This script is used to setup a GCP project, user permissions, group permissions, service accounts, and apis required to successfully and securely deploy your project.
NOTE: This script is does not deploy any GCP services.
| Folder | Description |
|---|---|
| gcp_project_setup.py | Script used to provision the GCP project, user permissions, group permissions, service accounts, and apis. |
| project_config.ini | Example configuration file |
- You need to have high enough privileges within the GCP organization to provision new projects.
The easiest way to get started is to activate a cloud console by logging into GCP and clicking the Activate Cloud Console button.
You will want to clone the project.
git clone https://github.com/GSA/odp-gcp-project-setup.git
You will want to customize the project_config.ini to meet your desired configuration.
For a complete example see the example project_config.ini.
Below is a list of configuration sections and the options you can set:
Note: Sections marked optional can be deleted from the project_config.ini
- [project]
project_id- Replace
<YOUR_PROJECT_ID>with a new or existing Project ID.
- Replace
project_folder- Replace
<YOUR_PROJECT_FOLDER>with the existing Folder ID the project should go into
- Replace
billing_account- Replace
<YOUR_BILL_ACCOUNT_ID>with the Billing Account ID you wish to be associated with this project.
- Replace
enable_app_engine- Set to
TrueorFalseto enable or disable App Engine for the Project.
- Set to
region- Set
<YOUR_PROJECTS_REGION>to the desired region.
- Set
- [project_labels] * Optional
- Any key value pairs that you add as an option under this section will generate a new label for your project.
test-label = test-valuewill generate a label oftest-labelwith a value oftest-label.
- Please keep in mind the following GCP restrictions on labels and values:
- "Only hyphens (-), underscores (_), lowercase characters, and numbers are allowed. International characters are allowed"
- Any key value pairs that you add as an option under this section will generate a new label for your project.
- [terraform_service_account] * Optional
- This section provides and example of creating a new or configuring an existing service account and assigning roles.
type- Set type to
service_accountto create or configure an existing service account
- Set type to
account- Replace
terraformwith the desired service account name.
- Replace
roles- You can add or delete any roles you would like applied in this section. Be sure to indent 2 spaces when adding new fields as white space matters.
- Understand roles added here will be appeneded. Removing already applied roles is from the list will not remove them from the actual configuration.
- [project_owner_user] * Optional
- This section provides and example of configuring an existing user account and assigning roles.
type- Set type to
userto configure an existing user account
- Set type to
account- Set the USER@domain.com to your desired user account.
roles- You can add or delete any roles you would like applied in this section. Be sure to indent 2 spaces when adding new fields as white space matters.
- Understand roles added here will be appeneded. Removing already applied roles is from the list will not remove them from the actual configuration.
- [project_owner_group] * Optional
- This section provides and example of creating a new or configuring an existing group and assigning roles.
- Section can be named anything you would like, and you can create as many group sections as you require.
type- Set type to
groupto configure an existing group account
- Set type to
account- Set the group@domain.com to your desired group account.
roles- You can add or delete any roles you would like applied in this section. Be sure to indent 2 spaces when adding new fields as white space matters.
- Understand roles added here will be appeneded. Removing already applied roles is from the list will not remove them from the actual configuration.
- Run the script with the
--configparameter pointing to where you saved theproject_config.inifile.
python gcp_project_setup.py --config project_config.ini