Console

1. In the Google Cloud console, use the project picker to select your project.

2. Navigate to theOverview page from App Hub:

   Go to Overview

3. ClickSet up App Hub.

4. In theEnable App Hub page, chooseFull setup to create amultiple-project boundary.

5. Make note of the project name and ID. This information identifies thehost project and you'll use these values to grant access.

6. Review the list ofAPIs being enabled.Some APIs have associated costs.Learn more about the costs of APIsor click each API to see associated costs.

   Note: This setup process enables several APIs, but only App Hub and Application Monitoring support host projects. Therefore, other enabled APIs might not function as expected in this legacy setup model. For more information, seeFeature support by boundary type.

7. ClickContinue.

8. In theDefine boundary tab, verify your project information.

9. ClickaddAdd project toadd service projects to your boundaryor add those later.

10. ClickContinue.

11. In theGrant access tab, choose the appropriateIAM roles and permissionsfor administrators in the project.For a list of recommended application-centric roles acrossGoogle Cloud products, seeGrant application-centric roles to your users.

12. In theNew principals box, enter the users, groups, orservice accounts who should have administrator access toapplication-centric tasks in the project.

13. ClickGrant roles and then clickComplete.

Later, you can grant additional IAM roles to your principalsfrom theIAM page. For more information, seeGrant an IAM role by using the Google Cloud console.

gcloud

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, aCloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. Make sure that the most recent version of Google Cloud CLI is installed:

   gcloudcomponentsupdate

3. Find the project IDof the Google Cloud project that you want to configure as the hostproject.

4. Set the host project as the default project for commands:

   gcloudconfigsetprojectHOST_PROJECT_ID

   ReplaceHOST_PROJECT_ID with the ID of theproject you want to configure as the host project.

5. Enable theApp Hub API in thehost project:

   gcloudservicesenableapphub.googleapis.com\--project=HOST_PROJECT_ID

Console

1. In the Google Cloud console, use the project picker to select the hostproject.

   Go to Welcome

2. Navigate to theBoundary settings page from App Hub:

   Go to Boundary settings

3. ClickaddAdd project.

4. Select the service projects that you want to attach to the host projectand add to your boundary in one of the following ways:

   • From the list of projects, select the checkboxes for the projectsyou want to attach as service projects.
   • Filter the project names and select their checkboxes.

5. ClickSelect.

   TheProjects in your boundary table displays the selected serviceprojects. The attachment process might take some time to complete.

6. Verify the list of service projects is complete.

gcloud

1. Find the project IDof each of the Google Cloud projects that you want to configure asservice projects.

2. Attach each service project:

   gcloudapphubservice-projectsaddSERVICE_PROJECT_ID\--project=HOST_PROJECT_ID

   Replace the following:

   • SERVICE_PROJECT_ID: the ID of the serviceproject to attach.
   • HOST_PROJECT_ID: the ID of the hostproject.

3. Repeat the previous process for each service project you want to attachto the host project.

Terraform

To attach a service project to a host project using Terraform, usethegoogle_apphub_service_project_attachment resource,for example:

resource"google_apphub_service_project_attachment""example"{service_project_attachment_id=google_project.service_project.project_iddepends_on=[time_sleep.wait_120s]}resource"google_project""service_project"{project_id="project-1"name="Service Project"org_id="123456789"deletion_policy="DELETE"}resource"time_sleep""wait_120s"{depends_on=[google_project.service_project]create_duration="120s"}

Console

1. In the Google Cloud console, use the project picker to select the hostproject.

   Go to Welcome

2. Navigate to theIAM page:

   Go to IAM

3. Clickperson_addGrant access.TheGrant access pane opens.

4. In theNew principals field, enter the email address of theprincipal that you want to grant access to App Hub.

5. ClickSelect a role and enterApp Hub in theFilter field.

6. Select theApp Hub IAM roleyou intend to assign to the principal and clickSave.

7. In each of the App Hub service projects you attached to thehost project, repeat the previous process to grant the same roles to thesame users.

gcloud

1. Find the project IDof each of the Google Cloud projects that you configured as host andservice projects.

2. Grant access to principals in the host project:

   gcloudprojectsadd-iam-policy-bindingHOST_PROJECT_ID\--member='user:EMAIL_ADDRESS'\--role='ROLE_NAME'

   Replace the following:

   • HOST_PROJECT_ID: the ID of the hostproject.
   • EMAIL_ADDRESS: the email address of theprincipal who must obtain App Hub access in the hostproject. This value must have the formatusername@yourdomain,for example,my.user@example.com.
   • ROLE_NAME: theApp Hub IAM roleyou want to assign to the principal, for example,roles/apphub.admin.

3. In each of the App Hub service projects you attached to thehost project, grant the same roles to the same users:

   gcloudprojectsadd-iam-policy-bindingSERVICE_PROJECT_ID\--member='user:EMAIL_ADDRESS'\--role='ROLE_NAME'

   ReplaceSERVICE_PROJECT_ID with the ID ofthe service project you are granting access to.

Console

1. In the Google Cloud console, use the project picker to select the hostproject.

   Go to Welcome

2. Navigate to theBoundary settings page from App Hub:

   Go to Boundary settings

3. Select the checkboxes of the service projects that you want to detachfrom the host project and remove from your boundary.

4. ClickDetach projects.

   TheProjects in your boundary table refreshes to display only theprojects that remain attached to the host project.

5. Verify the list of service projects is updated.

gcloud

1. Find the project IDof each of the service projects that you want to remove from the hostproject.

2. Remove each service project:

   gcloudapphubservice-projectsremoveSERVICE_PROJECT_ID\--project=HOST_PROJECT_ID

   Replace the following:

   • SERVICE_PROJECT_ID: the ID of the serviceproject to remove.
   • HOST_PROJECT_ID: the ID of the hostproject.

3. Repeat the previous process for each service project you want to removefrom the host project.