Introduction to the Resource Manager

The STACKIT Resource Manager employs a hierarchical structure to organize resources, using organizations, folders, and projects as resource containers. This tree-like structure, with organizations at the root, allows for clear organization and flexible, fine-grained access control.

Resource hierarchy

The following graph shows the allowed relationships.

The following table shows the hierarchical structure of resources in STACKIT, detailing the purpose and constraints of each management level from the top-level customer account down to individual provisioned resources:

Level	Purpose / Scope	Can contain	Unique constraints
Customer account	Billing ownership, contractual identity, top-level IAM governance	One (1) organization	Always 1:1 with exactly one organization
Organization	Root of the technical resource hierarchy	Folders (optional), Projects	Cannot be moved or replaced; life cycle controlled
Folder (optional)	Single-layer logical grouping of projects (no nesting)	Projects	Single layer only; cannot be nested
Project	Run and configuration boundary for services	Resources	Cannot move across organizations or sibling folders
Resource	A provisioned service instance (IaaS / PaaS / SaaS)	–	Always belongs to exactly one project

Customer accounts

A customer account represents the contractual and billing entity. User management, billing references, and account-wide governance policies originate here.

It always owns exactly one organization which is created automatically once the account is approved.

Learn more about customer accounts.

Organizations

The organization is the top-level technical scope. It anchors all resource groups (folders) and running domains (projects).

Projects and resources inherit contextual metadata (for example, labels, internal and external flags) from their parent organization through the hierarchy.

Learn more about organizations.

Folders (optional)

With folders, you group projects, for example by department, environment, or region.

They are single-layer only: a folder cannot contain other folders.

Folders are only available if the feature is enabled for the organization.

Projects

A project is the boundary for provisioning cloud services. All resources are created inside a project and inherit quota, billing reference, and the IAM context.

Learn more about projects.

Resources

Resources are concrete service instances, for example databases, compute, or network objects. Each resource:

• Belongs to exactly one project.
• Consumes quota.
• Is subject to IAM permissions inherited through project and organization membership.

Access control

Roles and permissions control what you can see and what actions you’re allowed to perform at each hierarchy level.

Learn more about roles and permissions.