GCP Google Cloud Platform Complete Developer Tutorial

Google Cloud Platform Introduction

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Google Cloud Platform Introduction

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Google Cloud Platform Introduction.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud services enable SERVICE_API_FOR_GOOGLE_CLOUD_PLATFORM_INTRODUCTION

gcloud gcloud --help

# Then create Google Cloud Platform Introduction from Console, CLI, Terraform, or client SDK.

Developer code / usage pattern

# Developer pattern for Google Cloud Platform Introduction
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Google Cloud Platform Introduction")

Terraform / IaC starter

# Terraform starter for Google Cloud Platform Introduction
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "google_cloud_platfor" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}

IAM and security design

For Google Cloud Platform Introduction, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-google-cloud-platform-introd@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-google-cloud-platform-introd \
  --display-name="Google Cloud Platform Introduction runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-google-cloud-platform-introd@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/viewer for read-only"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Google Cloud Platform Introduction is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Google Cloud Platform Introduction does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Google Cloud Platform Introduction with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Google Cloud Platform Introduction solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Google Cloud Free Account Setup

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Google Cloud Free Account Setup

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Google Cloud Free Account Setup.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud init

gcloud config set project PROJECT_ID

gcloud billing projects describe PROJECT_ID

gcloud services list --enabled

Developer code / usage pattern

# Developer pattern for Google Cloud Free Account Setup
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Google Cloud Free Account Setup")

Terraform / IaC starter

# Terraform starter for Google Cloud Free Account Setup
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "google_cloud_free_ac" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}

IAM and security design

For Google Cloud Free Account Setup, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-google-cloud-free-account-se@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-google-cloud-free-account-se \
  --display-name="Google Cloud Free Account Setup runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-google-cloud-free-account-se@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/viewer for read-only"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Google Cloud Free Account Setup is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Google Cloud Free Account Setup does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Google Cloud Free Account Setup with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Google Cloud Free Account Setup solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Google Account vs Cloud Identity vs Workspace

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Google Account vs Cloud Identity vs Workspace

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Google Account vs Cloud Identity vs Workspace.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud services enable SERVICE_API_FOR_GOOGLE_ACCOUNT_VS_CLOUD_IDENTITY_VS_WORKSPACE

gcloud identity --help

# Then create Google Account vs Cloud Identity vs Workspace from Console, CLI, Terraform, or client SDK.

Developer code / usage pattern

# Developer pattern for Google Account vs Cloud Identity vs Workspace
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Google Account vs Cloud Identity vs Workspace")

Terraform / IaC starter

# Terraform starter for Google Account vs Cloud Identity vs Workspace
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "google_account_vs_cl" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}

IAM and security design

For Google Account vs Cloud Identity vs Workspace, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-google-account-vs-cloud-iden@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-google-account-vs-cloud-iden \
  --display-name="Google Account vs Cloud Identity vs Workspace runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-google-account-vs-cloud-iden@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/viewer for read-only"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Google Account vs Cloud Identity vs Workspace is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Google Account vs Cloud Identity vs Workspace does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Google Account vs Cloud Identity vs Workspace with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Google Account vs Cloud Identity vs Workspace solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Billing Account Setup

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Billing Account Setup

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Billing Account Setup.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud services enable SERVICE_API_FOR_BILLING_ACCOUNT_SETUP

gcloud billing --help

# Then create Billing Account Setup from Console, CLI, Terraform, or client SDK.

Developer code / usage pattern

# Developer pattern for Billing Account Setup
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Billing Account Setup")

Terraform / IaC starter

# Terraform starter for Billing Account Setup
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "billing_account_setu" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}

IAM and security design

For Billing Account Setup, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-billing-account-setup@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-billing-account-setup \
  --display-name="Billing Account Setup runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-billing-account-setup@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/viewer for read-only"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Billing Account Setup is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Billing Account Setup does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Billing Account Setup with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Billing Account Setup solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Budgets and Billing Alerts

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Budgets and Billing Alerts

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Budgets and Billing Alerts.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud services enable SERVICE_API_FOR_BUDGETS_AND_BILLING_ALERTS

gcloud billing budgets --help

# Then create Budgets and Billing Alerts from Console, CLI, Terraform, or client SDK.

Developer code / usage pattern

# Developer pattern for Budgets and Billing Alerts
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Budgets and Billing Alerts")

