GCP Core Concepts

GCP Resource Hierarchy

GCP organizes resources in a hierarchy:

Organization (optional)
    └── Folders (optional)
        └── Projects (required)
            └── Resources (VMs, databases, etc.)

For personal projects, you typically just need a Project.

Projects

A Project is the fundamental organizing entity:

bash
Copy
# List your projects
gcloud projects list

# Get project details
gcloud projects describe my-project-id

# Create a new project
gcloud projects create my-new-project --name="My New Project"

Organizations (Enterprise)

For companies using Google Workspace or Cloud Identity:

• Central administration
• Policy inheritance
• Cross-project billing

Personal accounts don't have an Organization.

Regions and Zones

GCP infrastructure is distributed globally.

Regions

A Region is a geographic location (e.g., us-central1 = Iowa, USA).

Region: us-central1 (Iowa)
├── Zone: us-central1-a
├── Zone: us-central1-b
├── Zone: us-central1-c
└── Zone: us-central1-f

Zones

A Zone is an isolated location within a region. Different zones have independent power, cooling, and networking.

Choosing a Region

Common Regions

Multi-Region

Some services support multi-region deployment:

• us - All US regions
• eu - All EU regions
• asia - All Asia regions

bash
Copy
# Set default region
gcloud config set compute/region us-central1

# List available regions
gcloud compute regions list

APIs and Services

GCP services are accessed through APIs. Each API must be enabled per project.

How APIs Work

Your Code → API Call → GCP API Endpoint → GCP Service

Common APIs

Managing APIs

bash
Copy
# Enable an API
gcloud services enable run.googleapis.com

# Enable multiple APIs
gcloud services enable \
  run.googleapis.com \
  cloudbuild.googleapis.com \
  artifactregistry.googleapis.com

# List enabled APIs
gcloud services list --enabled

# Disable an API (careful!)
gcloud services disable run.googleapis.com

Identity and Access Management (IAM)

IAM controls who can do what with your resources.

The IAM Model

WHO (Principal) + WHAT (Role) + WHERE (Resource)

Example: "Alice can edit Cloud Run services in project my-app"

Principals (Who)

Roles (What)

Primitive Roles (broad, legacy):

• roles/owner - Full control
• roles/editor - Edit everything
• roles/viewer - Read-only

Predefined Roles (recommended):

• roles/run.admin - Manage Cloud Run
• roles/run.invoker - Invoke Cloud Run services
• roles/storage.admin - Manage Cloud Storage
• roles/cloudsql.admin - Manage Cloud SQL

Custom Roles (fine-grained):

• Create your own with specific permissions

Managing IAM

bash
Copy
# View project IAM policy
gcloud projects get-iam-policy PROJECT_ID

# Add a member to a role
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="user:[email protected]" \
  --role="roles/run.admin"

# Remove a member from a role
gcloud projects remove-iam-policy-binding PROJECT_ID \
  --member="user:[email protected]" \
  --role="roles/run.admin"

Service Accounts

Service accounts are identities for applications (not humans).

Types

Creating Service Accounts

bash
Copy
# Create service account
gcloud iam service-accounts create my-service-account \
  --display-name="My Service Account"

# Grant roles
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:my-service-account@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/run.invoker"

# Create key (for external use)
gcloud iam service-accounts keys create key.json \
  --iam-account=my-service-account@PROJECT_ID.iam.gserviceaccount.com

Networking Basics

VPC (Virtual Private Cloud)

Every project has a default VPC with:

• Subnets in each region
• Default firewall rules
• Internet access

bash
Copy
# List VPC networks
gcloud compute networks list

# List subnets
gcloud compute networks subnets list

Firewall Rules

Control traffic to/from your resources:

bash
Copy
# List firewall rules
gcloud compute firewall-rules list

# Create a rule (allow HTTP)
gcloud compute firewall-rules create allow-http \
  --allow=tcp:80 \
  --target-tags=http-server \
  --description="Allow HTTP traffic"

Cloud Run Networking

Cloud Run is serverless - networking is mostly handled for you:

• Ingress: Control who can access (all, internal, load balancer)
• Egress: Serverless VPC connector for private resources

Labels and Tags

Organize and track resources with labels.

Labels

Key-value pairs attached to resources:

bash
Copy
# Add labels when creating
gcloud run deploy my-service \
  --image=gcr.io/PROJECT_ID/my-app \
  --labels=env=production,team=backend

# Update labels
gcloud run services update my-service \
  --update-labels=version=v2

# Filter by label
gcloud run services list --filter="labels.env=production"

Common Label Patterns

env: production/staging/development
team: backend/frontend/data
app: myapp-name
cost-center: engineering
owner: [email protected]

Quotas and Limits

GCP enforces limits to prevent abuse and ensure fair usage.

Viewing Quotas

1. Go to IAM & Admin → Quotas
2. Filter by service
3. View current usage vs limits

bash
Copy
# View compute quotas
gcloud compute project-info describe --format="json" | jq '.quotas'

Requesting Increases

1. Go to IAM & Admin → Quotas
2. Select the quota
3. Click Edit Quotas
4. Submit request with justification

Billing Concepts

Billing Accounts

A billing account is where charges are billed:

• Linked to payment method
• Can be used by multiple projects
• Managed separately from projects

bash
Copy
# List billing accounts
gcloud billing accounts list

# Link project to billing account
gcloud billing projects link PROJECT_ID \
  --billing-account=BILLING_ACCOUNT_ID

Cost Breakdown

Typical costs:

• Compute - VMs, Cloud Run, Cloud Functions
• Storage - Cloud Storage, disks, databases
• Network - Egress (outbound) traffic
• APIs - Some APIs charge per call

Free Tier

GCP offers:

1. $300 credit for 90 days (new accounts)
2. Always Free tier (ongoing):
   • Cloud Run: 2M requests/month
   • Cloud Functions: 2M invocations/month
   • Cloud Storage: 5GB
   • And more...

Resource Naming

Naming Conventions

[company]-[project]-[env]-[resource-type]-[identifier]

Examples:
- acme-webapp-prod-vm-01
- myapp-staging-bucket
- api-service-prod

Rules

• Lowercase letters, numbers, hyphens
• Start with a letter
• No spaces or special characters
• Check specific service limits (length varies)

Putting It Together

A typical deployment uses multiple concepts:

Project: my-company-prod
├── IAM: [email protected] has roles/run.admin
├── Service Account: cloudrun-sa (for Cloud Run)
├── APIs Enabled:
│   ├── Cloud Run
│   ├── Artifact Registry
│   └── Cloud SQL
├── Region: us-central1
├── Resources:
│   ├── Cloud Run Service: api-service
│   ├── Cloud SQL: postgres-main
│   └── Artifact Registry: docker-images
└── Labels: env=production, team=backend