Projects and regions
Everything you create on Google Cloud lives in a project: its resources, the IAM policy that guards them, and the APIs that are turned on for them. A project is identified by an id you choose, like my-app-prod, and its bill goes to a billing account.
Projects sit in an organization
Section titled “Projects sit in an organization”Projects sit in a hierarchy. An organization is the root, usually your company’s domain, and folders group projects inside it, by team or by environment. A role granted on a folder applies to every project under it, so a team’s access can be set in one place.
Use projects to keep environments apart: one for production, others for staging and development. Nothing in one project can reach another unless IAM allows it.
Connect a project with a profile
Section titled “Connect a project with a profile”Alchemy reaches a project through a profile, which names a gcloud configuration: a Google account, a project and a default region. Add GCP to your default profile:
alchemy profile edit --add GCPAlchemy signs in to the configuration with gcloud auth login when it has no login yet. It never activates the configuration, so each profile can use a different Google account while your own gcloud stays as it is. To deploy as a service account instead, point the profile at its key file. See Setup.
Make a profile per project:
alchemy profile create prodalchemy profile edit --profile prod --add GCPChoose the stage and the project separately
Section titled “Choose the stage and the project separately”A stage decides what you deploy: its own state and its own resource names. A profile decides where: which project, and the default region.
alchemy deploy --stage prod --profile prodalchemy deploy --stage pr-42 --profile defaultMany stages can share the development project, each with its own services.
Turn on the APIs a project uses
Section titled “Turn on the APIs a project uses”Every service is an API, like run.googleapis.com, and it must be enabled in a project before anything there can use it. A new project has almost none enabled:
gcloud services enable run.googleapis.com artifactregistry.googleapis.comSetup lists the ones most apps need.
A region is where a resource runs
Section titled “A region is where a resource runs”A region, like us-central1 or europe-west1, is a geographic location with several zones, separate data centers inside it. A Cloud Run service, a Cloud SQL instance or a subnet runs in one region. Some resources are multi-regional, like a Cloud Storage bucket in US, and some are global, like a VPC network and IAM itself.
The configuration’s compute/region is the default region: where Alchemy creates regional resources that don’t set their own region or location. A region in the profile overrides it.
With CI=true, Alchemy skips the profile and reads the environment: GOOGLE_PROJECT_ID and GOOGLE_APPLICATION_CREDENTIALS for a key file. Better still, let the workflow sign in with no key at all. See Federated identity.