Terraform / IaC starter

# Terraform starter for Budgets and Billing Alerts
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "budgets_and_billing_" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}

IAM and security design

For Budgets and Billing Alerts, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-budgets-and-billing-alerts@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-budgets-and-billing-alerts \
  --display-name="Budgets and Billing Alerts runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-budgets-and-billing-alerts@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/viewer for read-only"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Budgets and Billing Alerts is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Budgets and Billing Alerts does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Budgets and Billing Alerts with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Budgets and Billing Alerts solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Projects

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Projects

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Projects.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud projects create PROJECT_ID --name="Learning Project"

gcloud config set project PROJECT_ID

Developer code / usage pattern

# Developer pattern for Projects
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Projects")

Terraform / IaC starter

# Terraform starter for Projects
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "projects" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}

IAM and security design

For Projects, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-projects@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-projects \
  --display-name="Projects runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-projects@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/viewer for read-only"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Projects is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Projects does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Projects with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Projects solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Folders

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Folders

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Folders.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud services enable SERVICE_API_FOR_FOLDERS

gcloud resource-manager folders --help

# Then create Folders from Console, CLI, Terraform, or client SDK.

Developer code / usage pattern

# Developer pattern for Folders
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Folders")

Terraform / IaC starter

# Terraform starter for Folders
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "folders" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}

IAM and security design

For Folders, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-folders@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-folders \
  --display-name="Folders runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-folders@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/viewer for read-only"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Folders is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Folders does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Folders with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Folders solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Organizations

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Organizations

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Organizations.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud services enable SERVICE_API_FOR_ORGANIZATIONS

gcloud organizations --help

# Then create Organizations from Console, CLI, Terraform, or client SDK.

Developer code / usage pattern

# Developer pattern for Organizations
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Organizations")

Terraform / IaC starter

# Terraform starter for Organizations
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "organizations" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}

IAM and security design

For Organizations, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-organizations@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-organizations \
  --display-name="Organizations runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-organizations@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/viewer for read-only"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Organizations is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Organizations does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Organizations with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Organizations solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Resource Hierarchy

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Resource Hierarchy

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Resource Hierarchy.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud services enable SERVICE_API_FOR_RESOURCE_HIERARCHY

gcloud resource-manager --help

# Then create Resource Hierarchy from Console, CLI, Terraform, or client SDK.

Developer code / usage pattern

# Developer pattern for Resource Hierarchy
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Resource Hierarchy")

Terraform / IaC starter

# Terraform starter for Resource Hierarchy
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "resource_hierarchy" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}

IAM and security design

For Resource Hierarchy, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-resource-hierarchy@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-resource-hierarchy \
  --display-name="Resource Hierarchy runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-resource-hierarchy@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/viewer for read-only"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Resource Hierarchy is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Resource Hierarchy does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Resource Hierarchy with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Resource Hierarchy solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Regions and Zones

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Regions and Zones

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Regions and Zones.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud services enable SERVICE_API_FOR_REGIONS_AND_ZONES

gcloud compute zones --help

# Then create Regions and Zones from Console, CLI, Terraform, or client SDK.

Developer code / usage pattern

# Developer pattern for Regions and Zones
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Regions and Zones")

Terraform / IaC starter

# Terraform starter for Regions and Zones
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "regions_and_zones" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}

IAM and security design

For Regions and Zones, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-regions-and-zones@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-regions-and-zones \
  --display-name="Regions and Zones runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-regions-and-zones@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/viewer for read-only"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Regions and Zones is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Regions and Zones does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Regions and Zones with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Regions and Zones solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Enable APIs and Services

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Enable APIs and Services

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Enable APIs and Services.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud services enable run.googleapis.com compute.googleapis.com storage.googleapis.com pubsub.googleapis.com

Developer code / usage pattern

# Developer pattern for Enable APIs and Services
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Enable APIs and Services")

Terraform / IaC starter

# Terraform starter for Enable APIs and Services
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "enable_apis_and_serv" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}

IAM and security design

For Enable APIs and Services, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-enable-apis-and-services@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-enable-apis-and-services \
  --display-name="Enable APIs and Services runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-enable-apis-and-services@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/viewer for read-only"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Enable APIs and Services is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Enable APIs and Services does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Enable APIs and Services with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Enable APIs and Services solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Install gcloud CLI

