[diceduckmonk]

You can’t have nested projects, but for the purposes of organizations there is folders and orgs, which are container of containers.

GCP’s IAM somewhat addresses the isolation and scope problem mentioned in the article. Not all GCP apis, atleast with respect to OAuth2, properly utilize IAM, insofar that they require overly power OAuth2 scopes. For example, to list cloud functions you need permissions to create and edit, too. That’s broken.

In GCP, many orgs find themselves proliferating in projects because GCP’s billing is abstruse. People isolate resources to projects so they know how much specific services actually cost. This in turn presents another problem. GCP Web Console’s search doesn’t index well. For example, substring search doesn’t work on far too many resources. VMs are the exception, but we think this is inverted. Substring search should work on every resource, not be exceptional. Historically it didn’t even do cross project search. This is frankly not acceptable for a search company.

[mdaniel]

> For example, to list cloud functions you need permissions to create and edit, too. That’s broken.

Do you have a concrete example of that? Or, maybe you mean the console needs those perms to work?