How to list all projects inside GCP organization using Resource Manager API?

Question

I am trying to list all projects I have in GCP by using the projects.list method from the Resource Manager API but I cannot figure out what access token to be used.

Let's say I have three projects:

• My Project 44572
• Testing
• My First Project

And when I use the projects.list method it should give me the output as this:

{
  "projects": [
    {
      "name": "My Project 44572", 
      "parent": {
        "type": "organization", 
        "id": "ORG_ID"
      }, 
      "projectId": "PROJECT_ID", 
      "projectNumber": "PROJECT_NUMBER", 
      "lifecycleState": "ACTIVE", 
      "createTime": "2020-06-15T08:38:04.712Z"
    }, 
    {
      "name": "Testing ", 
      "parent": {
        "type": "organization", 
        "id": "ORG_ID"
      }, 
      "projectId": "PROJECT_ID", 
      "projectNumber": "PROJECT_NUMBER", 
      "lifecycleState": "ACTIVE", 
      "createTime": "2020-06-15T08:35:59.480Z"
    }, 
    {
      "name": "My First Project", 
      "parent": {
        "type": "organization", 
        "id": "ORG_ID"
      }, 
      "projectId": "PROJECT_ID", 
      "projectNumber": "PROJECT_NUMBER", 
      "lifecycleState": "ACTIVE", 
      "createTime": "2020-06-15T08:33:23.859Z"
    }
  ]
}

But if I am using the Access Token which I got by using service account of My Project 44572 I am getting the following output:

{
  "projects": [
    {
      "name": "My Project 44572", 
      "parent": {
        "type": "organization", 
        "id": "ORG_ID"
      }, 
      "projectId": "PROJECT_ID", 
      "projectNumber": "PROJECT_NUMBER", 
      "lifecycleState": "ACTIVE", 
      "createTime": "2020-06-15T08:38:04.712Z"
    }
]
}

So, what access token I should use so that I would get all projects under my organization?

Answer 1

I solved the problem by assigning the service account of "My Project 44572" Owner role at Organization level and now when i use the access token generated by this service account it would list all the projects in my organization

Answer 2

The projects.list method requires the permission resourcemanager.projects.get . You can grant the account any role containing the permission at org level to achieve your goal, eg, -

• roles/viewer
• roles/editor
• roles/owner

Alternatively, you can use the resources.searchAll method which requires the cloudasset.assets.searchAllResources permission. You can grant the account any role with this permission at org level:

• roles/cloudasset.viewer
• roles/cloudasset.owner
• roles/viewer
• roles/editor
• roles/owner

To list all the projects within an organization 456:

gcloud asset search-all-resources \
--asset-types="cloudresourcemanager.googleapis.com/Project"
--scope=organizations/456

Documentation:

• https://cloud.google.com/asset-inventory/docs/searching-resources
• https://cloud.google.com/asset-inventory/docs/reference/rest/v1p1beta1/resources/searchAll

Related post:

• How to find, list, or search resources across services (APIs) and projects in Google Cloud Platform?