Console
    Start free

    Set up Cloud Hub

    This document describes how to set up Cloud Hub.

    There are several main steps in the setup process:

    1. To create App Hub applications and view data about them in Cloud Hub, set up application management .

      If you don't set up application management, you can still view some data by Google Cloud project instead of by application in Cloud Hub.

    2. Enable APIs for project data . Some pages in Cloud Hub don't support application data. You must enable APIs for these pages separately.

    3. Configure aggregated views of logs, metrics, and traces .

    4. Grant access to Cloud Hub users.

    Different people or teams might be responsible for different steps in the Cloud Hub setup process.

    Set up application management

    This section describes the steps required to enable application management and create your applications.

    Required roles

    To get the permissions that you need to configure an app-enabled folder, ask your administrator to grant you the following IAM roles:

    • Enable application management: Folder Admin ( roles/resourcemanager.folderAdmin ) on the parent resource for the folder
    • Link a billing account to the management project:
    • Enable recommended APIs: Service Usage Admin ( roles/serviceusage.serviceUsageAdmin ) on the management project, only if you want to enable additional services
    • Grant application-centric roles to users: Project IAM Admin ( roles/resourcemanager.projectIamAdmin ) on the management project
    • Configure the observability scope:
    • View application-level and project-level data in Cloud Hub: Cloud Hub Operator ( roles/cloudhub.operator ) on the app-enabled folder

    For more information about granting roles, see Manage access to projects, folders, and organizations .

    You might also be able to get the required permissions through custom roles or other predefined roles .

    Enable a application management

    Resources that are scattered across multiple projects can be difficult to manage as a logical grouping. Application management lets you shift your focus from individual infrastructure components to your application as a whole.

    When you enable application management on a folder, the system automatically does the following:

    • The system creates a management project in the folder.
    • The system enables required APIs in the management project.
    • The management project stores application data, including enabled APIs, billing, quotas, and access controls.

    To enable application management on a folder, do the following:

    Console

    1. Select or create the Google Cloud folder that you want to configure as an app-enabled folder. To create a new folder, see Creating folders .

    2. In the Google Cloud console, open the Manage resourcespage.

      Go to Manage resources

    3. From the list of projects and folders, locate the folder that you want to configure.

      If a folder has theapp-enabled folder icon, application management is already enabled.

    4. In the folder row, open the Actionsmenu and click Settings.

      If application management has not been enabled on the folder, the Application managementsetting displays Not enabled .

    5. In the Enable application managementarea, click Create project.

      The Create management project and enable required APIspanel opens.

    6. Review the list of required APIs . These APIs manage your application lifecycle. For APIs that have associated costs, click the API name to learn more about pricing.

    7. To enable application management, click Create project and enable APIs.

      The system creates the management project in the folder.

    8. Make note of the management project Project Nameand Project ID. You'll use these values to grant access.

      Alternatively, to get the management project ID, you can use the following Google Cloud CLI command:

       gcloud  
resource-manager  
folders  
describe  
 FOLDER_ID 
  
--format = 
 "value(managementProject.split('/').slice(-1))"

      Replace FOLDER_ID with the ID number of the app-enabled folder.

      For more information, see Find the project name, number, and ID .

    gcloud

    1. In the Google Cloud console, activate Cloud Shell.

      Activate Cloud Shell

      At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

    2. Make sure that the most recent version of Google Cloud CLI is installed:

       gcloud  
components  
update

    3. To enable application management on a specific folder, use the gcloud resource-manager capabilities update command with the --enable flag.

       gcloud  
resource-manager  
capabilities  
update  
folders/ FOLDER_ID 
/capabilities/app-management  
--enable

      Replace FOLDER_ID with the ID of the folder that you want to enable for application management.

      This command enables the application management capability on the specified folder and automatically provisions a new Google Cloud project within that folder to serve as the management project.

    4. Optionally, to enable recommended APIs on the management project, follow the instructions to enable Google Cloud services on a project .

