Migrating Projects Between Google Cloud Organizations

This blog outlines the process of migrating a project from one Google Cloud organization to another, focusing on necessary updates to organizational policies, project migration, VPC and subnet updates, and post-migration test.

Organizational Policies for Export and Import

To allow the export and import of projects between organizations, certain organizational policies need to be configured

Source Organization (Exporting Project)

You need to configure the policy constraints/resourcemanger.allowExportDestinations to allow the export of projects to the destination organization.

Target Organization (Import Project)

The target organization must allow imports using the constraints/resourcemanager.allowedImportSources policy.

Steps to Set Organization policies

Enable Exporting in the Source Organization - Run the following command to configure the source organization resourcemanager.allowImportSources to allow export to the target organization

gcloud resource-manager org-policies allow --organization "SOURCE_ORG_ID" \
resourcemanager.allowImportSources "under:organizations/TARGET_ORG_ID" 

Enable Importing in the Target Organization

• Similarly, configure the target organization resourcemanager.allowedImportSources to allow imports from the source organization.

glcoud resource-manager org-policies allow --organization "TARGET_ORG_ID" \
resourcemanager.allowedImportSources "under:organizations/SOURCE_ORG_ID"

Analyze resource migration blockers

Before migrating a project, it’s crucial to analyze potential blockers that could prevent a smooth migration. You can use following commmand to analyze resource migration blockers.

glcoud asset analyze-move --project=PROJECT_ID \
--destination-folder=DESTINATION_FOLDER_ID

Link Billing Account to the Project
Make sure the project to be migrated is linked to the correct billing account. Use the following command.

gcloud billing project link PROJECT_ID --billing-account=BILLING_ACCOUNT_ID

Migrate Project to New Organization

Once the necessary policies are set, you can migrate the project using the following gcloud command:

gcloud beta projects move PROJECT_ID --organization=TARGET_ORG_ID

Run Test
Once the migration and configurationm changes are completed, its important to run tests to verify that the migration was successful, the project is functioning properly in the new organization, and that the required networking configurations (VPC, subnets) are correct.

• Conduct smoke test to vaildate that the project’s services and APIs are running smoothly in the target organizaiton.
• Ensure that all dependencies and network connections are intact.

Summary of Steps

• Update Organization policies: Enable export and import permisions between source and target organizations.
• Link Billing Account: Ensure the project is linked to the correct billing account.
• Migrate Project: Use gcloud beta projects move to move the project to the new organization.
• Run Test: Verify that everything works properly in the new organization.
• Analyze migration blockers: Use gcloud asset analyze-move to identify andy potenctional migration blockers.