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Install gcloud CLI

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Install gcloud CLI.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud init

gcloud auth login

gcloud auth application-default login

gcloud config set project PROJECT_ID

gcloud config set compute/region us-central1

Developer code / usage pattern

# Developer pattern for Install gcloud CLI
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Install gcloud CLI")

Terraform / IaC starter

# Terraform starter for Install gcloud CLI
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "install_gcloud_cli" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}

IAM and security design

For Install gcloud CLI, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-install-gcloud-cli@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-install-gcloud-cli \
  --display-name="Install gcloud CLI runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-install-gcloud-cli@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/viewer for read-only"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Install gcloud CLI is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Install gcloud CLI does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Install gcloud CLI with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Install gcloud CLI solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Application Default Credentials

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Application Default Credentials

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Application Default Credentials.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud services enable SERVICE_API_FOR_APPLICATION_DEFAULT_CREDENTIALS

gcloud auth application-default --help

# Then create Application Default Credentials from Console, CLI, Terraform, or client SDK.

Developer code / usage pattern

# Developer pattern for Application Default Credentials
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Application Default Credentials")

Terraform / IaC starter

# Terraform starter for Application Default Credentials
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "application_default_" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}

IAM and security design

For Application Default Credentials, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-application-default-credenti@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-application-default-credenti \
  --display-name="Application Default Credentials runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-application-default-credenti@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/viewer for read-only"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Application Default Credentials is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Application Default Credentials does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Application Default Credentials with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Application Default Credentials solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Labels and Tags

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Labels and Tags

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Labels and Tags.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud services enable SERVICE_API_FOR_LABELS_AND_TAGS

gcloud resource-manager tags --help

# Then create Labels and Tags from Console, CLI, Terraform, or client SDK.

Developer code / usage pattern

# Developer pattern for Labels and Tags
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Labels and Tags")

Terraform / IaC starter

# Terraform starter for Labels and Tags
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "labels_and_tags" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}

IAM and security design

For Labels and Tags, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-labels-and-tags@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-labels-and-tags \
  --display-name="Labels and Tags runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-labels-and-tags@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/viewer for read-only"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Labels and Tags is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Labels and Tags does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Labels and Tags with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Labels and Tags solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Quotas and Limits

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Quotas and Limits

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Quotas and Limits.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud services enable SERVICE_API_FOR_QUOTAS_AND_LIMITS

gcloud quotas --help

# Then create Quotas and Limits from Console, CLI, Terraform, or client SDK.

Developer code / usage pattern

# Developer pattern for Quotas and Limits
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Quotas and Limits")

Terraform / IaC starter

# Terraform starter for Quotas and Limits
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "quotas_and_limits" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}

IAM and security design

For Quotas and Limits, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-quotas-and-limits@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-quotas-and-limits \
  --display-name="Quotas and Limits runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-quotas-and-limits@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/viewer for read-only"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Quotas and Limits is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Quotas and Limits does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Quotas and Limits with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Quotas and Limits solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Cleanup and Cost Safety

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Cleanup and Cost Safety

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Cleanup and Cost Safety.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud services enable SERVICE_API_FOR_CLEANUP_AND_COST_SAFETY

gcloud billing --help

# Then create Cleanup and Cost Safety from Console, CLI, Terraform, or client SDK.

Developer code / usage pattern

# Developer pattern for Cleanup and Cost Safety
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Cleanup and Cost Safety")

Terraform / IaC starter

# Terraform starter for Cleanup and Cost Safety
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "cleanup_and_cost_saf" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}

IAM and security design

For Cleanup and Cost Safety, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-cleanup-and-cost-safety@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-cleanup-and-cost-safety \
  --display-name="Cleanup and Cost Safety runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-cleanup-and-cost-safety@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/viewer for read-only"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Cleanup and Cost Safety is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Cleanup and Cost Safety does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Cleanup and Cost Safety with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Cleanup and Cost Safety solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Cloud Architecture Framework

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Cloud Architecture Framework

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Cloud Architecture Framework.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud services enable SERVICE_API_FOR_CLOUD_ARCHITECTURE_FRAMEWORK

gcloud architecture --help

# Then create Cloud Architecture Framework from Console, CLI, Terraform, or client SDK.

Developer code / usage pattern

# Developer pattern for Cloud Architecture Framework
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Cloud Architecture Framework")

Terraform / IaC starter

# Terraform starter for Cloud Architecture Framework
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "cloud_architecture_f" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}

