One project per environment, or per business
- Production: the websites and services customers use. Only one or two people are Owner or Admin here.
- Testing: containers and databases for trying changes. The team can be Editor here, and nothing in it can reach production.
- Shared tools (optional): things several projects use, such as an internal API. Join it to production with VPC peering, or make it the Center of a Network Hub once more projects need it.
Each project has its own package, wallet, members and VPC. A mistake, or an empty wallet, in testing doesn’t touch production, and each project’s costs are easy to see on their own.
Building for clients? Create one project per client. When the work is done, hand it over under Members & permissions (IAM) > Settings > Move project. Nothing moves until the client confirms.
Finished a website in your testing project? Move it into production from the website’s Settings > General tab > Move project (see Move a website to another project).
Plan IP ranges before you create services
Give every project’s VPC its own range, for example production 10.10.0.0/16, testing 10.20.0.0/16 and shared tools 10.30.0.0/16. Peering only works between ranges that don’t overlap. You can still move a range later, but every service in the project stops for a while during the move (see VPC and subnets).
When you have more projects, regions or offices
VPC peering is enough to join two projects in one region. Once you join three or more, reach a project in another region, or bring offices and staff in over VPN, use one Network Hub instead, with a firewall where you want one place to control traffic (see Network layout).
Checklist for a new account
- Turn on two-step sign-in (see People and access).
- If you buy as a company, add the company name and tax ID under Account & notifications so tax invoices are issued in the company’s name.
- Create projects for production and testing, with names that say what they are.
- Set each project’s VPC range, then add a subnet for each tier (see Network layout).
- Invite the team, giving each person the lowest role that lets them do their work.
- Top up each project’s wallet with enough for at least a month, so services never stop.
- Set a backup schedule on every database, and back up by hand before any big change (see Backups and rollback).
- For production databases, turn on high availability and point-in-time recovery (see High availability and point-in-time recovery).
- If offices or staff need your services, bring them in through a VPN gateway on a Network Hub instead of opening databases to the internet (see VPN Gateway).