ACE-Associate cheat sheet

Google Cloud resource hierarchy: Organization → Folders → Projects → Resources; IAM policies inherit downward from the nearest ancestor.

A project is the base unit for enabling APIs, billing linkage, and quota; a resource belongs to exactly one project.

Billing is attached to a project via a Billing Account; a project without an active billing account cannot use billable services.

gcloud config set project sets the default project for subsequent gcloud commands in the active configuration.

Cloud SDK configurations are named profiles; gcloud config configurations create and activate switch between them.

APIs must be enabled per project before use: gcloud services enable <api>.googleapis.com.

Default VPC networks auto-create a subnet per region with a /20 range; custom mode networks start with no subnets.

Cloud Identity or Workspace provides the identity source for an Organization node; a consumer Gmail account has no Organization.

Quotas are per-project and per-region; quota increases are requested through the console or gcloud services quota tooling.

Compute choice rule: managed containers → Cloud Run/GKE; VMs → Compute Engine; serverless functions → Cloud Functions.

Storage choice rule: object → Cloud Storage; block → Persistent Disk; shared file → Filestore; relational → Cloud SQL/Spanner.

Cloud Storage classes: Standard, Nearline (30-day min), Coldline (90-day min), Archive (365-day min); early deletion incurs charges.

Cloud Storage durability is designed for 11 nines; regional buckets keep data in one region, multi-region buckets replicate across a continent.

Cloud SQL supports MySQL, PostgreSQL, and SQL Server; Spanner provides global strong consistency with horizontal scale.

BigQuery is serverless columnar analytics; partitioning and clustering reduce bytes scanned and therefore query cost.

Managed instance groups with autoscaling use instance templates; regional MIGs spread instances across zones for availability.

Load balancer rule: global external HTTP(S) for L7 across regions; regional external passthrough Network LB for L4 TCP/UDP.

Deployment repeatability: Infrastructure as Code (Terraform/Deployment Manager) plus CI/CD pipelines; immutable images via Container Registry/Artifact Registry.

Cloud Monitoring collects metrics, uptime checks, and dashboards; Cloud Logging stores logs in buckets with configurable retention.

Log sinks route entries to destinations (Cloud Storage, BigQuery, Pub/Sub) using inclusion/exclusion filters.

Ops Agent collects system metrics and logs from Compute Engine VMs; legacy agents are the Cloud Logging and Monitoring agents.

Alerting policies evaluate metric conditions and notify via notification channels (email, SMS, Pub/Sub, webhooks).

Service Level Indicators measure actual behavior; an SLO is an SLI target over a window; the error budget is 1 − SLO.

Managed instance group autohealing uses a health check to recreate unhealthy instances automatically.

Snapshots capture Persistent Disk state incrementally; snapshot schedules automate recurring backups.

Cloud SQL automated backups plus point-in-time recovery via binary logging/binlog enable restore to a moment in time.

Budget alerts in Cloud Billing notify at configurable thresholds but do not cap or stop spending by themselves.

IAM policy binding = member + role + resource; roles are primitive (Owner/Editor/Viewer), predefined, or custom.

Least privilege rule: grant the narrowest predefined role at the highest (closest to resource) hierarchy level that satisfies the need.

Service accounts are identities for workloads; use IAM roles or Workload Identity Federation rather than exported long-lived keys.

VPC firewall rules are stateful and evaluate on ingress/egress; rules are prioritized and a deny rule can override an allow.

Cloud Identity-Aware Proxy enforces identity checks for HTTP(S) apps and TCP forwarding without exposing external IPs.

Cloud KMS manages encryption keys; CMEK lets you supply keys for services such as Cloud Storage and BigQuery.

VPC Service Controls create a security perimeter that restricts data exfiltration across project boundaries.

Cloud Audit Logs include Admin Activity, Data Access, System Event, and Policy Denied logs; Data Access logs are off by default.

Organization Policy constraints (e.g., disabling external IPs or restricting locations) enforce guardrails across projects.