GCP Cloud Architect cheat sheet

Resource hierarchy is Organization > Folders > Projects > Resources; IAM allow policies inherit downward and a child policy cannot revoke a permission granted by an ancestor.

Choose a region by latency to users, data residency requirements, and service availability; use multi-region configurations when the design must exceed 99.99% availability.

Compute decision rule: GKE for containerized microservices needing portability, Cloud Run for stateless HTTP containers with scale-to-zero, Compute Engine for OS-level control or licensed software, App Engine for standard runtimes.

Storage decision rule: Cloud Storage for object data, Filestore for NFS shares, Persistent Disk for block storage, BigQuery for analytical SQL over large datasets.

Database decision rule: Cloud SQL for regional relational workloads with standard engines, Spanner for globally consistent horizontal scale, Firestore for mobile/web document data, Bigtable for high-throughput wide-column time series.

Availability of serial dependencies multiplies: 0.999 x 0.999 = 0.998; adding independent redundant paths reduces single points of failure rather than multiplying them.

A VPC is global while subnets are regional; Shared VPC lets a host project supply subnets to service projects so network administration stays centralized.

Quotas are enforced per project per region; request increases before deployment and use organization policies to constrain which resource types and locations teams may create.

Terraform is declarative: terraform plan shows the diff, terraform apply converges, and remote state belongs in a Cloud Storage backend with versioning and locking enabled.

Deployment Manager is the GCP-native IaC service (YAML, Jinja, Python templates); Terraform is preferred when multi-provider support and a large module ecosystem matter.

Config Connector manages Google Cloud resources through Kubernetes manifests, enabling GitOps for infrastructure in the same repo as workloads.

Cloud Build executes cloudbuild.yaml steps and triggers on commits to connected repositories; the same pipeline can deploy to GKE, Cloud Run, or App Engine.

IaC promotion path: plan, policy validation, apply in non-production, manual approval, apply in production; keep one state file per environment.

Private Google Access lets VM instances with no external IP reach Google APIs over internal routes; Private Service Connect creates private endpoints to supported services.

Migrate to Virtual Machines handles lift-and-shift VM migration; Database Migration Service handles MySQL, PostgreSQL, and SQL Server moves to Cloud SQL.

Labels are key-value pairs used for billing and filtering; network tags are string identifiers matched by firewall rules and routes; the two are not interchangeable.

Apply least privilege: prefer predefined roles over basic Owner/Editor/Viewer, use custom roles when predefined roles are too broad, and remember deny policies override allow policies.

Create a user-managed service account per workload; avoid the default compute service account with Editor, use Workload Identity for GKE pods, and impersonate rather than export key files.

Encryption at rest is on by default with Google-managed keys; CMEK moves key control and rotation to Cloud KMS, and CSEK keeps the key entirely customer-held.

VPC Service Controls perimeters block data exfiltration by denying access to protected services from outside the perimeter, even when the caller holds valid credentials.

For hybrid connectivity use HA VPN (99.99% SLA with two tunnels) or Cloud Interconnect; both can be combined for redundancy across paths.

Enforce data residency with location organization policies and use Assured Workloads folders for regulated regimes such as FedRAMP, IL4, CJIS, or HIPAA.

Admin Activity audit logs are always on; Data Access logs are off by default and must be explicitly enabled; VPC Flow Logs capture network traffic metadata for forensics.

Store API keys and passwords in Secret Manager, never in source code, container images, or instance metadata.

Define SLI (measured indicator), SLO (internal target), and SLA (contractual commitment) in that order; the error budget equals 1 minus the SLO.

Alert on multi-window, multi-burn-rate error budget consumption rather than raw thresholds to reduce false pages.

Cost tooling: budgets with alert thresholds, billing export to BigQuery for queryable cost data, and Recommender for idle resources and rightsizing.

Sustained use discounts apply automatically to qualifying monthly Compute Engine usage; committed use discounts trade a 1- or 3-year commitment for a larger reduction.

Spot VMs cost far less than on-demand but can be reclaimed with 30 seconds notice, so use them only for fault-tolerant batch or stateless work.

Object lifecycle rules transition or delete by age: Nearline at 30 days, Coldline at 90 days, Archive at 365 days; Autoclass can move objects between classes automatically.

BigQuery cost control: partition and cluster tables, avoid SELECT *, use dry runs to estimate bytes scanned, and use flat-rate slots for predictable heavy workloads.

Network charges follow zone and region boundaries: same-zone traffic is free, internet egress is billed, and Cloud CDN plus Private Google Access reduce egress volume.

Reference pipeline: source repository, Cloud Build trigger, Artifact Registry image, Cloud Deploy promotion to GKE or Cloud Run targets.

Deployment strategy trade-offs: rolling update is default and cheapest, blue/green switches instantly but doubles running cost, canary limits blast radius with percentage traffic.

Use separate projects per environment (development, staging, production) so IAM boundaries, quotas, and billing stay isolated.

Cloud Deploy targets can require manual approval before production; rollback is performed by redeploying the previously successful release.

Migration sequence is assess, plan, migrate, optimize; Migration Center provides discovery inventory and TCO estimates before cutover.

For hybrid or multi-cloud fleets, GKE Enterprise plus Anthos Config Management applies the same configuration and policy from Git to every cluster.

All infrastructure changes flow through IaC and code review so every change is auditable and reversible; tag release artifacts in Artifact Registry.

Validate releases with automated tests in the pipeline and with Cloud Deploy deployment verification that analyzes canary metrics before full rollout.

Observability stack mapping: Cloud Monitoring for metrics and alerting, Cloud Logging for logs, Cloud Trace for latency, Error Reporting for exceptions, Profiler for CPU and heap.

Define SLOs in Cloud Monitoring with uptime checks and burn-rate alerting policies so degradation pages before users are widely affected.

Log buckets default to 30-day retention and are configurable up to 3650 days; route logs to BigQuery, Cloud Storage, or Pub/Sub with sinks and use exclusion filters to cut cost.

DR strategies in increasing cost and decreasing RTO: backup and restore, pilot light, warm standby, multi-site active-active; select from the required RPO and RTO.

Backup and DR Service centralizes backup policy for Compute Engine, GKE, and VMware workloads; dual-region buckets with turbo replication minimize replication lag.

Autoscaling layers: managed instance group autoscaler for VMs, GKE cluster autoscaler for nodes plus HPA/VPA for pods, Cloud Run concurrency for requests.

Self-healing relies on health checks: MIG autohealing recreates failed VMs, and GKE liveness and readiness probes restart or gate traffic to unhealthy pods.

Operational readiness is proven by periodic game days, chaos experiments, and DR failover tests backed by written runbooks.

Incident practice: blameless postmortems, tracked action items, and on-call rotations keep mean time to recovery trending downward.