Set up the Platform Admin account

Your GDC Sandbox instance is populated with several accounts. One of them is the Platform Admin account, with the email address [e-mail]. This page describes how to configure this account with the necessary permissions for creating projects and performing other administration tasks.

Set up Platform Admin permissions

The following steps will set up your administrator account with the roles necessary to manage projects, users, storage, and other resources.

Warning: don't remove the Platform Admin account [e-mail], or remove the Organization IAM Admin role from this account. This will lock out the instance.

You can set up your administrator account using the GDC console, or the command line tool gdcloud.

GDC console

1. Navigate to your GDC console as described In Connect to your instance.
2. Select Access.
3. Select [e-mail] and click Edit Roles.

4. Click Add Another Role to add more roles.

   1. To provide the Platform Admin with the necessary rights to create projects and perform other administrative tasks, add the following roles:
      • Org Network Policy Admin
      • Organization IAM Admin
      • Bucket Admin
      • Organization DB Admin
      • Project Creator
      • Project Editor
      • User Cluster Admin
      • Organization Grafana Viewer
   2. To provide the Platform Admin with the necessary rights to create and test specific services, add roles specific to those services.
   3. Click Save.

5. Click Submit.

gdcloud

1. Ensure you have the gdcloud CLI installed.
2. Sign in using gdcloud auth login.

3. Set up role bindings for an organization:

   gdcloud organizations add-iam-policy-binding ORGANIZATION \
     --member=user:[e-mail] \
     --role=ROLE
   

   Replace the following variables:

   • ORGANIZATION: the name of the organization for which you're setting up the role binding.
   • ROLE: the name of the predefined or custom role you want to assign to the user.

4. To provide the Platform Admin with the necessary rights to create projects and perform other administrative tasks, add the following roles:

     gdcloud organizations add-iam-policy-binding org-1 \
               --member=user:[e-mail] \
               --role=org-network-policy-admin
   
     gdcloud organizations add-iam-policy-binding org-1 \
               --member=user:[e-mail] \
               --role=organization-iam-admin
   
     gdcloud organizations add-iam-policy-binding org-1 \
               --member=user:[e-mail] \
               --role=bucket-admin
   
     gdcloud organizations add-iam-policy-binding org-1 \
               --member=user:[e-mail] \
               --role=organization-db-admin
   
     gdcloud organizations add-iam-policy-binding org-1 \
               --member=user:[e-mail] \
               --role=project-creator
   
     gdcloud organizations add-iam-policy-binding org-1 \
               --member=user:[e-mail] \
               --role=oproject-editor
   
     gdcloud organizations add-iam-policy-binding org-1 \
               --member=user:[e-mail] \
               --role=user-cluster-admin
   
     gdcloud organizations add-iam-policy-binding org-1 \
               --member=user:[e-mail] \
               --role=organization-grafana-viewer