Skip to content

Connect Azure and Google Cloud

Alongside, or instead of, AWS. Each member then gets their own resource group on Azure or project on Google Cloud.

Register your organization first, as in step 1 of Onboard Your Organization. The AWS setup there is a CloudFormation command; Azure and Google Cloud are connected by granting RosettaHub access as described below. You can connect AWS, Azure and Google Cloud to the same organization.

Azure

You need an Azure subscription that will serve as the root subscription. Grant RosettaHub access to manage resource groups within that subscription; RosettaHub then creates a resource group for each member.

Screenshot: Azure setup

Contact support@rosettahub.com for the exact role assignment to grant.

Google Cloud

1. Have a Google Cloud organization

If you do not have one yet, create it through Cloud Identity: https://gsuite.google.com/signup/gcpidentity/welcome.

2. Raise your project quota (new accounts only)

RosettaHub creates a project for each member, and new Google Cloud accounts have a low default limit on projects. Request an increase at https://support.google.com/code/contact/billing_quota_increase. It can take 24 to 48 hours.

Screenshot: GCP project quota

3. Grant RosettaHub access to your folder

Replace folder_id with your folder ID and rh-email with the RosettaHub service email you are given during registration:

gcloud resource-manager folders add-iam-policy-binding folder_id \
  --member="user:rh-email" \
  --role="roles/owner"

gcloud resource-manager folders add-iam-policy-binding folder_id \
  --member="user:rh-email" \
  --role="roles/resourcemanager.projectCreator"

gcloud resource-manager folders add-iam-policy-binding folder_id \
  --member="user:rh-email" \
  --role="roles/resourcemanager.projectDeleter"

gcloud resource-manager folders add-iam-policy-binding folder_id \
  --member="user:rh-email" \
  --role="roles/resourcemanager.folderAdmin"

Warning

Check folder_id and rh-email before running these commands. Wrong values grant permissions to the wrong principal, or on the wrong folder.

4. Optional: restrict Regions

To restrict users to specific Regions, grant the organization policy administrator role as well. Replace project_id and org_id with your own:

gcloud organizations add-iam-policy-binding org_id \
  --member="serviceAccount:administrator@project_id.iam.gserviceaccount.com" \
  --role="roles/orgpolicy.policyAdmin"

gcloud organizations add-iam-policy-binding org_id \
  --member="user:rh-email" \
  --role="roles/orgpolicy.policyAdmin"

To keep every user in a single Region, enforce an organization policy at the folder level and tell RosettaHub which Region you chose.

Then