GCP ACE cheat sheet

Resource hierarchy order is Organization > folders > projects > resources; IAM allow policies are inherited downward, and a child policy cannot revoke a parent grant.

A project belongs to exactly one organization or to no organization; folders can nest and can contain projects or other folders.

A project can be linked to at most one billing account, while one billing account can pay for multiple projects; budgets and alerts attach to billing accounts or projects.

Running gcloud config set project PROJECT_ID changes the default project for subsequent gcloud commands; it does not grant IAM permissions.

Quotas are enforced per project and per region: allocation quotas cap resource counts, rate quotas cap API call rates, and increases are requested in the console.

Cloud Identity provides identity, group, and endpoint management without Google Workspace collaboration apps; Google Groups can be granted IAM roles.

Labels are key-value pairs used for cost allocation, filtering, and automation; tags are key-value pairs used in IAM conditions and firewall targeting.

Enabling an API is per project; the API must be enabled in the project where the dependent resources are created.

gcloud configurations are named profiles; gcloud config configurations activate NAME switches the default project, account, and region settings.

A VPC network is global while its subnets are regional; resources in different regions of the same VPC communicate over internal IP addresses.

VPC firewall rules are stateful and evaluated by priority; a lower number means higher priority, with implied deny ingress and allow egress rules.

Region choice is driven by latency, data residency, and service availability; zones within a region are independent failure domains.

Cloud Storage classes are Standard, Nearline with a 30-day minimum, Coldline with 90 days, and Archive with 365 days; early deletion incurs prorated charges.

Cloud SQL regional high availability uses a standby in a second zone with synchronous replication and automatic failover; read replicas serve read scaling.

Committed use discounts require a 1- or 3-year commitment for steady usage; sustained use discounts apply automatically to qualifying monthly Compute Engine usage.

BigQuery partitioning divides tables by date, timestamp, or integer range; clustering sorts data within partitions to reduce bytes scanned by filtered queries.

Load balancer selection: global external Application LB for HTTP(S) across regions; regional external proxy Network LB for TCP or SSL; passthrough Network LB preserves client IP.

A Cloud Storage bucket location is immutable after creation; regional locations reduce latency, multi-region locations increase availability, and dual-region uses two specific regions.

gcloud app deploy app.yaml creates a new App Engine version and routes traffic according to promotion settings such as --promote or --no-promote.

gcloud run deploy SERVICE --image IMAGE creates or updates a Cloud Run revision; --allow-unauthenticated permits public invocation of the service.

GKE Autopilot manages nodes, scaling, and infrastructure; users deploy pods and billing is based on requested CPU and memory.

Artifact Registry stores container images and language packages, integrates with IAM, and supports vulnerability scanning; it succeeds Container Registry.

Cloud Build runs each step in cloudbuild.yaml as a container; substitutions provide variables and triggers start builds from repository events.

terraform plan previews changes by comparing configuration with state and real resources; terraform apply creates, updates, or deletes resources to match configuration.

Pub/Sub publishers send messages to a topic, and each subscription receives a copy; default delivery is at-least-once and governed by the acknowledgment deadline.

Deployment Manager uses YAML, Jinja, or Python templates; a preview creates resources in a dry-run mode before an update is applied.

kubectl apply -f manifest.yaml declaratively creates or updates GKE resources, while kubectl get pods lists pods in the current namespace.

Cloud Monitoring uptime checks probe endpoints from multiple locations; an alerting policy fires after a configured failure duration.

Log sinks route entries to Cloud Storage, BigQuery, Pub/Sub, or another project; inclusion and exclusion filters control which entries are routed.

Admin Activity and System Event audit logs are always enabled; Data Access audit logs are disabled by default and must be explicitly enabled for most services.

An SLO specifies a target and a rolling or calendar window; the error budget equals 1 minus the SLO target.

Error Reporting aggregates and groups application exceptions from logs; it can alert on new error groups but is not a general metrics store.

Billing export to BigQuery writes detailed cost and usage data into datasets; queries over these tables support cost analysis and chargeback.

Cloud Monitoring metrics are time series; dashboards and alerting policies use metric filters, aggregation, and alignment.

gcloud logging read queries entries with filters, and gcloud logging sinks create creates a sink at project, folder, or organization level.

The Ops Agent collects metrics and logs from Compute Engine VMs and replaces the legacy monitoring and logging agents.

An IAM allow policy binds members to roles on a resource; allow policies are additive and inherited down the hierarchy, while deny policies can override allows.

Basic roles Owner, Editor, and Viewer are broad and legacy; predefined roles are service-specific, and custom roles use an explicit permission list.

A service account is an identity for workloads; attaching a service account to a resource supplies credentials through the metadata server.

Service account keys are long-lived secrets; attached service accounts, Workload Identity Federation, and short-lived tokens avoid downloaded key files.

IAM conditions are CEL expressions on role bindings that limit when a grant applies, based on resource, request, or time attributes.

VPC Service Controls define a service perimeter that restricts access to supported services and helps reduce data exfiltration; they are not network firewalls.

Cloud KMS manages key rings and keys; CMEK lets supported services use customer-managed keys, and envelope encryption uses a DEK wrapped by a KEK.

Organization Policy constraints apply at organization, folder, or project level and restrict configurations such as allowed locations or public IP addresses.

Cloud Audit Logs record Admin Activity, Data Access, System Event, and Policy Denied events; Data Access logs usually require explicit enablement.