IAM and security design

For Cloud Architecture Framework, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-cloud-architecture-framework@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-cloud-architecture-framework \
  --display-name="Cloud Architecture Framework runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-cloud-architecture-framework@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/viewer for read-only"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Cloud Architecture Framework is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Cloud Architecture Framework does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Cloud Architecture Framework with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Cloud Architecture Framework solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Identity and Access Management IAM

Core concepts you must know

IAM capability breakdown

How to create / configure Identity and Access Management IAM

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Identity and Access Management IAM.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud iam service-accounts create svc-identity-and-access-manageme --display-name="Identity and Access Management IAM service account"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-identity-and-access-manageme@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

Developer code / usage pattern

# Developer pattern for Identity and Access Management IAM
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Identity and Access Management IAM")

Terraform / IaC starter

resource "google_service_account" "app" {
  account_id   = "svc-app"
  display_name = "Application service account"
}

resource "google_project_iam_member" "app_role" {
  project = var.project_id
  role    = "roles/viewer"
  member  = "serviceAccount:${google_service_account.app.email}"
}

IAM and security design

For Identity and Access Management IAM, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-identity-and-access-manageme@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-identity-and-access-manageme \
  --display-name="Identity and Access Management IAM runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-identity-and-access-manageme@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Identity and Access Management IAM is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Identity and Access Management IAM does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Identity and Access Management IAM with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Identity and Access Management IAM solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

IAM Principals

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure IAM Principals

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for IAM Principals.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud iam service-accounts create svc-iam-principals --display-name="IAM Principals service account"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-iam-principals@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

Developer code / usage pattern

# Developer pattern for IAM Principals
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with IAM Principals")

Terraform / IaC starter

resource "google_service_account" "app" {
  account_id   = "svc-app"
  display_name = "Application service account"
}

resource "google_project_iam_member" "app_role" {
  project = var.project_id
  role    = "roles/viewer"
  member  = "serviceAccount:${google_service_account.app.email}"
}

IAM and security design

For IAM Principals, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-iam-principals@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-iam-principals \
  --display-name="IAM Principals runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-iam-principals@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, IAM Principals is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what IAM Principals does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect IAM Principals with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does IAM Principals solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

IAM Roles

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure IAM Roles

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for IAM Roles.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud iam service-accounts create svc-iam-roles --display-name="IAM Roles service account"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-iam-roles@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

Developer code / usage pattern

# Developer pattern for IAM Roles
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with IAM Roles")

Terraform / IaC starter

resource "google_service_account" "app" {
  account_id   = "svc-app"
  display_name = "Application service account"
}

resource "google_project_iam_member" "app_role" {
  project = var.project_id
  role    = "roles/viewer"
  member  = "serviceAccount:${google_service_account.app.email}"
}

IAM and security design

For IAM Roles, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-iam-roles@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-iam-roles \
  --display-name="IAM Roles runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-iam-roles@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, IAM Roles is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what IAM Roles does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect IAM Roles with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does IAM Roles solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

IAM Permissions

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure IAM Permissions

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for IAM Permissions.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud iam service-accounts create svc-iam-permissions --display-name="IAM Permissions service account"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-iam-permissions@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

Developer code / usage pattern

# Developer pattern for IAM Permissions
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with IAM Permissions")

Terraform / IaC starter

resource "google_service_account" "app" {
  account_id   = "svc-app"
  display_name = "Application service account"
}

resource "google_project_iam_member" "app_role" {
  project = var.project_id
  role    = "roles/viewer"
  member  = "serviceAccount:${google_service_account.app.email}"
}

IAM and security design

For IAM Permissions, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-iam-permissions@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-iam-permissions \
  --display-name="IAM Permissions runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-iam-permissions@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, IAM Permissions is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what IAM Permissions does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect IAM Permissions with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does IAM Permissions solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

IAM Allow Policies

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure IAM Allow Policies

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for IAM Allow Policies.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud iam service-accounts create svc-iam-allow-policies --display-name="IAM Allow Policies service account"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-iam-allow-policies@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

Developer code / usage pattern

# Developer pattern for IAM Allow Policies
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with IAM Allow Policies")

Terraform / IaC starter

resource "google_service_account" "app" {
  account_id   = "svc-app"
  display_name = "Application service account"
}

resource "google_project_iam_member" "app_role" {
  project = var.project_id
  role    = "roles/viewer"
  member  = "serviceAccount:${google_service_account.app.email}"
}