    Terraform

    To enable application management on a folder using Terraform, use the google_folder resource , for example:

      resource 
  
 "google_folder" 
  
 "folder" 
  
 { 
  
 display_name 
  
 = 
  
 "my-folder" 
  
 parent 
  
 = 
  
 "organizations/123456789" 
  
 deletion_protection 
  
 = 
  
 false 
 } 
 resource 
  
 "time_sleep" 
  
 "wait_60s" 
  
 { 
  
 depends_on 
  
 = 
  
 [ 
 google_folder.folder 
 ] 
  
 create_duration 
  
 = 
  
 "60s" 
 } 
 resource 
  
 "google_resource_manager_capability" 
  
 "capability" 
  
 { 
  
 value 
  
 = 
  
 true 
  
 parent 
  
 = 
  
 "${google_folder.folder.name}" 
  
 capability_name 
  
 = 
  
 "app-management" 
  
 depends_on 
  
 = 
  
 [ 
 time_sleep.wait_60s 
 ] 
 }

    This command enables the application management capability on the specified folder and automatically provisions a new Google Cloud project within that folder to serve as the management project. To enable the list of recommended APIs on the management project, follow the instructions to enable an API service on a Google Cloud project .

    Link a billing account to the management project

    To use advanced Application-centric Google Cloud features, you must link an active billing account to the management project. For example, a linked billing account helps you do the following:

    • Manage production-scale workloads that exceed App Hub resource quotas.
    • Use Application Design Center to create templates and deploy applications.

    For an overview of potential costs associated with application management and the enabled APIs, see Understanding costs .

    Follow these steps to link an active billing account to your management project:

    Console

    1. Verify that the billing account that you want to use for application management exists. To create a billing account, see Create a new self-serve Cloud Billing account .

    2. In the Google Cloud console, open the Billingpage.

      Go to Billing

    3. In the My projectstab, locate the management project.

    4. In the project row, open the Actionsmenu, select Change billing, and then choose the Cloud Billing account.

    For more information on enabling billing for a project, see Enabling billing for a project .

    gcloud

    gcloud billing projects link PROJECT-ID 
\
    --billing-account ACCOUNT-ID

    Replace PROJECT-ID with the project ID and ACCOUNT-ID with the billing account ID. Billing account IDs are in the format 0X0X0X-0X0X0X-0X0X0X .

    Configure observability scopes

    The observability scope determines where the Google Cloud console searches for telemetry data to display. Each Google Cloud project has a single observability scope, which identifies the default log and trace scopes. For metric data, the project's metrics scope determines where the Google Cloud console searches for data.

    To view or analyze all of your application's telemetry data, configure the observability scope and the metrics scope for the management project. By configuring these scopes, Cloud Hub and other services can find and display your application's log, metric, and trace data, even when that data is stored in multiple projects.

    This section summarizes the required configuration. For detailed instructions, see Set up application monitoring . The following table shows the required configuration scopes.

    Scope component
    Configuration scenario
    Key actions and considerations
    Log scope
    You use an aggregated sink to route all logs in the organization to a central log bucket.
    1. Create a log view that only includes application logs stored in the bucket.
    2. Configure the default log scope on the management project to include the log view.
    You don't have an organization-level aggregated sink, and the app-enabled folder doesn't have nested folders.
    1. Configure an aggregated sink to route application logs to the _Default log bucket of the management project.
    2. Make sure that the log scope named _Default is the default log scope.
    You don't want to use an aggregated sink.
    Configure the default log scope on the management project to list the storage locations of your application's log data.
    Metrics scope
    You configured an app-enabled folder containing all the projects that store the metric data you want to view.
    Google Cloud Observability attempts to synchronize the list of projects in your app-enabled folder with the list of projects on the scope of the metrics.

    As long as the number of projects in the app-enabled folder doesn't exceed your metric scope quota, Google Cloud Observability can keep the list of projects on the scope of the metrics updated when you add or remove projects in the app-enabled folder.
    Trace scope
    You want to monitor application trace data across multiple projects.
    1. Create a custom trace scope on the management project that lists the projects that store your application's trace data.
    2. Set your custom trace scope as the default trace scope.

