Enable APIs for service account access: only parent project or all projects?

[urip_g]

Hello,

I am currently in the process of enabling an integration with GCP. As part of this process, I've created a service account in a project and granted it permissions at the GCP organization level. 

I intend to use a few specific APIs, notably the Resource Manager API and the Cloud Asset API, to access a selection of projects under the GCP organization.

My question is - do I need to turn the relevant APIs on for all relevant projects under the organization, or is it enough to only turn them on for the parent project of the service account? 

The resources I found on this topic are extremely vague, so I turn to you in hopes to find an answer.

[anjelisa]

Hi @urip_g,

Welcome to Google Cloud Community!

You need to enable these APIs at the project level. Enabling the APIs at the organization level alone is not sufficient.

Each individual project within the organization has its own API settings and needs to have the required APIs. Enabling the APIs at the parent project or organization level does not automatically enable them for all projects within the organization.

Enabling APIs at the organization level can provide access to the APIs for all projects within the organization, but it doesn't automatically enable the APIs for all projects. Each project has its own independent configuration, including which APIs are enabled or disabled.

Here are some references from the Google Cloud documentation that support this information:

1. Enabling and disabling APIs at the project level:

   • Enabling and disabling APIs
   • How to enable an API

2. Managing APIs at the organization level:

   • APIs & Services: Managing Organization resources

Please note that specific integrations and requirements may vary, so it's always a good idea to consult the official documentation and guidelines provided by Google Cloud Platform for your specific use case.

Hope this helps.