GCP Setup Complete Tutorial: Account, Organization, IAM & Billing Initial Configuration

A step-by-step guide to setting up GCP from zero. Walks through account creation, organization design, billing controls, IAM, region selection, API enablement, and Cloud Shell — covering the production-grade best practices end to end.

Step 1: Create Your Account and Claim the $300 Credit

1. Go to cloud.google.com/free
2. Click "Get started for free"
3. Sign in with a Google account (a new Gmail address works too)
4. Select your country, industry, and intended use
5. Register a credit card (for identity verification — charges require separate consent)
6. Receive the $300 / 90-day credit

Step 2: Set Up an Organization (Recommended for Businesses)

• Enable Cloud Identity Free Edition (free, requires a custom domain)
• Or use Google Workspace
• An Organization resource is created automatically
• Complete domain verification to gain Organization Owner privileges

Step 3: Resource Hierarchy Design

Organization (example.com)
├── Folder: Production
│   ├── Project: prod-app-1
│   ├── Project: prod-data
│   └── Project: prod-ml
├── Folder: Staging
│   └── Project: staging-app
├── Folder: Development
│   ├── Project: dev-alice
│   └── Project: dev-bob
└── Folder: Shared Services
    ├── Project: shared-network
    └── Project: shared-monitoring

Step 4: Configure the Billing Account

1. Cloud Console → Billing → New Billing Account
2. Link a credit card
3. Link the Billing Account to your Folders and Projects
4. Create a Budget with a monthly cap and 50/90/100% alerts
5. Enable BigQuery billing export

Step 5: IAM Design

• Google Groups — create groups such as gcp-admins, gcp-developers, gcp-viewers
• Grant roles to groups, not to individual users
• Do not use Basic Roles (Owner/Editor) in production
• Lean on Predefined Roles (e.g., roles/compute.admin)
• Create dedicated Service Accounts with least-privilege scopes
• Prefer Workload Identity (no static keys)
• Use Privileged Access Manager (PAM) for just-in-time access

Step 6: Region Selection

Step 7: Enable Core APIs

gcloud services enable \
  compute.googleapis.com \
  container.googleapis.com \
  run.googleapis.com \
  cloudfunctions.googleapis.com \
  storage.googleapis.com \
  bigquery.googleapis.com \
  pubsub.googleapis.com \
  iam.googleapis.com \
  cloudbuild.googleapis.com \
  artifactregistry.googleapis.com \
  monitoring.googleapis.com \
  logging.googleapis.com

Step 8: Make Use of Cloud Shell

• Launch it from the icon in the top-right of the Console
• Free (up to 50 hours per week per session)
• 5 GB persistent home directory
• gcloud, kubectl, terraform, docker, and git come preinstalled
• Cloud Shell Editor lets you use it as a full IDE

Step 9: Install gcloud CLI Locally

# macOS
brew install --cask google-cloud-sdk

# Linux (Debian/Ubuntu)
curl https://sdk.cloud.google.com | bash

# 初期設定
gcloud init
gcloud auth login
gcloud config set project YOUR_PROJECT_ID
gcloud config set compute/region asia-northeast1
gcloud config set compute/zone asia-northeast1-a

Step 10: Configure Organization Policies (Recommended)

• compute.vmExternalIpAccess: Restrict external IPs on VMs
• iam.disableServiceAccountKeyCreation: Disable Service Account key creation
• gcp.resourceLocations: Restrict allowed regions
• iam.allowedPolicyMemberDomains: Restrict to trusted domains
• storage.uniformBucketLevelAccess: Disable ACLs in favor of uniform bucket-level access

Production Environment Checklist

• ☐ Organization + Folder + Project hierarchy
• ☐ Billing Budget with Pub/Sub notifications
• ☐ BigQuery billing export
• ☐ Cloud Identity / Workspace integration
• ☐ Group-based IAM
• ☐ Dedicated Service Accounts
• ☐ Organization Policies applied
• ☐ VPC SC + CMEK for sensitive data
• ☐ All Cloud Audit Logs enabled
• ☐ Cloud Monitoring notification channels
• ☐ Cloud Build CI/CD pipeline
• ☐ Infrastructure as Code with Terraform

Google Cloud is a trademark of Google LLC. For the latest information, see the official GCP documentation.