Set up a single project

This document describes how to set up a single Google Cloud project to manage applications. This configuration is also known as the single-project boundary.

In this setup, the Google Cloud project is configured to manage its own applications and components, acting as a standalone management project. This approach is the quickest way to begin managing applications if all your application components reside within this single project. App Hub automatically discovers all supported resources within the project, making them ready to be organized into applications.

Limitations

The single-project boundary has different feature support compared to the folder-level boundary. App Hub, Application Design Center, and Application Monitoring fully support single projects, but other Application-centric Google Cloud services, like Cloud Hub and Gemini Cloud Assist, require a folder-level boundary.

For a comparison of feature support between the single-project and folder-level models, see Feature support by boundary type.

Before you begin

Choose the Google Cloud project you want to use for managing your applications. This project will function as the standalone management project. You can use an existing project or create a new one.

Required roles

To get the permissions that you need to configure a single project for application management, ask your administrator to grant you the following IAM roles on the project that you want to configure as the standalone management project:

  • Manage resources, permissions, and billing on the project: Project Owner (roles/owner)
  • Manage all application components on the project: App Hub Admin (roles/apphub.admin)

For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Enable application management on a project

This action configures the project as a standalone management project and enables the required APIs for application metadata and configurations. The project is then called an app-enabled project.

To enable application management on a single project, follow these steps:

  1. In the Google Cloud console, activate Cloud Shell.

    Activate Cloud Shell

    At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

  2. Make sure that the most recent version of Google Cloud CLI is installed:

    gcloud components update

  3. Find the project ID.

  4. Set the project as the default project for commands:

    gcloud config set project PROJECT_ID

    Replace PROJECT_ID with the ID of the project.

  5. Enable the App Hub API:

    gcloud services enable apphub.googleapis.com \
    --project PROJECT_ID

  6. Attach the project to itself to create an application management boundary:

    gcloud alpha apphub boundary update \
    --crm-node="projects/$(gcloud projects describe PROJECT_ID --format='value(projectNumber)')" \
    --project=PROJECT_ID \
    --location=global

    This command configures the project as its own management project, letting App Hub automatically discover all supported resources within it.

  7. Confirm the attachment status:

    gcloud alpha apphub boundary describe \
    --project=PROJECT_ID \
    --location=global

    You obtain an output similar to the following example:

    name: projects/PROJECT_ID/locations/LOCATION/boundary
crmNode: projects/PROJECT_NUMBER
createTime: 2025-08-28T19:04:47Z
updateTime: 2025-08-28T19:04:47Z
type: AUTOMATIC

    PROJECT_NUMBER is the project number corresponding to your project ID.

Assign App Hub roles and permissions

To let users discover, register, and manage application components within this project using App Hub, you need to grant them the appropriate App Hub roles and permissions.

Follow these steps:

Console

  1. In the Google Cloud console, use the project picker to select the management project.

  2. Navigate to the IAM page:

    Go to IAM

  3. Click Grant access. The Grant access pane opens.

  4. In the New principals field, enter the email address of the principal that you want to grant access to App Hub.

  5. Click Select a role and enter App Hub in the Filter field.

  6. Select the App Hub IAM role you intend to assign to the principal and click Save.

gcloud

  1. Grant access to principals in the management project:

    gcloud projects add-iam-policy-binding PROJECT_ID \
    --member='user:EMAIL_ADDRESS' \
    --role='ROLE_NAME'

    Replace the following:

    • PROJECT_ID: the ID of the management project.
    • EMAIL_ADDRESS: the email address of the principal who must obtain App Hub access. This value must have the format username@yourdomain, for example, my.user@example.com.
    • ROLE_NAME: the App Hub IAM role you want to assign to the principal, for example, roles/apphub.admin.

What's next