1.Intro

Ah shit, here we go again xD. This time is Google Cloud, my first time. Please prepare new trial account with 300$, we will use it for 3 months in a row. Not sure I can do what I'm aiming for (Cloud Engineer Associate + DevOps Pro). In this article, I'm mainly using resource from Udemy course and visit Associate Cloud Engineer link for me information!

Useful links:

• Train for the exam
• Exam Guide

Section of the exam:

• Section 1: Setting up a cloud solution environment (~20% of the exam)
• Section 2: Planning and configuring a cloud solution (~10% of the exam)
• Section 3: Deploying and implementing a cloud solution (~30% of the exam)
• Section 4: Ensuring successful operation of a cloud solution (~30% of the exam)
• Section 5: Configuring access and security (~10% of the exam)

2.Resource Hierarchy

Concept of project in GCP

A project is the main container for all your resources. (Ref: ResourceGroup at Azure)

Resource Hierarchy

Same like Azure, pretty familiar xD. Permissions management in GCP work with mechanism inheritance. GCP Resource Hierarchy has 4 levels: Organization, Folders, Projects and Resources.

Manage Projects

We can use this for tracking costs of specific project like this

Organization Policies VS IAM

Nothing new for me, no need to explain detailed:

• Org Policies: WHAT can be done (Example: Edit/Create a policy for resource location lock, only allow to create instance in specific location like es-east1/europe-west1.)
• IAM: WHO can do something.

API

For some services, we need to enable before use it!

Cloud Identity

WHO is the people that allow to do WHAT

• Cloud Identity: Manages the "WHO"
• IAM: Manages the "WHAT"

Best practice is manage people with group for sure, not only in GCP. For example in Elasticsearch, we create a role called data-reader that has permission to read indices kienlt-data-*, then we add right user to that role, so we don't need to create multiple role for each user or remove user from that role when they are no longer needed, pretty common practice I believe!

Asset Inventory

Inventory of everything in your GCP. Is the central catalog for every single resource in yuor GCP Org.

I remember when my boss ask me to create inventory of whole system on-premises, it would take shit load of time... But in GCP, there are already service for this shit!

Cloud Billing Account

A single billing account can pay for thoudsands of projects, centralizing financial control. And need to remember that billing accounts are "Separate" from projects in GCP (to use paid service, a project must be linked to an active cloud billing account so Google know where to send the fuckin' bill!)

Ofc, like other public cloud providers, you are able to view the cost with labels...

Other shit

• We can setting billing exports to BigQuery to analyze the costs!
• A BigQuery dry run allows you to estimate the number of bytes a query will scan, validate its syntax, and check object existence for free, without using query slots or processing data

3. IAM

Just little more detail of Cloud Identity I told above!

Impersonate

GCP IAM Impersonation example, impersonate GCP Service Account to test permission read storage. So you don't need to use serviceAccount Key Json (More fuckin' secure!)

gcloud storage ls gs://my-company-bucket \
  --impersonate-service-account=app-reader@my-project.iam.gserviceaccount.com

You feel like familiar with something in K8S? right? Yes, exactly! It is fuckin' serviceAccount in K8S. Example test serviceAccount developer-sa in namespace dev if it is able to get pods!

kubectl get pods -n dev --as=system:serviceaccount:dev:developer-sa

Fine-grained accounts

Format:

[app-name]-[env]-[purpose]-sa

And yes, fuckin' Least privileges please!

Workload vs Workforce Identity Federation

• Workforce: for human
• Workload: for machine

4. Compute & Scaling

VM Access

We can login with IAM instead of SSH or User/Password. Actually behind the scene, GCP did many many thing it in:

• OS Login
• Guest agent functionality
• Github Guest Os Login

Default Google-provided OS images already included the Guest Agent and OS Login packages come pre-installed and pre-configured. So we don't need to install them manually xD.

The OS Login Package provides the actual binaries and Linux modules that communicate with GCP (detail in Github above):

• Authorized Keys Command
• NSS Modules
• PAM(Pluggable Authentication Modules) Modules: You will like me feel like the last word "Modules" is little duplicate, but actually they are widely used. For example: ATM machine -> Automated Teller Machine machine, PDF format -> Portable Document Format format, SQL language -> Structured Query Language language. That is how we talk in common of software engineering I guess xD

Managed Instance Group (MIG)

Nothing to write here, they are almost exactly fuckin' same like Auto Scaling Group in AWS. LOL

Other shit

• Create Patch Deployment for patch management of fleet of computer engine, that will generate patch jobs

5. Google Kubernetes Engine (GKE)

This one worth to mention since this is new for me.

