GCP Cloud Architect key terms

A tree of organizations, folders, and projects that holds all Google Cloud resources, so permissions and policies set higher up are inherited by everything beneath them.

A guardrail defined at organization, folder, or project level that blocks or limits specific configurations, such as public IP addresses or allowed services, across many projects at once.

A global, software-defined network that holds subnets in one or more regions and controls routing and firewall rules for the resources attached to it.

A design where one host project owns the network and subnets while other service projects attach their resources to it, giving central network control with delegated deployment.

A private connection between two VPC networks, in the same or different organizations, that lets their resources reach each other using internal IP addresses without gateways or the public internet.

A way to reach Google APIs or third-party services through a private IP endpoint inside your own VPC, so traffic never leaves Google's network.

A managed service that distributes incoming traffic across backends using global or regional proxies, with health checks and options for HTTP(S), TCP, UDP, and internal-only balancing.

A dedicated or partner-provided private connection between your on-premises network and Google's network, offering more consistent latency and bandwidth than internet-based VPN.

The system that decides who can do what on which resource, by binding principals such as users, groups, and service accounts to roles that grant permissions.

A non-human identity owned by a project that workloads use to authenticate to Google Cloud APIs; it receives roles like a user and is authenticated with keys or attached identities.

A method that lets workloads running outside Google Cloud, such as in AWS or Azure, obtain short-lived Google Cloud credentials by exchanging their own identity tokens instead of using service account keys.

A managed key service where you create and control encryption keys; customer-managed encryption keys let you encrypt Google Cloud data with keys you own and can rotate or revoke.

A security perimeter around Google Cloud services that prevents data from being copied outside the perimeter, blocking access from unauthorized networks even when credentials are valid.

A service that filters traffic reaching external load balancers using allow and deny rules, IP lists, and web application firewall rules to block attacks such as denial-of-service floods.

A service that checks user identity and request context before letting traffic reach an application or VM, enabling access to internal apps without a VPN or public IP.

A service that applies controls such as data residency, personnel access limits, and compliance frameworks to a folder so regulated workloads meet specific regulatory requirements.

Rules attached to a bucket that automatically change an object's storage class, or delete it, after a set age or condition, lowering cost for data that ages predictably.

A group of identical VMs that Compute Engine creates, repairs, and resizes based on load, using policies such as CPU target or schedule to match capacity to demand.

Describing infrastructure in version-controlled configuration files so deployments are repeatable, reviewable, and consistent; the Terraform Google provider is the common tool for this.

Limits on how much of a resource, such as CPUs or API calls, a project can consume; some are fixed, others can be raised by request, and hitting one blocks new usage.

A managed continuous integration service that runs build steps in containers to compile, test, and produce artifacts, triggered by source changes or schedules.

A managed continuous delivery service that promotes releases through an ordered set of targets, such as test then production, and can require approvals between stages.

Release patterns where a new version reaches a small share of traffic first (canary) or runs alongside the old one before switching (blue-green), limiting the blast radius of a bad release.

A service that replicates servers from on-premises or other clouds and runs them as Compute Engine instances, so existing workloads move without being rebuilt.

A managed tool that copies large datasets into Cloud Storage from other clouds, HTTP endpoints, or on-premises file systems, with scheduling and integrity checks.

A service that inventories existing infrastructure and estimates the cost and effort of moving workloads to Google Cloud, producing a total cost of ownership comparison.

A messaging service where publishers send messages to a topic and subscribers receive them asynchronously, decoupling services and absorbing spikes in traffic.

A service that routes events from Google Cloud sources, and from custom applications, to targets such as Cloud Run or Cloud Functions, so code reacts to changes.

A managed Kubernetes service where Google runs the control plane and you run containerized workloads on node pools that can autoscale and be upgraded automatically.

A serverless platform that runs containers handling HTTP requests or events, scaling to zero when idle, with no cluster or servers for you to manage.

A serverless data warehouse that runs SQL over very large datasets using columnar storage and a separated compute layer, billed by data scanned or reserved capacity.

A globally distributed relational database that offers strong consistency, horizontal scaling, and high availability through synchronous replication across regions.

Recovery time objective is how long a service may stay down after a failure; recovery point objective is how much data loss is acceptable. Together they drive backup and replication design.

Observability services that collect metrics, dashboards, alerts, and log entries from Google Cloud and hybrid resources, forming the basis for detecting and diagnosing problems.

A service level indicator is a measured signal such as latency or availability; the objective is its target; the error budget is the allowed shortfall before reliability work takes priority.

Diagnostic tools that show where requests spend time across services (Trace) and which code paths consume the most CPU or memory (Profiler), helping find performance bottlenecks.

A service that records the resources, policies, and relationships in your projects over time, supporting audits, compliance checks, and change analysis across the organization.

A service that analyzes usage and configuration and suggests concrete changes, such as resizing underused VMs or granting narrower roles, with the estimated impact of each.

Price reductions in exchange for committing to a steady amount of vCPU, memory, or other resource for one or three years, best suited to predictable baseline workloads.

Tools that alert you when spend crosses thresholds and export detailed cost and usage data to BigQuery or files, so you can attribute and forecast costs.