TopolearnProjects are the unit of billing, quotas and API enablement, and policies set higher up flow down to them.
Every Google Cloud resource belongs to exactly one project. Projects can sit under folders, and folders under an organization node that is tied to your company's Google Workspace or Cloud Identity domain.
A project has three identifiers:
- Project ID: globally unique, chosen by you, immutable (
shop-prod-4821). Used in commands and APIs. - Project number: assigned by Google, also immutable; appears in service agent emails.
- Name: a display label you can change.
The project is the boundary for enabled APIs, quotas, billing linkage and most IAM grants. A common layout is one project per application per environment (shop-dev, shop-prod), grouped in folders such as Production and Non-production, or by team.
Two things flow down the tree: IAM allow policies (a role granted on a folder applies to every project inside) and organization policies (guardrails such as allowed regions). A child can add permissions but cannot remove what a parent granted.
Accounts without an organization (a personal Gmail) can still create projects; they just have no folders or org-wide policies. Deleting a project shuts it down and schedules permanent deletion after a 30-day recovery window.
Example
# Create a project inside a folder and make it the default
gcloud projects create shop-dev-4821 --name="Shop dev" --folder=123456789012
gcloud config set project shop-dev-4821
gcloud projects describe shop-dev-4821 --format="value(projectNumber,parent.type,parent.id)"
# 987654321098 folder 123456789012
# Walk up the tree
gcloud projects get-ancestors shop-dev-4821
# ID TYPE
# shop-dev-4821 project
# 123456789012 folder
# 555555555555 organizationRemember
- Every resource lives in one project
- Project ID is unique and permanent; the name is just a label
- IAM and org policies set on a folder or the org are inherited
Watch out for
- Putting dev and prod in one project, so one IAM grant or quota affects both.