And yes, we have same thing in Azure + AWS:

• Azure: Azure Container Apps or AKS Automatic
• AWS: AWS Fargate (cho EKS / ECS)

K8S

This courses include some basic K8S knowledge, great for newbie I believe!

Cluster Autoscaling

Reference: About GKE cluster autoscaling

Cluster autoscaler makes these scaling decisions based on the resource requests (rather than actual resource utilization) of Pods running on that node pool's nodes. It periodically checks the status of Pods and nodes, and takes action

That is little different in GKE, so it will only add new nodes based pending (Unschedulable) pods, not CPU Utilization of Node. This works both for standard and autopilot cluster.

Workload Identity

It is the recommended, secure way for GKE pods to access GCP services. And we have same business logic in public cloud providers:

• AWS: IAM Roles for Service Accounts (IRSA)
• Azure/GCP: Workload Identity

Example and scenario: Configure Workload Identity to bind a Kubernetes service account to a Google Cloud service account. This is little long but useful, that is why I put it here

Workload Identity Federation for GKE is Google's recommended and most secure method for GKE workloads to access Google Cloud APIs. You enable Workload Identity on the cluster, create a Kubernetes service account (KSA) in your namespace, create a Google Cloud IAM service account (GSA) with appropriate Cloud Storage permissions, then bind the KSA to the GSA using IAM policy bindings. When pods run using the annotated KSA, the GKE metadata server automatically exchanges the Kubernetes token for short-lived Google Cloud credentials, allowing the pod to authenticate to Cloud Storage APIs without any keys. This eliminates key management, follows least privilege (each workload gets distinct identity), provides full audit trails, and is explicitly recommended in CIS GKE Benchmarks.

6. Serverless with Cloud Run

Cloud run services (Serverless containers)

• GCP: Cloud Run
• AWS: Fargate or App Runner
• Azure: Azure Container Apps / App Service Container

Cloud run function (Serverless functions)

• GCP: Cloud Run Functions
• AWS: Lambda
• Azure: Azure Functions

Event Trigger for function

• GCP: Eventarc or Pub/Sub
• AWS: EventBridge
• Azure: Azure Event Grid

Example with Eventarc

This is fuckin' popular example that would appear in every tutorial, LOL. When user upload an image to Cloud Storage Bucket (S3), Eventarc will catch this event and trigger Cloud Run Function to handle (resize image, extract metadata of image and write to somewhere?)

Another example would to mention: Pub/Sub will related to decoupling services (using Eventarc). Also remember, there is no fuckin' persistant data in Cloud Run Service (But mount NFS or publish data to Cloud Storage are fine xD)

7. Cloud Storage

Storage Classes

Bucket name must be globally unique. We have some storage classes like others but almost just name different, LOL:

• Standard (Hot)
• Nearline (Warm)
• Coldline (Cool)
• Archive (Cold)

And for early deletion fee. The author explained pretty well and easy to understand in this picture:

And there is little different in retrieval time of GCP vs AWS/Azure:

• Archive in GCP allow you able to read data from archive class
• AWS (S3 Glacier) / Azure (Archive Tier): ask you to wait 3 to 12 hours to retrieve data after "request restore".

Policies & Permissions

• Signed URL in GCP (GCS) = SAS Token in Azure (Blob Storage) = Presigned URL in AWS (S3)
• Delete encryption key = permanent data loss, because there is no way to decrypt files storage in bucket without key (But we have Pending deletion for key and soft delete for files in bucket. So don't worry if accident happens xD).
• Lifecycle policy management: same as other, move files from current classes to other classes or delete it for costs saving. But wait, early deletion fees STILL apply if objects are deleted or overwritten before their minimum duration (30d Nearline, 90d Coldline, 365d Archive)! Though transitions themselves are free, and Autoclass buckets are exempt from early deletion fees.
• And use lifecycle for know, autoclass for unknown. Age condition then set storage class actions.
• Autoclass ignores file size < 128Kb by default, it only transitions to Nearline (unless you configured it for Archive).
• And even with Automation, remember minimum durations: Nearline(30 days), Coldline(90 days), Archive (365 days)
• Uniform Bucket-Level access is the standard, no need legacy ACL and required to use feature like Managed Folders. And enabling Uniform bucket-level access will disable existing object-level ACLs.

Storage Transfer Service (STS)

• Use when needed for large transfers into GCS: support Cloud to Cloud or On-premises to Cloud
• Able to run directly or via scheduling, run synchronization and have data integrity for validation.

8. Managed Databases in GCP

Relational (SQL) options

• Cloud SQL: Mysql, PostgreSQL, SQL Server...
• AlloyDB: PostgreSQL by GCP, not fuckin' open source xD, like Aurora in AWS.
• Cloud Spanner: horizontally scalable Relational (SQL) database (AWS doesn't have a direct equivalent, but think of it as managed CockroachDB/YugabyteDB). Offers a signature SLA of 99.999% for multi-region (and 99.99% for single-region).

NoSQL options

• Firestore: Document database, like MongoDB. Perfect for mobile/web apps
• Bigtable: Wide-column NoSQL database, same as Apache HBase or Apache Cassandra. (Clickhouse/TiFlash are OLAP column stores, their actual GCP equivalent is BigQuery, not Bigtable).
• Use cases: IoT data, clickstreams, time-series, financial data. Massive scale, high-throughput, and low latency (TB to PB).
• Key exam points:
  • Single index: Data is only indexed by the row key.
  • Avoid Hotspotting: Sequential row keys (like raw timestamps or alphabetical ID sequences) cause traffic to hit a single node (hotspotting). Prevent this by salting (pre-pending a hash), reversing IDs, or promoting fields.
  • Dynamic scale: Storage is decoupled from compute. You can dynamically add/remove nodes to scale throughput/IOPS without downtime or data migration.
  • Storage Types: SSD (default, recommended for low-latency queries) vs HDD (recommended for large historical/archival datasets where latency isn't critical).
  • Tooling: Use the cbt CLI tool to interact with and query Bigtable.
• MemoryStore: Redis/Memcached

Backup & Recovery

Point-in-Time Recovery (PITR): A new database instance is created with a new IP address; the original instance remains untouched.

High availability and read replicas

It is just like AWS, nothing specials...

Other shit

• Want a centralized view -> go for Database Center
• AlloyDB is a fully managed PostgreSQL-compatible database service for your most demanding enterprise database workloads

Cloud Managed Services vs. Open-Source Equivalents

Not related but I want to put here, everytime I see services in AWS/GCP/Azure, I often search if there is same solution but open-source. So here is my little research:

• GCP Cloud Spanner = CockroachDB/YugabyteDB (Distributed SQL).
• AWS DynamoDB = ScyllaDB (Distributed NoSQL, Key-Value/Documents.
• Cloud-Native RDBMS: Aurora (AWS) & AlloyDB (GCP). Not multi-write, still using single master (primary node for write).

9. Big Data & Analytics Platforms

OLAP workloads. We are able to upload dataset with .csv example and query based column in csv file. They are split by ","

Dataflow is Google Cloud's fully managed, serverless service for processing large amounts of data. For example Raw Data (CSV,logs...) --> Dataflow (Transform, filter, aggregate) --> Clean Data (Ready for BigQuery)

10. Managed file storage

Filestore = managed NFS, for Linux. NetApp (NFS or SMB file services, for Window mostly!)

11. Virtual Private Cloud (VPC) Networking

Unlike AWS or Azure, a Google VPC is Global by default, remember this!

Subnet

• Subnets are regional resources. THey are Cross-zone (meaning a single subnet spans all zones within its region!)
• When IPs in subnet run out of IP, zero downtime expansion, I meaning it is able to change the subnet mask (ex: from /24 to /20) without fuckin' downtime! And yeah expand is easy but not able to shrink xD, like volumes.

Cloud NGFW

It is fuckin' stateful, meaning you only need to allow ingress and it will allow egress for you! No need a seprate egress rule.

Shared VPC

No need to talk about VPC Peering but shared VPC, one network, many projects:

• Multiple projects share the same VPC
• Centralized control by networking team
• One set of firewall rules for all

Private access to google services private

How to enable:

• Per subnet setting (you can turn it on in subnet setting)
• Internal traffic only
• Google services only.

What we can access via private services:

• Cloud Storage
• BigQuery
• Pub/Sub
• Cloud Logging & Monitoring
• Container Registry
• Artifact Registry

If you need internet access, you will need cloud NAT, hmm what about Cloud NAT:

• One Cloud Nat gateway for the fuckin' entire subnet or region.
• Auto scals to handle traffic from thousands of VMs.
• Outbound only.

12. Load Balancer

Nothing to talk much about this section, remember the different between 2 tiers: Standard vs Premium Tier:

• Standard Tier: cheaper, more hops, can not use global LB.
• Premium Tier: cost more, less hops (which mean faster, low latency).

Other shit

• When autoscaling based on Load Balancing capacity, you must first define the capacity (Maximum RPS) in the Backend Service. Once defined, configure the autoscaler to maintain a target utilization percentage (commonly 80%) of that capacity.

13. Infrastructure as Code (IaC)

LOL, first time I heard about Config Connector, you have k8s cluster running in GCP, manifest with kind Storage Bucket, kubectl apply that fuckin' file, config connector calls GCP APIs.

And Fabric FAST, ready-made landing zone for new org with pre-built terraform modules, GCP best practices, secure by default, production-ready.

AI Tooling

• Application Design Center: is a console tool that converts plain language descriptions into visual architecture diagrams and deployable Terraform code, using pre-approved, best-practice templates.
• Cloud Hub: is your unified operational dashboard, giving a single view of application health, alerts, costs, security findings, and quota usage across all your deployed applications.

14.Monitoring

Nothing much worht to mention here, except Gemini Cloud, since we sent logs, metrics to GCP and simply we only need ask Gemini what is the fuckin' wrong, it's accuracy about 70-80%. Pretty sure we need to validate it before apply xD

15. Logging

GCP Cloud logging = AWS CloudWatch Logs.

• Log Buckets are container within cloud logging. _Required bucket stores for 400 days and can not be disabled. _Default bucket stores for 30 days by default,retention can be optimized.
• Buckets are regional, a specialized, database-like engine built exclusively inside Cloud Logging.
• Log Analytics allows you to run SQL queries directly against your log data without exporting it to BigQuery.
• You can upgrade existing bucket to use Log Analytics.
• Cloud Audit Log GCP = AWS CloudTrail
• Need more metrics (Ram, disk space used, app metrics...), required to install Agent Metrics (Ops Agent).
• Cloud Trace is for tracing, find latency bottlenecks, why this shit takes 5 seconds to complete!
• Cloud Profiler is for code performance: Finding cpu/memory leaks in specific functions.
• Query Insight helps you identify slow SQL queries in Cloud SQL based on CPU and latency.

Log Router Sink

Log Router sinks are the standard method for exporting GCP logs to supported destinations for long-term storage and analysis.

16. Other shit

• Gemini Enterprise Agent Platform Workbench instances are Jupyter notebook-based development environments on Google Cloud. No need to manage infrastructure.
• Google Cloud's Cloud Hub is a free central dashboard that unifies operations data, health metrics, maintenance events, and cost optimization insights for your cloud applications and projects. It lets you monitor resources across different projects in one single place.
• Backup for GKE is a fully managed Google Cloud service designed to protect, manage, and restore application data and Kubernetes resources in Google Kubernetes Engine (GKE) clusters.
• Workforce identity pools are Google Cloud organization-level containers used in Workforce Identity Federation to manage external user identities (like employees or partners). Possible we can use Microsoft Entra ID to login with gloud commands with Workforce Identity Federation.
• A cloud asset inventory is a centralized service or database that tracks, monitors, and analyzes cloud infrastructure resources, configurations, and identity policies across a project, organization, or multicloud environment. It provides visibility into virtual machines, storage, networks, and access controls
• Environment customization allows you to install additional packages into your Cloud Shell environment when it starts. Cloud Shell automatically runs the script, $HOME/.customize_environment, when your instance boots up. Unlike .profile or .bashrc, this script runs once when Cloud Shell boots (rather than once for each shell login).
• Google Cloud's Identity-Aware Proxy (IAP) TCP forwarding enables secure, encrypted connections to administrative services (such as SSH and RDP) on virtual machine instances over private internal IPs. It removes the need for public IP addresses or jump hosts (bastion hosts) by routing traffic through HTTPS.
• Google Cloud's Tensor Processing Units (TPUs) are custom-built to help speed up machine learning workloads
• Hierarchical firewall policies let you create and enforce a consistent firewall policy across your organization
• Inbound forwarding is used to allow on-premises networks to resolve names hosted in Cloud DNS. While you would use a private zone, the specific step of configuring a server policy is for hybrid connectivity (on-prem to cloud)
• Active Assist refers to the portfolio of tools used in Google Cloud to generate recommendations and insights to help you optimize your Google Cloud projects