ACE cheat sheet

A Google Cloud project is the fundamental resource container; it is created under exactly one Organization node and inherits policy from that hierarchy.

Resource hierarchy order: Organization > Folders > Projects > Resources. IAM policies are additive down the tree; a grant at a higher node applies to all descendants.

Billing must be linked to a project before most billable APIs can be enabled; an unlinked project can still hold resources but cannot call paid services.

Projects are identified by three values: project name (mutable, display only), project ID (globally unique, immutable), and project number (auto-assigned, immutable).

APIs and services are disabled by default per project; enable them with gcloud services enable or the console API Library before first use.

gcloud config set project changes the active project for the current configuration; gcloud config configurations create manages separate named contexts.

Quotas are per-project, per-region limits (rate and allocation); increases are requested through the console Quotas page and are not automatic.

Cloud Billing budgets and alerts notify at thresholds but do not cap or stop spending; programmatic caps require Pub/Sub-triggered automation.

gcloud init performs authentication, configuration selection or creation, and default project and region/zone selection in one guided flow.

Choose a region for latency, data residency, and service availability; choose zones within the region for fault isolation (zonal resources fail with one zone).

Compute decision rule: managed containers (Cloud Run) for stateless HTTP services; GKE for orchestration control; Compute Engine for full OS control or licensed/stateful workloads.

Storage decision rule: Cloud Storage for object data; Persistent Disk for block storage attached to one VM; Filestore for managed NFS shared across many clients.

Cloud Storage classes trade retrieval cost for storage cost: Standard > Nearline (30-day min) > Coldline (90-day min) > Archive (365-day min); early deletion incurs charges.

Cloud SQL provides managed MySQL, PostgreSQL, and SQL Server with regional HA via a standby; Spanner is chosen when horizontal scale and global strong consistency are required.

VPC networks are global; subnets are regional. A subnet's primary range plus secondary ranges support alias IPs used by GKE pods and services.

Load balancer selection: global external Application LB for HTTP(S) across regions; regional external proxy Network LB for TCP/SSL; passthrough Network LB preserves client source IP.

Managed instance groups with autoscaling and health checks provide self-healing; use regional MIGs to survive a zone failure.

Deployment should be reproducible: define infrastructure with Terraform or Deployment Manager and store configuration in version control rather than console-only changes.

Cloud Monitoring collects metrics, uptime checks, and dashboards; Cloud Logging stores logs; alerting policies route to notification channels such as email, SMS, or Pub/Sub.

Logs Router sinks export logs to Cloud Storage, BigQuery, or Pub/Sub; inclusion and exclusion filters determine which entries are routed and which are dropped.

Log retention: _Default bucket retains 30 days by default; _Required retains 400 days for admin activity and is not deletable; custom buckets set their own retention.

Audit log types: Admin Activity (always on, free), Data Access (disabled by default, billed), System Event, and Policy Denied.

A service level objective combines an SLI (metric) with a target percentage over a window; an error budget is 1 minus the SLO target.

Snapshot schedules automate Persistent Disk backups; for Cloud SQL use automated backups plus point-in-time recovery via binary/binlog or WAL archiving.

Stackdriver-era agents are replaced by the Ops Agent, which collects system metrics and logs from Compute Engine instances in one package.

Deployment strategies: rolling update replaces instances gradually; canary sends a small traffic share first; blue/green switches traffic between two full environments for instant rollback.

Cost control levers: committed use discounts for steady load, sustained use discounts applied automatically, preemptible/Spot VMs for fault-tolerant batch, and rightsizing recommendations.

IAM policy binding = member + role + resource. Roles are primitive (Owner, Editor, Viewer), predefined, or custom; prefer predefined least-privilege roles over primitive.

A service account is both an identity and a resource; grant it roles, attach it to workloads, and avoid exporting long-lived JSON keys in favor of Workload Identity Federation.

IAM conditions add attribute-based constraints (resource name, time window, request attributes) to a binding, narrowing when the grant applies.

VPC firewall rules are stateful and evaluated by priority (lower number = higher priority); implied rules allow egress and deny ingress by default.

Shared VPC centralizes networking: a host project owns subnets and the network, service projects attach and consume them; IAM controls who can use each subnet.

Private Google Access lets VM instances without external IPs reach Google APIs; Private Service Connect provides private endpoints to Google and third-party services.

Cloud KMS key hierarchy: key ring > key > key version. Rotation creates a new primary version; old versions remain for decryption of existing ciphertext.

Encryption at rest is default with Google-managed keys; CMEK uses Cloud KMS keys, and CSEK uses customer-supplied keys that Google does not store.

Organization Policy constraints (for example restricting external IPs or allowed locations) enforce guardrails across all projects regardless of IAM grants.