Suggested change

	helpfulengineering.org Org
	└ Core
	└ Log
	└ Audit
	└ Sandboxes
	└ helpful-gcp-sandbox2
	└ Project Delivery
	└ Monitoring O2
	└ helpful-project-monitoring-O2-dev
	└ helpful-project-monitoring-O2-prod
	└ <project name>
	└ helpful-<project name>-dev
	└ helpful-<project name>-prod
	└ ...
	helpfulengineering.org (organization resource)
	└ Core (folder resource)
	└ Log (folder resource)
	└ Audit
	└ Sandboxes (folder resource)
	└ helpful-gcp-sandbox2 (project resource)
	└ Project Delivery (folder resource)
	└ Monitoring O2 (folder resource)
	└ helpful-project-monitoring-O2-dev (project resource)
	└ helpful-project-monitoring-O2-prod
	└ <project name> (folder resource)
	└ helpful-<project name>-dev (project resource)
	└ helpful-<project name>-prod
	└ ...

[imonthercks]

Looks good. Agree we need to make some changes to nomenclature about accounts vs. projects between AWS and GCP.