    Create applications

    After you have enabled application management , you can create your applications. You have the following options to create your applications:

    • Use App Hub to create applications from existing Google Cloud resources. See Create an application .
    • Use Application Design Center to design and deploy new Google Cloud resources, which automatically provision App Hub applications. You use application templates to define the design and then deploy application instances based on the templates.

    Enable APIs for project data

    Most pages in Cloud Hub display both application data and project data. However, some pages only support project views of data.

    When you set up application management, APIs for viewing application data in Cloud Hub were enabled on the management project.

    To view data for resources in individual projects, you must enable the required APIs on those projects. Some required APIs, such as Cloud Logging and Cloud Monitoring, are enabled by default when you create a project.

    Required roles

    To get the permissions that you need to enable APIs, ask your administrator to grant you the Service Usage Admin (roles/serviceusage.serviceUsageAdmin) IAM role on the project. For more information about granting roles, see Manage access to projects, folders, and organizations .

    You might also be able to get the required permissions through custom roles or other predefined roles .

    To use Gemini Cloud Assist to get help with tasks such as troubleshooting or cost optimization, set up Gemini Cloud Assist to enable the required APIs. This setup is separate from API enablement in Cloud Hub.

    The following table summarizes the APIs required for each Cloud Hub page.

    Enable APIs

    To enable APIs for projects, perform the following steps:

    Support Project only Cloud Customer Care

    Console

    From the Cloud Hub Home page, you can view a list of APIs that are not enabled for Cloud Hub and enable those APIs.

    1. In the Google Cloud console, go to the Homepage,

      Go to Home

    2. From the project picker, select the project that you want to view.

    3. Next to Enable Recommended APIs click View APIs. A dialog displays APIs to enable.

    4. To enable the APIs, click Enable.

    gcloud

    You can use Google Cloud CLI to enable one or more specific APIs.

    1. Set the default project to the project where you want to enable the API.

      gcloud config set project PROJECT_ID

      Replace PROJECT_ID with your project ID.

    2. Get a list of services that you can enable in your project:

       gcloud services list --available

      If you don't see the API listed, that means you haven't been granted access to enable the API.

    3. Enable the services that you want to use in the project. You can enable more than one API by providing a list of service names.

      gcloud services enable SERVICE_NAME1 
 SERVICE_NAME2

    Grant access to Cloud Hub users

    The Cloud Hub Operator role includes permissions for viewing most data in Cloud Hub. You must grant access to view resource costs on the Optimization page and Gemini Cloud Assist investigations separately.

    Depending on the specific responsibilities of your users, you might need to grant other roles so that they can take action on data that they view in Cloud Hub.

    Required roles

    To get the permissions that you need to manage access to a project or folder, ask your administrator to grant you the following IAM roles on the resource that you want to manage access for (project or folder):

    • To manage access to a project: Project IAM Admin ( roles/resourcemanager.projectIamAdmin )
    • To manage access to a folder: Folder Admin ( roles/resourcemanager.folderAdmin )

    For more information about granting roles, see Manage access to projects, folders, and organizations .

    You might also be able to get the required permissions through custom roles or other predefined roles .

    Grant access for application data

    Console

    1. In the Google Cloud console, go to the IAMpage.

      Go to IAM

    2. In the project selector, choose the app-enabled folder.

    3. On the IAMpage, click Grant access. The Grant accesspane opens.

    4. In the New principalsfield, enter the email address of a Cloud Hub user.

    5. Click Select a roleand in the Filterfield, enter Cloud Hub.

    6. Select the Cloud Hub Operatorrole and click Save. The role is granted to the individual across all the projects and sub-folders of the app-enabled folder.

