Set up Cloud Hub

This document describes how to set up Cloud Hub.

There are several main steps in the setup process:

To create App Hub applications and view data about them in Cloud Hub, set up application management.

If you don't set up application management, you can still view some data by Google Cloud project instead of by application in Cloud Hub.
Enable APIs for project data. Some pages in Cloud Hub don't support application data. You must enable APIs for these pages separately.
Configure aggregated views of logs, metrics, and traces.
Grant access to Cloud Hub users.

Different people or teams might be responsible for different steps in the Cloud Hub setup process.

Set up application management

This section describes the steps required to enable application management and create your applications.

Required roles

To get the permissions that you need to configure an app-enabled folder, ask your administrator to grant you the following IAM roles:

Enable application management: Folder Admin (roles/resourcemanager.folderAdmin) on the parent resource for the folder
Enable APIs: Service Usage Admin (roles/serviceusage.serviceUsageAdmin) on the target folder (to enable required and recommended APIs)
Link a billing account to the management project:
- Project Billing Manager (roles/billing.projectManager) on the management project
- Billing Account User (roles/billing.user) on the target billing account
Grant application-centric roles to users: Project IAM Admin (roles/resourcemanager.projectIamAdmin) on the management project
Configure the observability scope:
- Observability Editor (roles/observability.editor) on the management project
- Logs Configuration Writer (roles/logging.configWriter) on the management project
- Monitoring Admin (roles/monitoring.admin) on the management project and on each project that you want to add to the metrics scope
- Cloud Trace User (roles/cloudtrace.user) on the management project
- App Hub Viewer (roles/apphub.viewer) on the management project
View application-level and project-level data in Cloud Hub: Cloud Hub Operator (roles/cloudhub.operator) on the app-enabled folder

For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Enable a application management

Application management lets you shift your focus from individual infrastructure components to your application as a whole.

When you enable application management on a folder, the folder is called app-enabled folder and the following occurs:

A project is defined as the management project in the folder.
The system enables required APIs on the management project.
The management project stores application data, including enabled APIs, billing, quotas, and access controls.

To enable application management on a folder, do the following:

Console

Select or create the Google Cloud folder that you want to configure as an app-enabled folder. To create a new folder, see Creating folders.
In the Google Cloud console, open the Manage resources page.

Go to Manage resources
From the list of projects and folders, locate the folder that you want to configure.

If a folder has the app-enabled folder icon, application management is already enabled.
In the folder row, open the Actions menu and click Settings.

If application management has not been enabled on the folder, the Application management setting displays Not enabled.
In the Enable application management area, click Create project.

The Create management project and enable required APIs panel opens.
Review the list of required APIs. These APIs manage your application lifecycle. For APIs that have associated costs, click the API name to learn more about pricing.
To enable application management, click Create project and enable APIs.

The system creates the management project in the folder.

Warning: If API enablement fails, you must restart the application management enablement process. The error is displayed in Notifications.
Make note of the project name and ID of the management project. You'll use these values to grant access.

Alternatively, to get the management project ID, you can use the following Google Cloud CLI command:
```
gcloud resource-manager folders describe FOLDER_ID
    --format="value(managementProject.split('/').slice(-1))"
```
Replace FOLDER_ID with the ID of the app-enabled folder.

For more information, see Find the project name, number, and ID.

gcloud

In the Google Cloud console, activate Cloud Shell.

Activate Cloud Shell

At the bottom of the Google Cloud console, a Cloud Shell session starts and displays a command-line prompt. Cloud Shell is a shell environment with the Google Cloud CLI already installed and with values already set for your current project. It can take a few seconds for the session to initialize.
Make sure that the most recent version of Google Cloud CLI is installed:
```
gcloud components update
```
To enable application management on a specific folder, use the gcloud resource-manager capabilities update command with the --enable flag.
```
gcloud resource-manager capabilities update folders/FOLDER_ID/capabilities/app-management \
   --enable
```
Replace FOLDER_ID with the ID of the folder.

This command enables the application management capability on the specified folder and automatically provisions a new Google Cloud project within that folder to serve as the management project.
Optionally, to enable recommended APIs on the management project, follow the instructions to enable Google Cloud services on a project.

Terraform

To enable application management on a folder using Terraform, use the google_resource_manager_capability resource, for example: