GCP ACE key terms

The nested order of organization, folders, projects, and individual resources in Google Cloud, used to organize assets and inherit IAM policies and organization policies from parent to child.

The basic container in Google Cloud that holds resources, links to a billing account, and defines boundaries for API enablement, quotas, and most IAM allow policies.

A grouping container inside an organization or another folder that lets administrators apply IAM policies and organization constraints to many projects at once.

The top of the Google Cloud resource hierarchy, created from a Cloud Identity or Google Workspace domain, giving central control over every folder and project beneath it.

A Google Cloud entity holding payment details that pays for one or more linked projects; budgets and programmatic spend exports are configured against it.

A limit on how much of a resource or API call rate you can consume in a project or region, protecting shared capacity; some quotas can be raised by request.

A browser-based shell with gcloud, kubectl, and other tools preinstalled, plus a small persistent disk, giving command-line access without any local setup.

The primary command-line tool for creating and managing Google Cloud resources, with commands grouped by service and support for output formatting and scripting.

A global virtual network that provides routing, firewall rules, and connectivity for regional subnets and the resources placed in them, whether on Google Cloud or connected on-premises.

A regional range of IP addresses within a VPC network; each subnet belongs to exactly one region, and VMs placed in it receive internal IP addresses automatically.

A stateful VPC-level rule that permits or denies traffic to or from instances based on direction, source or destination, protocol, port, and target tags or service accounts.

A configuration where one host project owns a VPC network and its subnets that other service projects attach to, centralizing network administration while letting teams manage their own resources.

A managed service that lets instances with only private IP addresses reach the internet for outbound traffic, without allowing unsolicited inbound connections from outside.

A family of managed, software-defined load balancers, global or regional and covering HTTP(S), TCP, and UDP, that distribute traffic to backends with health checking and autoscaling integration.

A globally uniquely named container for objects in Cloud Storage; its name, location, storage class, and IAM policies determine how data is stored and who can reach it.

A category applied to a bucket or object, such as Standard, Nearline, Coldline, or Archive, that trades storage price against retrieval cost and minimum storage duration.

A set of rules on a bucket that automatically changes an object's storage class or deletes it once conditions such as age, creation date, or version count are met.

A billing discount obtained by committing to a set amount of vCPU and memory usage for one or three years in a region, in exchange for a significantly lower price.

A reusable definition of VM properties such as machine type, image, disks, network, metadata, and startup script, used to create managed instance groups and individual VMs consistently.

A group of identical VMs created from an instance template that supports autoscaling, autohealing, rolling updates, and distribution across zones in a region.

A serverless CI/CD service that runs build steps in containers according to a configuration file, producing artifacts such as container images or deployable packages.

A managed repository service for storing and scanning container images and language packages, with fine-grained IAM and regional repositories; it supersedes Container Registry.

A fully managed serverless platform that runs stateless containers that respond to HTTP requests or events, scaling down to zero instances when idle.

A managed Kubernetes service where Google operates the control plane; you choose cluster mode, node pools, and versions while GKE handles upgrades and node repairs.

A named channel in Pub/Sub to which publishers send messages; subscriptions attached to the topic deliver copies to subscribers such as Cloud Run services or push endpoints.

A managed observability service that collects metrics, logs-based metrics, and uptime results, and powers dashboards, alerting policies, and notification channels.

A rule in Cloud Monitoring that opens an incident and notifies configured channels when a metric or condition crosses a threshold for a defined duration.

A configuration that routes matching log entries from Cloud Logging to destinations such as Cloud Storage, BigQuery, or Pub/Sub, using inclusion and exclusion filters.

A Cloud Monitoring probe that regularly requests a public or private URL or TCP port from multiple locations to verify that a service is reachable and responding.

An always-on audit log recording administrative operations such as resource creation or IAM changes; it is retained for 400 days, cannot be disabled, and is visible to authorized viewers.

A target level for a service level indicator, such as 99.9 percent of requests succeeding over 30 days; the error budget derives from how far actual performance sits from it.

A named collection of permissions, either basic, predefined, or custom, that can be granted to a principal; individual permissions cannot be granted on their own.

An entry that grants a role to a member such as a user, group, service account, or domain on a resource; bindings merge into the allow policy and inherit downward.

A non-human identity used by workloads and VMs to authenticate to Google APIs, identified by an email address and authenticated with keys or attached credentials.

A user-defined IAM role containing a chosen list of permissions, created at project or organization level so a workload receives exactly the access it needs.

The practice of granting identities only the permissions required for their task and nothing broader, limiting the impact of mistakes or compromised credentials.

A rule set at organization, folder, or project level that restricts how resources can be configured, such as blocking external IPs or limiting allowed locations, independent of IAM.

A managed service for creating and using cryptographic keys and key rings, supporting symmetric and asymmetric keys, rotation, and customer-managed encryption keys for other Google Cloud services.

A security perimeter that restricts access to supported Google Cloud APIs from inside a defined boundary, helping prevent data exfiltration even if credentials are stolen.