1.2.1. Organizations, Folders, and Projects
💡 First Principle: The resource hierarchy has exactly four levels — Organization, Folder, Project, and Resource — and policies set at any level are inherited by everything nested beneath it, all the way down.
The Organization node sits at the top and represents your company as a whole; it's tied to a Cloud Identity or Google Workspace domain and is the anchor point for organization-wide policies. Folders are optional, sit beneath the Organization, and typically mirror your company's structure — a folder per department, per team, or per environment (production versus development). Projects are the actual working unit: every resource you create — a VM, a bucket, a database — belongs to exactly one project, and every project has a unique project ID, a project number, and (optionally) a human-friendly project name.
Critically, a project does not require an Organization above it. A standalone project can exist entirely on its own — useful for a solo developer or a small proof-of-concept — but it forfeits the benefits of centralized organization policies and folder-based delegation that come with a full hierarchy.
Organization Policies (a distinct constraint system from IAM) attach at any of these levels and restrict what configurations are allowed — for example, blocking the creation of external IP addresses or restricting which regions resources can be deployed to — regardless of what an individual user's IAM role would otherwise permit them to do.
⚠️ Exam Trap: IAM answers "who can do what," while Organization Policy answers "what configurations are allowed at all," even for an Owner. A scenario where an Owner-level user still can't perform an action they should have permission for is almost always pointing at an Organization Policy constraint, not an IAM misconfiguration.
Reflection Question: A new subsidiary needs its own set of projects that inherit the parent company's security policies but should be managed by a separate team. Which two levels of the hierarchy work together to achieve that, and what does each one contribute?
