2.1. Setting Up Cloud Projects and Accounts
💡 First Principle: Setting up a cloud environment isn't a single action — it's establishing a structure (the hierarchy), populating it with identities (users, groups, service accounts), and opening the doors those identities need (enabled APIs, sufficient quota) in the right order, because each step depends on the one before it.
Get this phase wrong and every downstream task inherits the mistake: an IAM role granted at the wrong level in the hierarchy either locks legitimate users out or over-grants access company-wide, and neither failure is obvious until an audit or an incident surfaces it. This is why "setup" tasks make up a full 20% of the exam on their own, even though they only happen once per environment — the blast radius of a setup mistake is enormous precisely because it happens early and everything else builds on top of it.
Think of it like laying the foundation and plumbing for a building before anyone moves in: nobody sees the resource hierarchy or the IAM bindings day-to-day, but every subsequent tenant's ability to get water and electricity depends on it being routed correctly from the start.
⚠️ Common Misconception: An Organization node is required before you can create any Google Cloud project. In reality, standalone projects can exist with no Organization above them — an Organization becomes necessary once you need org policies, centralized resource hierarchy, or Cloud Identity-managed users at scale, not before.
