ACE flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Project ID

A globally unique, immutable identifier assigned when a project is created. It appears in API calls and resource names and cannot be changed after creation.

Resource hierarchy inheritance

IAM policies granted at Organization or Folder level apply to every descendant project and resource. Access is additive down the tree, so a lower-level deny cannot override an inherited allow.

Enabling APIs

Google Cloud services are disabled per project by default. A billable API must be enabled, and billing linked, before its resources can be created or called.

gcloud configurations

Named sets of properties such as account, project, and zone. Creating separate configurations lets one workstation switch contexts without overwriting defaults.

Billing budget alerts

Budgets track spend against a threshold and send notifications. They do not stop resources or cap spending; stopping requires automation triggered by Pub/Sub budget messages.

Quota versus rate limit

Quotas cap total resource allocation per project and region, while rate limits cap requests per time interval. Both are per project and increases are requested, not automatic.

Folder purpose

Folders group projects for shared policy and administration, such as separating departments or environments. IAM and Organization Policy set on a folder affect all contained projects.

Region and zone choice

Regions determine latency, data residency, and available services. Zones are isolated failure domains within a region; zonal resources fail if their zone becomes unavailable.

Cloud Run versus GKE

Cloud Run runs stateless containers with automatic scaling and no cluster management. GKE is chosen when you need orchestration control, daemonsets, or complex scheduling.

Storage class minimum duration

Nearline, Coldline, and Archive objects incur a minimum storage duration of 30, 90, and 365 days. Deleting earlier bills the remainder as an early deletion charge.

Regional managed instance group

A MIG spread across zones in one region. It maintains instance count, self-heals unhealthy instances, and autoscales, while surviving the loss of a single zone.

Global VPC scope

A VPC network is global while its subnets are regional. Resources in different regions can communicate over internal IPs within the same VPC without extra gateways.

Alias IP ranges

Secondary subnet ranges assigned to GKE pods and services. They keep pod traffic inside the VPC and allow firewall rules to target pods separately from nodes.

Cloud SQL high availability

A regional configuration runs a standby instance in another zone with synchronous replication. On primary failure, failover promotes the standby with a brief connection interruption.

Spanner selection criteria

Choose Spanner when you need horizontal write scaling, global strong consistency, and high availability beyond a single region, which Cloud SQL cannot provide.

Passthrough network load balancer

A regional load balancer that forwards packets without terminating the connection, preserving client source IP. Suitable for non-HTTP protocols and TCP/UDP traffic.

Infrastructure as code

Describing resources in versioned configuration files such as Terraform so environments are reproducible, reviewable, and recoverable rather than built by manual console steps.

Uptime check

A Cloud Monitoring probe that requests a URL or TCP endpoint from multiple global locations and alerts when responses fail or exceed configured thresholds.

Logs Router sink

A rule that routes matching log entries to a destination such as Cloud Storage, BigQuery, or Pub/Sub. Inclusion and exclusion filters decide which entries are exported.

Data Access audit logs

Logs recording reads and writes of resource data. They are disabled by default, must be enabled per service, and can generate significant logging charges.

Error budget

The allowed amount of unreliability, computed as one minus the SLO target. If an SLO is 99.9 percent, the error budget is 0.1 percent of the window.

Ops Agent

The unified agent for Compute Engine that collects system metrics and logs and sends them to Cloud Monitoring and Cloud Logging, replacing separate legacy agents.

Canary deployment

Releasing a new version to a small fraction of traffic first, then monitoring error rates before widening. Limits blast radius and allows fast rollback.

Committed use discount

A discount in exchange for committing to a spend or resource amount for one or three years. Best for predictable, steady workloads rather than spiky usage.

Alerting policy

A Cloud Monitoring rule combining a condition on a metric or log, a duration, and notification channels. It fires incidents when the condition is met.

Audit log retention

Admin Activity logs are always enabled and kept 400 days in the _Required bucket. The _Default bucket retains other logs 30 days unless a custom bucket is used.

IAM role types

Primitive roles are broad Owner, Editor, Viewer. Predefined roles are service-specific and curated. Custom roles are user-defined permission sets for least privilege.

Service account key risk

Exported JSON keys are long-lived credentials that can be leaked. Prefer Workload Identity Federation or attached service accounts over downloadable keys.

IAM condition

An optional expression attached to a role binding that limits when it applies, using attributes such as resource name, request time, or access level.

Firewall rule priority

Rules are evaluated by priority, where a lower number wins. VPCs have implied deny-ingress and allow-egress rules that apply when nothing else matches.

Shared VPC

A host project owns the network and subnets; service projects attach and deploy resources into them. IAM on subnets controls which service project identities may use them.

Private Google Access

A subnet setting letting instances without external IPs reach Google APIs and services through internal routing, avoiding exposure to the public internet.

CMEK versus CSEK

CMEK encrypts with Cloud KMS keys you control and Google manages. CSEK uses keys you supply per request, which Google does not store, so loss means data loss.