Enable and manage Management Hub

Management Hub is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. You can process personal data for this product or feature as outlined in the Cloud Data Processing Addendum, subject to the obligations and restrictions described in the agreement under which you access Google Cloud Platform. Pre-GA products and features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

This page describes how to enable and manage Management Hub.

Enable Management Hub

Roles required

To get the required permission for enabling Management Hub , ask your administrator to grant you any of the following IAM roles on the Google Cloud Resource Hierarchy (projects, folders, and organizations):

• roles/owner
• roles/storage.admin

These roles contain the storage.managementHubs.update permission, which is required to enable Management Hub .
You can also get this permission with custom roles. You might be able to get this permission with other predefined roles as well. To see which roles are associated with which permissions, refer to IAM roles for Cloud Storage.

To grant, change, or revoke access to projects, folders, and organizations, see Manage access to projects, folders, and organizations.

Command line

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. Enable Management Hub for a project, folder, or organization with the gcloud alpha storage management-hub enable command. The following sections describe how to use this command for each resource type.

   Enable Management Hub for a project

   gcloud alpha storage management-hub enable --project=PROJECT_ID

   Where:

   PROJECT_ID is the Google Cloud project ID. Project IDs are alphanumeric, for example, my-project.

   Enable Management Hub for a folder

   gcloud alpha storage management-hub enable --sub-folder=FOLDER_ID

   Where:

   FOLDER_ID is the Google Cloud folder ID. Folder IDs are numeric, for example, 123456789012.

   Enable Management Hub for an organization

   gcloud alpha storage management-hub enable --organization=ORGANIZATION_ID

   Where:

   ORGANIZATION_ID is the Google Cloud organization ID. Organization IDs are numeric, for example, 123456789012.

   To apply name based bucket filters, use the following flags:

   • --exclude-bucket-ids: List of bucket IDs to be excluded from the Management Hub plan.
   • --exclude-bucket-regexes: List of bucket ID regexes to be excluded from the Management Hub plan.
   • --include-bucket-ids: List of bucket IDs to be included in the Management Hub plan.
   • --include-bucket-regexes: List of bucket ID regexes to be included in the Management Hub plan.

   For example:

   $gcloud alpha storage management-hub enable --organization=my-org --exclude-bucket-ids="my-bucket" --exclude-bucket-regexes="my-bucket-.*"

   To apply location based bucket filters, use the following flags:

   • --exclude-locations: List of locations to be excluded from the Management Hub plan.
   • --include-locations: List of locations to be included in the Management Hub plan.

   For example:

   $gcloud alpha storage management-hub enable --sub-folder=123456 --include-locations="us-east1","us-west1"

View Management Hub configuration

This section describes how to view the Management Hub configuration for a resource.

Roles required

To get the required permission for viewing Management Hub configuration , ask your administrator to grant you any of the following IAM roles on the Google Cloud Resource Hierarchy (projects, folders, and organizations):

• roles/owner
• roles/storage.admin

These roles contain the storage.managementHubs.get permission, which is required to view Management Hub configuration .
You can also get this permission with custom roles. You might be able to get this permission with other predefined roles as well. To see which roles are associated with which permissions, refer to IAM roles for Cloud Storage.

To grant, change, or revoke access to projects, folders, and organizations, see Manage access to projects, folders, and organizations.

Command line

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. View the Management Hub configuration for a project, folder, or organization with the gcloud alpha storage management-hub describe command. The following sections describe how to use this command for each resource type.

   View the Management Hub configuration for a project

   gcloud alpha storage management-hub describe --project=PROJECT_ID

   Where:

   PROJECT_ID is the Google Cloud project ID. Project IDs are alphanumeric, for example, my-project.

   View Management Hub configuration for a folder

   gcloud alpha storage management-hub view --sub-folder=FOLDER_ID

   Where:

   FOLDER_ID is the Google Cloud folder ID. Folder IDs are numeric, for example, 123456789012.

   View Management Hub configuration for an organization

   gcloud alpha storage management-hub describe --organization=ORGANIZATION_ID

   Where:

   ORGANIZATION_ID is the Google Cloud organization ID. Organization IDs are numeric, for example, 123456789012.

Update Management Hub configuration

This section describes how to update the Management Hub configuration for a resource.

Roles required

To get the required permission for updating Management Hub , ask your administrator to grant you any of the following IAM roles on the Google Cloud Resource Hierarchy (projects, folders, and organizations):

• roles/owner
• roles/storage.admin

These roles contain the storage.managementHubs.update permission, which is required to update Management Hub .
You can also get this permission with custom roles. You might be able to get this permission with other predefined roles as well. To see which roles are associated with which permissions, refer to IAM roles for Cloud Storage.

To grant, change, or revoke access to projects, folders, and organizations, see Manage access to projects, folders, and organizations.

Command line

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. Update the Management Hub configuration for a project, folder, or organization with the gcloud alpha storage management-hub update command. The following sections describe how to use this command for each resource type.

   Update the Management Hub configuration for a project

   gcloud alpha storage management-hub update --project=PROJECT_ID

   Where:

   PROJECT_ID is the Google Cloud project ID. Project IDs are alphanumeric, for example, my-project.

   Update the Management Hub configuration for a folder

   In your development environment, run the following command:

   gcloud alpha storage management-hub update --sub-folder=FOLDER_ID

   Where:

   FOLDER_ID is the Google Cloud folder ID. Folder IDs are numeric, for example, 123456789012.

   Update the Management Hub configuration for an organization

   gcloud alpha storage management-hub update --organization=ORGANIZATION_ID

   Where:

   ORGANIZATION_ID is the Google Cloud organization ID. Organization IDs are numeric, for example, 123456789012.

   For information about how to apply bucket filters, see Apply bucket filters.

Disable Management Hub

This section describes how to disable Management Hub.

Roles required

To get the required permission for disabling Management Hub , ask your administrator to grant you any of the following IAM roles on the Google Cloud Resource Hierarchy (projects, folders, and organizations):

• roles/owner
• roles/storage.admin

These roles contain the storage.managementHubs.update permission, which is required to disable Management Hub .
You can also get this permission with custom roles. You might be able to get this permission with other predefined roles as well. To see which roles are associated with which permissions, refer to IAM roles for Cloud Storage.

To grant, change, or revoke access to projects, folders, and organizations, see Manage access to projects, folders, and organizations.

Command line

1. In the Google Cloud console, activate Cloud Shell.

   Activate Cloud Shell

   At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.

2. Disable Management Hub for a project, folder, or organization with the gcloud alpha storage management-hub disable command. The following sections describe how to use this command for each resource type.

   gcloud alpha storage management-hub disable --project=PROJECT_ID

   Where:

   PROJECT_ID is the Google Cloud project ID. Project IDs are alphanumeric, for example, my-project.

   Disable Management Hub for a folder

   gcloud alpha storage management-hub disable --sub-folder=FOLDER_ID

   Where:

   FOLDER_ID is the Google Cloud folder ID. Folder IDs are numeric, for example, 123456789012.

   Disable Management Hub for an organization

   gcloud alpha storage management-hub disable --organization=ORGANIZATION_ID

   Where:

   ORGANIZATION_ID is the Google Cloud organization ID. Organization IDs are numeric, for example, 123456789012.

What's next

• Learn how to Relocate buckets.