Skip to content

README.md

Latest commit

 

History

History
107 lines (73 loc) · 3.08 KB

README.md

File metadata and controls

107 lines (73 loc) · 3.08 KB
Raw

Enable Service Usage API across an organization

Lists every project under a GCP organization and enables the Service Usage API (serviceusage.googleapis.com) on each one.

Runs in dry-run mode by default — it only lists the projects and prints what it would do. Pass --dry-run false to actually enable the service.

Prerequisites

To run the script, you must have:

  • Google Cloud CLI (gcloud)
  • jq
  • An authenticated gcloud session: gcloud auth login
  • IAM permission to list projects under the organization and to enable services on each project (roles/serviceusage.serviceUsageAdmin or equivalent, plus roles/browser / resourcemanager.projects.list at the org level).

Executing the script

  1. Ensure that you have execute privileges:

    chmod +x enable-serviceusage.sh

  2. Authenticate and run:

    gcloud auth login
./enable-serviceusage.sh --org-id 123456789012

Synopsis

./enable-serviceusage.sh --org-id <ORG_ID> [options]

Options

--org-id (Required)

[String] The numeric GCP organization ID whose projects will be processed.

--service (Optional)

[String] Comma-separated list of one or more services to enable. Defaults to serviceusage.googleapis.com. Example: serviceusage.googleapis.com,orgpolicy.googleapis.com.

--dry-run (Optional)

[String] When false the service is enabled on each project; when true the script only lists the projects and what it would do. Defaults to true.

--skip-system (Optional)

[String] When true projects whose lifecycle state is not ACTIVE (e.g. DELETE_REQUESTED) are skipped. Defaults to true.

--help

Lists all the options and their usages.

Example usage

Example 1: List the projects that would be affected (dry-run)

./enable-serviceusage.sh --org-id 123456789012

Example 2: Enable the Service Usage API on every project

./enable-serviceusage.sh --org-id 123456789012 --dry-run false

Example 3: Enable a different service

./enable-serviceusage.sh --org-id 123456789012 --service compute.googleapis.com --dry-run false

Example 4: Enable multiple services at once

./enable-serviceusage.sh --org-id 123456789012 \
  --service serviceusage.googleapis.com,orgpolicy.googleapis.com --dry-run false

Notes

  • The script discovers projects at any depth in the org. It walks the organization's folder tree (folders only, via gcloud resource-manager folders list) to build the full set of parent containers, then filters the project list locally by parent id. This covers folder-nested projects that a plain parent.id=<org> filter would miss, and avoids the Cloud Asset API (which requires a usable quota project).
  • It only sees projects the authenticated account has permission to list. Projects in the org that the caller cannot access are silently absent.
  • Enabling a service is idempotent — re-running on a project that already has the API enabled is a no-op.