ACE key terms

The top-level container in Google Cloud that owns billing, APIs, and resources. Every resource belongs to exactly one project, and quotas and IAM policies are usually scoped to it.

A grouping node in the resource hierarchy that sits between the organization and projects. Folders let administrators apply IAM policies and constraints to many projects at once.

The root of the Google Cloud resource hierarchy, created automatically for a Google Workspace or Cloud Identity domain. Policies set here are inherited by all folders and projects beneath it.

The tree of organization, folders, projects, and individual resources. IAM allow policies and organization policies flow downward from parent to child, so placement determines inherited access.

A payment instrument that pays for charges from one or more projects. Linking a project to a billing account enables billable services; budgets and alerts are configured at this level.

A billing configuration that sends notifications when spend or forecasted spend crosses defined thresholds. Alerts only notify; they do not automatically stop resources or cap spending.

A limit on how much of a resource or API usage a project may consume, such as CPUs per region. Some quotas are enforced hard; others can be raised by request.

A geographic location, such as us-central1, containing multiple independent zones. Choosing a region affects latency, data residency, price, and which services are available.

An isolated failure domain within a region, for example us-central1-a. Distributing workloads across zones protects against single-datacenter failures and supports high availability designs.

The command-line tool for creating and managing Google Cloud resources. It supports named configurations, so one machine can switch between projects, accounts, and regions easily.

A browser-based shell with the gcloud CLI, language SDKs, and common tools preinstalled, plus temporary persistent storage. It runs with the signed-in user's credentials and is useful for quick administration.

Managing resources through declarative configuration files stored in version control rather than manual console actions. It makes environments reproducible, reviewable, and repeatable across projects.

A third-party declarative tool that provisions Google Cloud resources from configuration files and tracks state. It is widely used for repeatable, multi-resource deployments and change planning.

A Google Cloud service that deploys sets of resources from YAML or Jinja templates and tracks them as a single deployment. It supports previewing changes before applying them.

The infrastructure-as-a-service offering that provides configurable virtual machines with selectable machine types, disks, images, and networking. Instances can be created, started, stopped, and resized.

A reusable definition of virtual machine properties, such as machine type, image, and startup script. Managed instance groups use templates to create identical or versioned instances.

A group of identical virtual machines managed as one unit, supporting autoscaling, health checks, and rolling updates. Regional groups spread instances across zones for availability.

A policy that adds or removes instances in a managed instance group based on signals such as CPU utilization, load balancing serving capacity, or a schedule. It helps match capacity to demand.

Durable block storage attached to Compute Engine instances. Disks are zonal or regional, can be resized, and can be snapshotted for backup or for creating new disks.

A point-in-time copy of a persistent disk stored durably and usable to create new disks. Snapshots support backup, cloning, and moving data between zones or regions.

A global, logically isolated network that holds subnets, routes, and firewall rules. VPC networks connect resources across regions and can be shared across projects.

A regional range of IP addresses within a VPC network. Subnets have primary and secondary ranges, and instances in them receive internal addresses automatically.

A VPC-level rule that allows or denies traffic to or from instances based on direction, source or destination, protocol, port, and target tags or service accounts.

A label attached to an instance that firewall rules and routes can target. Tags make it possible to apply consistent network policy to groups of instances without naming each one.

A configuration where a host project owns a VPC network and subnets, and one or more service projects deploy resources into them. Central networking teams keep control of the network.

A globally unique container for objects in Cloud Storage. Its name, location, storage class, and access controls determine where data lives and who can read or write it.

A set of rules on a Cloud Storage bucket that automatically changes an object's storage class or deletes it when conditions such as age or version count are met.

A time-limited URL that grants temporary access to a Cloud Storage object without requiring the requester to have a Google account or IAM role.

A collection of permissions that can be granted to a principal. Basic roles are broad, predefined roles are service-specific, and custom roles are user-defined permission sets.

The rule that IAM allow policies set on a parent resource also apply to all descendants. Effective access is the union of grants along the path from organization to resource.

The security practice of granting each principal only the permissions needed for its task, and only for as long as needed. It reduces the blast radius of mistakes or compromised credentials.

A special identity intended for workloads and automation rather than people. It authenticates with keys or attached credentials and is granted IAM roles like any other principal.

A periodic probe that determines whether a backend or instance is healthy. Load balancers use it to route traffic away from unhealthy backends, and instance groups use it for repair.

The observability service for collecting metrics, logs-based metrics, dashboards, uptime checks, and alerting policies across Google Cloud and hybrid resources.

A Cloud Monitoring rule that fires when a condition on a metric or log is met, then notifies configured channels such as email, SMS, or webhooks.

The service that stores, searches, and routes log entries from Google Cloud and custom sources. Log sinks export entries to destinations such as Cloud Storage or Pub/Sub.

A Cloud Logging configuration that routes matching log entries to a destination such as a Cloud Storage bucket, BigQuery dataset, or Pub/Sub topic for retention or analysis.

Google Kubernetes Engine, a managed control plane for running containerized workloads. Node pools, autoscaling, and upgrades are handled with less operational overhead than self-managed clusters.