ACE-Associate key terms

The top-level organizing container in Google Cloud that owns all resources, billing, and APIs. Every resource belongs to exactly one project, which acts as the boundary for quotas, permissions, and enablement.

A node in the resource hierarchy used to group projects for shared policy and administration. Folders sit between the organization and projects and inherit settings from above while applying them downward.

The root node of the Google Cloud resource hierarchy, tied to a company domain or identity provider. It enables centralized control, policy inheritance, and oversight across all folders and projects beneath it.

A payment entity that pays for resources consumed by one or more projects. Linking projects to a billing account enables charges, budgets, and cost tracking across the organization.

A limit on how much of a resource or API usage a project may consume, such as CPUs or requests per minute. Quotas protect both the platform and the customer from unexpected consumption.

The system that controls who can do what on which resources. It works by binding principals to roles on a resource, and those grants are inherited down the resource hierarchy.

An identity that can be granted access, such as a user account, group, service account, or domain. Principals receive permissions only through role bindings in an IAM policy.

A named collection of permissions that can be granted to a principal. Roles come as basic, predefined, or custom and define the actions a principal may perform on resources.

A granular authorization to perform a specific action on a resource, expressed in service.resource.verb form. Permissions are never granted directly to users but are bundled inside roles.

The document attached to a resource that lists bindings between principals and roles. It determines effective access together with inherited policies from parent resources in the hierarchy.

A non-human identity used by workloads, applications, and virtual machines to authenticate to Google Cloud APIs. It is identified by an email address and can be granted roles like any user.

A downloadable credential file that lets a workload authenticate as a service account from outside Google Cloud. Keys are long-lived secrets and should be rotated or replaced with workload identity where possible.

A user-defined role containing a hand-picked set of permissions, used when predefined roles grant too much or too little. Custom roles support least privilege but require ongoing maintenance as APIs evolve.

The security principle of granting only the permissions needed for a task and nothing more. It reduces blast radius from mistakes or compromise and is implemented through careful role selection and scoping.

The behavior where IAM grants on a parent resource such as a folder or organization also apply to all child resources. Effective access is the union of all policies along the resource path.

A constraint applied at organization, folder, or project level that restricts how resources may be configured, regardless of IAM permissions. It enforces guardrails such as allowed regions or disabled service accounts keys.

The Google Cloud service for creating and running virtual machine instances. It offers configurable machine types, persistent disks, networking, and autoscaling for general-purpose workloads.

A reusable definition capturing machine type, image, disk, and startup configuration for virtual machines. Templates enable consistent, repeatable creation of instances and back managed instance groups.

A group of identical virtual machines created from an instance template and managed as a unit. It provides autoscaling, health checking, and automatic recreation of failed instances.

The automatic adjustment of resource capacity, such as adding or removing virtual machines, based on demand signals like CPU utilization or load balancing metrics. It balances cost against performance.

Durable block storage attached to Compute Engine instances that persists independently of the instance lifecycle. Disks can be resized, snapshotted, and reattached to other instances.

A point-in-time copy of a persistent disk stored durably and usable to restore or create new disks. Snapshots are incremental and commonly used for backup and disaster recovery.

A global, software-defined network that hosts your resources and controls IP addressing and routing. Subnets within a VPC are regional and connect resources privately.

A regional range of IP addresses within a VPC where resources such as instances are placed. Subnets can span zones in a region and have primary and secondary ranges.

A rule in a VPC that permits or denies traffic to or from instances based on direction, source or destination, protocol, port, and target tags. Rules are evaluated to control network access.

A configuration where a host project owns a VPC network and subnets while service projects attach resources to it. It centralizes network administration while letting teams manage their own workloads.

A managed service that distributes incoming traffic across backends such as instance groups for availability and scale. It supports global and regional, external and internal load balancing with health checks.

A periodic probe that verifies whether a backend is responding and able to serve traffic. Unhealthy backends are removed from load balancing rotation and can trigger instance recreation.

A container for objects in Cloud Storage with a globally unique name, a location, and a storage class. Buckets hold unstructured data and are governed by IAM and lifecycle rules.

A category of Cloud Storage bucket or object defining cost, availability, and access frequency characteristics, such as Standard, Nearline, Coldline, or Archive. Choosing appropriately balances retrieval cost against storage cost.

A bucket configuration that automatically transitions, deletes, or otherwise manages objects after conditions like age or version count are met. It reduces manual housekeeping and storage cost.

A declarative description of resources that Google Cloud Deployment Manager or similar tooling creates and manages as a unit. Deployments make infrastructure reproducible and repeatable across environments.

The practice of defining and provisioning infrastructure through version-controlled configuration files rather than manual console actions. It improves repeatability, reviewability, and consistency across environments.

The service for collecting metrics, logs-derived signals, and uptime checks, and for building dashboards and alerts. It provides visibility into the health and performance of Google Cloud and hybrid resources.

The service that ingests, stores, and queries logs from Google Cloud services and custom applications. Logs can be routed to destinations such as Cloud Storage or Pub/Sub for retention and analysis.

A routing configuration that sends matching log entries from a project, folder, or organization to a destination like Cloud Storage, BigQuery, or Pub/Sub. Sinks enable centralized retention and export.

A rule in Cloud Monitoring that triggers a notification when a metric or condition crosses a threshold. Alerts can notify channels such as email, SMS, or webhooks when incidents occur.

A synthetic probe that periodically requests a public or private endpoint to verify availability. Results feed into Cloud Monitoring dashboards and can trigger alerting policies when failures occur.

A billing configuration that tracks spending against a defined amount and sends notifications at chosen thresholds. It warns about cost overruns but does not by itself stop resource consumption.

Records of administrative activity and data access in a project, including who did what, where, and when. They support security investigation, compliance, and change tracking.