Controlling access to the images
To split workloads, environments, and user access, you will usually need different Google Cloud projects. Although most cloud workloads do not require sharing between projects, images are an excellent choice for doing so. You can follow a consistent approach to distributing images with best practices for security, permission, package management, and operations pre-configured for the rest of the company by using a shared collection of images.
Figure 13.3 – Sharing images between projects
You can share images by giving different IAM roles to different projects inside an organization. Image Creation Project, represented in Figure 13.3, is the project that holds the images that you want to share with other projects, and it must have the following IAM roles and policies applied to it:
- Allow users of Image User Group to create instances from these images by granting them the
compute.imageUserrole - Allow Image...