    7. In the project selector, choose the management project.

    8. To grant roles for resource costs and investigations, grant the required roles on the management project.

      1. On the IAMpage, click Grant access. The Grant accesspane opens.
      2. Grant the following roles to the appropriate individuals:
        • To view cost data on the Optimization page - Reader ( roles/reader ) or Viewer ( roles/viewer ), or a custom role that contains the billing.resourceCosts.get permission.
        • To view Gemini Cloud Assist investigations - Investigation Viewer ( roles/geminicloudassist.investigationViewer )

    gcloud

    1. In the Google Cloud console, activate Cloud Shell.

      Activate Cloud Shell

      At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

    2. Make sure that the most recent version of Google Cloud CLI is installed. Run the following command from the Cloud Shell:

      gcloud components update

    3. Grant the Cloud Hub Operator role in the app-enabled folder to the individuals. This role is granted to an individual across all the projects and sub-folders of the app-enabled folder.

      gcloud resource-manager folders add-iam-policy-binding FOLDER_ID 
\
    --member='user: PRINCIPAL 
' \
    --role='roles/cloudhub.operator'

      Replace FOLDER_ID with the ID of the folder. You can find your app-enabled folder ID on the IAM & Admin Settings page of the Google Cloud console. To ensure that the folder is app-enabled, the Settingspage should display the Management project ID. If you can't find the Management project ID, you might not be on an app-enabled folder. From the project selector, select your app-enabled folder.

    4. Grant access to view resource costs on the management project. The example command grants the Reader ( roles/reader ) role. To grant a role with a narrower set of permissions, create a custom role that contains the billing.resourceCosts.get permission.

      gcloud projects add-iam-policy-binding PROJECT-ID 
\
    --member='user: PRINCIPAL 
' \
    --role='roles/reader'

      Replace PROJECT-ID with the ID of the management project. The management project ID for a folder has the format FOLDER-NAME -mp .

    5. Grant access to view investigations on the management project.

      gcloud projects add-iam-policy-binding PROJECT-ID 
\
    --member='user: PRINCIPAL 
' \
    --role='roles/geminicloudassist.investigationViewer'

    Grant access for project data

    Console

    1. In the Google Cloud console, go to the Cloud Hub Homepage.

      Go to Home

    2. In the project selector, choose your project.

    3. Click Manage access. The Grant accesspane opens.

    4. In the New principalsfield, enter the email address of a Cloud Hub user.

    5. Click Select a roleand in the Filterfield, enter Cloud Hub.

    6. Select the Cloud Hub Operatorrole and click Save.

    7. Use the same steps to grant roles for viewing resource costs and investigations.

      • To view cost data on the Optimization page - Reader ( roles/reader ) or Viewer ( roles/viewer ), or a custom role that contains the billing.resourceCosts.get permission.
      • To view Gemini Cloud Assist investigations - Investigation Viewer ( roles/geminicloudassist.investigationViewer )

    gcloud

    1. In the Google Cloud console, activate Cloud Shell.

      Activate Cloud Shell

      At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

    2. Make sure that the most recent version of Google Cloud CLI is installed. Run the following command from the Cloud Shell:

      gcloud components update

    3. Grant the Cloud Hub Operator role on the project.

      gcloud projects add-iam-policy-binding PROJECT_ID 
\
    --member='user: PRINCIPAL 
' \
    --role='roles/cloudhub.operator'

      Replace PROJECT_ID with the project ID.

    4. Grant access to view resource costs in the project. The example command grants the Reader ( roles/reader ) role. To grant a role with a narrower set of permissions, create a custom role that contains the billing.resourceCosts.get permission.

      gcloud projects add-iam-policy-binding PROJECT_ID 
\
    --member='user: PRINCIPAL 
' \
    --role='roles/reader'

    5. Grant access to view investigations in the project.

      gcloud projects add-iam-policy-binding PROJECT_ID 
\
    --member='user: PRINCIPAL 
' \
    --role='roles/geminicloudassist.investigationViewer'

    What's next

    • View the Home page.
    Create a Mobile Website
    View Site in Mobile | Classic
    Share by: