ACE cheat sheet — every exam topic on one page

Setting up a cloud solution environment

Setting Up Google Cloud Projects, Resource Hierarchy, and IAM

• The hierarchy is organization to folders to projects to resources; IAM and organization policies attach at any level and inherit downward
• A standalone organization comes from Cloud Identity (Free edition is fine) on a verified domain; remove the domain-wide Project Creator and Billing Account Creator grants it starts with
• Allow policies are additive — a lower-level grant never removes an inherited one; IAM deny policies, evaluated first and with per-rule exception principals, are how you block inherited access
• Moving a project swaps the inheritance from the old folder for the new one; project-level bindings move with it
• Prefer predefined roles granted to groups at the lowest level that works; IAM Conditions give time-bound grants but cannot be used with basic roles
• Organization policies constrain what can be done (even by Owners); a child can inherit, merge, replace or reset, policies are not retroactive, and dry-run shows impact first
• GCDS is a one-way sync from Active Directory (the directory wins); SSO controls sign-in but still needs Cloud Identity accounts; Workforce Identity Federation needs no accounts but an existing organization
• APIs must be enabled per project (SERVICE_DISABLED means run gcloud services enable); billable APIs need a linked billing account
• Regional and global quotas (CPUs, GPUs) are checked separately; reservations consume quota and budgets never cap it
• Install the Ops Agent for memory and in-guest logs; use metrics scopes for multi-project monitoring and non-intercepting aggregated sinks for central logs
• Use custom mode VPCs, skipDefaultNetworkCreation to suppress the default network, and Compute Network User on host subnets for Shared VPC
• Cloud Asset Inventory keeps 35 days of history and streams changes through org- or folder-level feeds; Gemini Cloud Assist answers questions about your resources in the console

Google Cloud Billing Accounts, Budgets, Alerts, and BigQuery Export

• One billing account funds many projects; each project links to at most one billing account, and that link is independent of the organization the project lives in
• Linking a project needs Billing Account User (or Administrator) on the billing account plus Project Billing Manager or Owner on the project
• New organizations grant Billing Account Creator to the whole domain; remove it to control who opens billing accounts. The creator becomes Billing Account Administrator
• Changing a project's billing account does not interrupt services; unlinking or closing the account stops paid services, so move projects first and close last
• Lock billing blocks unlinking and moving a project's billing; a lien only blocks project deletion
• Costs Manager runs budgets and usage cost exports; Viewer only reads; only Administrator manages payments and billing IAM
• Standard budgets only alert, on delayed data; emails go to Billing Account Administrators and Users, up to five email channels, and Pub/Sub for everything else
• Spend cap budgets pause one eligible service (Gemini API, Gemini Enterprise Agent Platform, Cloud Run, Cloud Run functions) in one project per month
• Usage cost exports backfill from the previous month only into US or EU multi-region datasets; the pricing export is never backfilled

Planning and implementing a cloud solution

Choosing and Deploying Compute: Compute Engine, GKE, and Cloud Run

• Pick compute by management burden and control: Compute Engine for VMs and lift-and-shift, GKE for orchestrated containers, Cloud Run for stateless containers with scale-to-zero, Cloud Run functions for single-purpose event handlers, and Agent Runtime for hosting AI agents with managed sessions.
• The availability policy combines maintenance behaviour (MIGRATE or TERMINATE) with automatic restart; VMs with GPUs cannot live-migrate and must use TERMINATE.
• OS Login replaces metadata SSH keys with IAM roles (plus Service Account User on the VM's service account); instance metadata overrides project metadata, and the compute.requireOsLogin organization policy stops anyone switching it off.
• VM Manager needs enable-osconfig, the OS Config agent and API, an attached service account and a path to osconfig.googleapis.com (Private Google Access for internal-only VMs).
• Zonal PD is the default; regional PD and Hyperdisk Balanced HA replicate synchronously across two zones; asynchronous replication covers another region; Hyperdisk provisions IOPS independently of size; Local SSD is fast, fixed-size and lost on host failure.
• MIGs are built from immutable instance templates, autoscale on CPU, load-balancer capacity or custom metrics, and change through a rolling update to a new template.
• Spot VMs suit interruptible checkpointed work; sustained use discounts apply automatically past 25% of the month; committed use discounts bill 24/7 for 1 or 3 years; custom shapes and extended memory (not on E2) fit measured needs.
• GKE Autopilot manages nodes and bills per Pod request; regional clusters survive zonal outages; private nodes use Private Google Access for Google APIs and Cloud NAT for the internet; nodes pull images as the node service account.
• Cloud Run services answer requests (60-minute maximum per request), Cloud Run jobs run to completion; concurrency, minimum and maximum instances trade cost against latency; Eventarc routes Google events, including Cloud Audit Logs, into Cloud Run.
• GPUs are the general-purpose accelerator and the only option for CUDA code; TPUs fit very large tensor-heavy training on TPU-supported frameworks.

Choosing Storage and Databases: Cloud SQL, BigQuery, Spanner, and More

• Select databases by data model, scale, and consistency: Cloud SQL for regional relational, Spanner for globally consistent relational scale, Firestore for documents with sync, Bigtable for massive-throughput wide-column data, BigQuery for analytics.
• Bigtable performance depends on row keys: lead with a high-cardinality id, not a timestamp, to avoid hotspotting; multi-cluster app profiles fail over automatically.
• AlloyDB (columnar engine) is the PostgreSQL-compatible step up for fast analytics on live transactional data; Memorystore is a managed cache and session store, not a system of record, with Basic (single node), Standard (replica + automatic failover) and Redis Cluster/Valkey (sharded writes).
• Pub/Sub ingests and decouples, Dataflow transforms streams, Managed Service for Apache Kafka is for Kafka compatibility; a Pub/Sub BigQuery subscription writes straight to a table when no transformation is needed.
• Cloud Storage classes trade at-rest price against retrieval fees and minimum durations: Standard (none), Nearline (30 days), Coldline (90 days), Archive (365 days) — all with the same durability and millisecond access.
• Bucket location is permanent: regional for lowest cost and latency, dual-region for two regions you can name (turbo replication: 15-minute target), multi-region for broad geo-redundancy chosen by Google.
• File workloads map to Filestore for NFS, NetApp Volumes for SMB and NetApp features, Managed Lustre for HPC throughput; Cloud Storage FUSE is not NFS and has no file locking.
• gcloud storage cp/mv/rsync need --recursive for directories, rsync mirrors with --delete-unmatched-destination-objects, bq load appends unless --replace, and Cloud SQL imports need the instance service account to read the bucket; large or cross-cloud transfers use Storage Transfer Service, network-bound petabytes use Transfer Appliance.
• Multi-region redundancy is automatic where it is a location or config choice (Cloud Storage, Spanner, Firestore, BigQuery) and operator-driven where it uses replicas (Cloud SQL cross-region replica promotion, Bigtable multi-cluster replication).

VPC Networks, Firewall Rules, and Load Balancing on Google Cloud

• VPC networks are global and subnets are regional; custom mode is the production choice because every auto mode network uses the same 10.128.0.0/9 ranges and cannot be peered with another.
• A subnet's primary range can be expanded in place without disruption but never shrunk; secondary ranges supply alias IPs, such as GKE Pod and Service ranges, not VM primary addresses.
• Shared VPC shares one network across projects in one organization, with Compute Network User granted in the host project on the project or on individual subnets; VPC Network Peering is non-transitive, forbids overlapping ranges, and exchanges custom routes only when exported and imported.
• VPC firewall rules are stateful; the lowest priority number wins, a deny wins an equal-priority tie, and implied rules deny all ingress and allow all egress.
• IAP SSH needs ingress from 35.235.240.0/20 plus the IAP-secured Tunnel User role; Private Google Access is per subnet and still obeys egress firewall rules.
• Hierarchical firewall policies attach to the organization or folders and are evaluated first; an allow or deny ends evaluation, while goto_next passes the decision down. Secure Tags work in NGFW policies, not VPC firewall rules.
• HA VPN gives a 99.99% SLA when both interfaces have tunnels, even to one peer IP; Classic VPN gives 99.9%. Dedicated Interconnect offers 10, 100, or 400 Gbps circuits, Partner Interconnect 50 Mbps to 50 Gbps, and Cross-Cloud Interconnect links to other clouds.
• Choose load balancers by layer, client location, and scope; only passthrough Network Load Balancers show the client IP as the packet source, and regional proxy load balancers need a proxy-only subnet. Global load balancing requires Premium Tier.

Terraform, Config Connector, and AI-Assisted Tooling on Google Cloud

• Declarative IaC describes desired end state and safely converges to it; imperative gcloud scripts list steps and are not safely repeatable.
• terraform init installs providers and modules and configures the backend (rerun it when they change); plan previews without changing anything; validate, show and init -upgrade are not previews.
• A plain apply re-plans; to apply exactly what was approved, save the plan with plan -out and apply that file, which Terraform rejects if state changed since.
• The gcs backend shares state and locks it natively (a second run fails at once unless -lock-timeout is set), but the bucket must already exist and you enable Object Versioning yourself.
• State holds secrets in plain text even when marked sensitive: restrict the bucket, never commit state, and rotate any secret that leaked.
• Isolate environments with separate root configurations, state in each environment's own project, and a scoped deployer service account per environment; CLI workspaces do not separate credentials.
• Authenticate Terraform through ADC with no keys: attached service accounts on Google Cloud, Workload Identity Federation in external CI, impersonation (Token Creator plus impersonate_service_account) on workstations.
• Adopt drift by updating configuration, import existing resources with import blocks, refactor into modules with moved blocks, and use API-level settings such as Cloud SQL deletion_protection_enabled when every client must be blocked.
• Config Connector continuously reconciles Kubernetes objects to Google Cloud resources; deletion-policy abandon keeps a resource when its object is deleted, applying a matching object acquires an existing one, and namespaced mode gives each namespace its own service account.
• Helm packages applications (not infrastructure) as charts with rollback-capable releases, pushed to Artifact Registry Docker-format repositories as OCI artifacts; Fabric FAST builds the organization landing zone, starting with a bootstrap run once by a human org admin.
• Cloud Assist works in the console with built-in project context, Gemini CLI in the terminal (GEMINI.md context, -p for non-interactive runs), Antigravity runs supervised agents that produce reviewable artifacts, and Application Design Center deploys designs with App Hub registration — exported Terraform becomes unmanaged.

Ensuring the successful operation of a cloud solution

Managing Compute Engine, GKE, and Cloud Run: Day-2 Operations

• Reach a VM without an external IP with gcloud compute ssh --tunnel-through-iap (firewall rule for 35.235.240.0/20 on port 22 plus roles/iap.tunnelResourceAccessor); --internal-ip only works when you already have a network path into the VPC.
• OS Login puts SSH behind IAM (roles/compute.osLogin, or osAdminLogin for sudo); users also need roles/iam.serviceAccountUser when the VM runs as a service account.
• Automate disk backups with a snapshot schedule and its retention; clean up old snapshots with snapshots list --filter on creationTimestamp and snapshots delete.
• Custom images in an image family give templates the newest non-deprecated build; share them across projects with roles/compute.imageUser.
• Image pulls use the node service account (not Workload Identity), which needs roles/artifactregistry.reader in the repository project — no keys or imagePullSecrets required.
• Node pools can change machine type and disk in place (nodes are recreated) but cannot gain GPUs; --num-nodes and --min/--max-nodes are per zone in multi-zone clusters.
• HPA targets are a percentage of requests (no requests means <unknown> and no scaling); VPA needs enabling on Standard, and Off is the only mode that never changes requests.
• Autopilot bills general-purpose Pods by their requests — omitted requests get billed defaults, and limits never lower the bill.
• Deploy with --no-traffic to keep a revision at 0%; after traffic is pinned to a revision, new deploys get 0% until update-traffic --to-latest.
• Cloud Run: min instances remove cold starts, max instances protect backends (size to the connection budget), and lower concurrency means more instances.

Managing Cloud Storage and Databases: Lifecycle, Backups, and CMEK

• Uniform bucket-level access makes IAM the only permission model: ACL requests then fail with 400, it can be reverted only within 90 days, and the org policy constraint applies only to new buckets.
• Signed URLs give one method on one object for up to 7 days (V4); signed policy documents allow browser form uploads with size and content-type conditions. Either way the signer must already have access.
• Versioning keeps noncurrent versions until deleted; soft delete keeps deleted or overwritten data for 7 to 90 days (default 7); retention policies and holds block the change instead.
• numNewerVersions counts the live version (keep live + K earlier copies with N = K + 1); age counts from creation, daysSinceNoncurrentTime from replacement.
• Minimum storage durations count from original creation time; Autoclass cannot be combined with SetStorageClass rules.
• bq query defaults to legacy SQL unless configured, so pass --use_legacy_sql=false for GoogleSQL; --dry_run reports bytes without running the query.
• Cloud SQL backup restores overwrite the target instance (which can be another instance); PITR needs automated backups plus transaction logs and always creates a new instance; replicas are not backups.
• Spanner backups last up to 1 year and restore to a new database; Firestore weekly schedules keep up to 14 weeks; AlloyDB continuous backup covers 1 to 35 days (default 14).
• BigQuery tables or partitions unmodified for 90 days drop to long-term storage pricing automatically; queries do not reset the timer.
• INFORMATION_SCHEMA job views are region-qualified: JOBS for every user in the project, JOBS_BY_USER for your own jobs.
• CMEK needs the service agent's cryptoKeyEncrypterDecrypter grant; rotation does not re-encrypt old data, so disabling an old version breaks reads of data encrypted with it.
• Match the tool to the scope: Database Center for fleet-wide database health and recommendations, Query Insights for slow queries inside one Cloud SQL or AlloyDB instance; drain a Dataflow job to finish in-flight data, cancel it to stop immediately.

Managing VPC Networking: Subnets, Static IPs, Cloud DNS, and Cloud NAT

• Subnet ranges can only expand — expand-ip-range works in place with no downtime, but fails on overlap with any primary or secondary range, subnet range in a peered VPC, or a static route destination; auto mode-created subnets stay capped at /16 even after conversion, and firewall rules naming the old CIDR are not updated
• Ephemeral external IPs are released on stop, ephemeral internal IPs on delete; an internal IP picked at creation but not reserved is still ephemeral; in-use addresses can be promoted to static without interruption
• External IP scope must match the resource: regional for VMs (any zone in the region), global for global external load balancers; an address serves one resource at a time
• Routes: most specific destination first, then lowest priority value, then ECMP across ties; the default route sits at priority 1000; static routes cannot match or fit inside a subnet route; ILB next hops must be internal passthrough Network Load Balancers
• Cloud DNS: private zones answer their whole namespace (no fallback to public DNS); forwarding zones send queries out, inbound server policies let on-premises resolve in; DNS peering targets a VPC network, needs roles/dns.peer on the producer project and is separate from VPC Network Peering
• Cloud NAT gives egress-only internet access to any destination; Private Google Access reaches only Google APIs; each NAT IP has 64,512 ports shared at the minimum ports per VM (default 64); manual NAT IPs give partners a fixed allowlist
• Firewall rules: lower number wins and deny beats allow at equal priority; target service accounts rather than network tags when the rule matters for security (tags are easier to change); rules can be updated or disabled in place, but action and direction cannot change
• Cloud NGFW: hierarchical policies (organization/folder) evaluate first; network policies are global or regional and run after classic VPC rules by default (AFTER_CLASSIC_FIREWALL) unless the network is set to BEFORE_CLASSIC_FIREWALL

Cloud Monitoring and Logging: Alerts, Log Sinks, and Audit Logs

• Cloud Monitoring handles numeric time series and alerting; Cloud Logging handles log entries, storage and routing — log-based metrics bridge logs into alertable metrics
• An alerting policy is conditions plus notification channels: the retest window must match how long a problem must persist, and documentation, severity and auto-close shape what responders get
• Counter log-based metrics count matches over a window, distribution metrics enable percentile alerts, and log match alerts notify per entry; values never logged need a custom metric via OpenTelemetry or the Monitoring API
• Admin Activity and System Event audit logs are always on, free and kept 400 days in _Required; Data Access is off by default (except BigQuery), configured per service with inheritance and exempted principals; Policy Denied is on by default but can be excluded
• VPC Flow Logs are per subnet, sampled and carry byte counts; firewall logging is per rule with no byte counts, and implied rules never log — use a logged deny-all rule at priority 65534
• Logging bills stored volume at ingestion plus retention beyond 30 days: exclusion filters cut ingestion cost, shorter retention cuts only the retention charge, and _Required is free
• A sink's writer identity needs the destination's writer role (BigQuery Data Editor, Pub/Sub Publisher, Storage Object Creator, Logs Bucket Writer) unless auto-granted; sinks are not retroactive, so use gcloud logging copy for stored entries
• Observability Analytics (formerly Log Analytics) adds in-place SQL and linked BigQuery datasets; the bucket upgrade is irreversible
• The Ops Agent is for Compute Engine VMs, not GKE nodes, and needs Logs Writer and Monitoring Metric Writer; Managed Service for Prometheus keeps PromQL with managed collection or self-deployed collection
• Export to systems outside Google Cloud through a sink to Pub/Sub; BigQuery suits in-cloud analysis and Cloud Storage suits archives
• Match symptom to tool: Trace for latency across service hops, Profiler for CPU and heap by function, Error Reporting for grouped exceptions, Query Insights plus index advisor for slow SQL, Personalized Service Health for Google-side incidents, Active Assist for recommendations, Cloud Hub for an App Hub application view, and Gemini Cloud Assist (not Code Assist) for incident investigations

Configuring access and security

Managing Cloud IAM: Roles, Policies, and Inheritance

• An allow policy is a set of role bindings on one resource; each binding ties one role to principals, optionally with a condition
• Use the right principal form: group: for teams, serviceAccount:EMAIL for service accounts; allAuthenticatedUsers is any Google account (effectively public) and domain: excludes service accounts
• Allow-policy inheritance is additive: a child's allow policy cannot remove an inherited grant; change the grant at its source, change group membership, or use a deny policy
• Deny policies deny permissions at the organization, folder or project, are checked before allow policies, honour exception principals, override even Owner, and are managed with Deny Admin on the organization
• get-iam-policy shows one node; get-ancestors-iam-policy adds the ancestors; Policy Troubleshooter evaluates inherited and group-based grants for one principal and permission
• set-iam-policy replaces the whole policy; keep the etag so a write based on a stale read fails instead of overwriting someone else's change
• Pick the narrowest predefined role and bind it at the lowest node; a correct role on a folder still reaches every project in it
• Custom roles live at the project or organization level only; NOT_SUPPORTED permissions cannot be included, and only the DISABLED stage stops a role's bindings from granting anything

Service Accounts, Impersonation, and Workload Identity Federation

• Three kinds of service account: Google-managed service agents (service-PROJECT_NUMBER@gcp-sa-SERVICE…), default accounts such as the Compute Engine default, and user-managed accounts you create per workload
• Service agents created on request get no roles; grant what the service needs, such as Cloud KMS CryptoKey Encrypter/Decrypter to the Cloud Storage service agent for CMEK
• Grant service accounts minimum roles at the resource level, one account per workload; attaching an account across projects is blocked by iam.disableCrossProjectServiceAccountUsage on the account's project
• Disable before deleting; a deleted account can be undeleted by numeric unique ID within 30 days with its roles; a recreated same-name account is a new identity with no roles and blocks the undelete until you delete it
• Access scopes intersect with IAM roles; gcloud without --scopes applies the defaults (read-only Storage), and changing scopes or the account needs a stopped VM and set-service-account
• Service Account User attaches, Token Creator impersonates, Creator only creates, Admin manages lifecycle and policy, Key Admin manages keys; project-level grants cover every account and enable escalation
• Keys have no expiry by default; orgs created from 3 May 2024 block key creation/upload and default Editor grants, keyExpiryHours affects only new keys, and exposed keys are disabled automatically
• Impersonation needs Token Creator for the caller and resource roles for the account; use access tokens for Google APIs and ID tokens with an audience for private Cloud Run; lifetimes beyond 1 hour (up to 12) need an org policy
• Workload Identity Federation for GKE grants roles to the KSA principal:// identifier (project number, PROJECT_ID.svc.id.goog pool) or links a GSA; old node pools need --workload-metadata=GKE_METADATA
• Workload Identity Federation trusts external OIDC/SAML tokens; attribute conditions restrict who can federate; workforce pools are for humans, workload pools for software