IAM and security design

For IAM Allow Policies, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-iam-allow-policies@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-iam-allow-policies \
  --display-name="IAM Allow Policies runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-iam-allow-policies@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, IAM Allow Policies is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what IAM Allow Policies does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect IAM Allow Policies with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does IAM Allow Policies solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

IAM Conditions

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure IAM Conditions

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for IAM Conditions.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud iam service-accounts create svc-iam-conditions --display-name="IAM Conditions service account"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-iam-conditions@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

Developer code / usage pattern

# Developer pattern for IAM Conditions
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with IAM Conditions")

Terraform / IaC starter

resource "google_service_account" "app" {
  account_id   = "svc-app"
  display_name = "Application service account"
}

resource "google_project_iam_member" "app_role" {
  project = var.project_id
  role    = "roles/viewer"
  member  = "serviceAccount:${google_service_account.app.email}"
}

IAM and security design

For IAM Conditions, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-iam-conditions@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-iam-conditions \
  --display-name="IAM Conditions runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-iam-conditions@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, IAM Conditions is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what IAM Conditions does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect IAM Conditions with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does IAM Conditions solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Custom IAM Roles

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Custom IAM Roles

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Custom IAM Roles.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud iam service-accounts create svc-custom-iam-roles --display-name="Custom IAM Roles service account"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-custom-iam-roles@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

Developer code / usage pattern

# Developer pattern for Custom IAM Roles
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Custom IAM Roles")

Terraform / IaC starter

resource "google_service_account" "app" {
  account_id   = "svc-app"
  display_name = "Application service account"
}

resource "google_project_iam_member" "app_role" {
  project = var.project_id
  role    = "roles/viewer"
  member  = "serviceAccount:${google_service_account.app.email}"
}

IAM and security design

For Custom IAM Roles, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-custom-iam-roles@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-custom-iam-roles \
  --display-name="Custom IAM Roles runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-custom-iam-roles@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Custom IAM Roles is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Custom IAM Roles does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Custom IAM Roles with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Custom IAM Roles solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Service Accounts

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Service Accounts

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Service Accounts.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud iam service-accounts create svc-service-accounts --display-name="Service Accounts service account"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-service-accounts@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.serviceAccountAdmin"

Developer code / usage pattern

# Developer pattern for Service Accounts
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Service Accounts")

Terraform / IaC starter

resource "google_service_account" "app" {
  account_id   = "svc-app"
  display_name = "Application service account"
}

resource "google_project_iam_member" "app_role" {
  project = var.project_id
  role    = "roles/viewer"
  member  = "serviceAccount:${google_service_account.app.email}"
}

IAM and security design

For Service Accounts, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-service-accounts@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-service-accounts \
  --display-name="Service Accounts runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-service-accounts@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.serviceAccountAdmin"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Service Accounts is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Service Accounts does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Service Accounts with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Service Accounts solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Service Account Keys

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Service Account Keys

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Service Account Keys.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud iam service-accounts create svc-service-account-keys --display-name="Service Account Keys service account"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-service-account-keys@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

Developer code / usage pattern

# Developer pattern for Service Account Keys
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Service Account Keys")

Terraform / IaC starter

resource "google_service_account" "app" {
  account_id   = "svc-app"
  display_name = "Application service account"
}

resource "google_project_iam_member" "app_role" {
  project = var.project_id
  role    = "roles/viewer"
  member  = "serviceAccount:${google_service_account.app.email}"
}

IAM and security design

For Service Account Keys, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-service-account-keys@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-service-account-keys \
  --display-name="Service Account Keys runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-service-account-keys@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Service Account Keys is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Service Account Keys does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Service Account Keys with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Service Account Keys solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Service Account Impersonation

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Service Account Impersonation

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Service Account Impersonation.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud iam service-accounts create svc-service-account-impersonatio --display-name="Service Account Impersonation service account"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-service-account-impersonatio@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.serviceAccountTokenCreator"

Developer code / usage pattern

# Developer pattern for Service Account Impersonation
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Service Account Impersonation")

Terraform / IaC starter

resource "google_service_account" "app" {
  account_id   = "svc-app"
  display_name = "Application service account"
}

resource "google_project_iam_member" "app_role" {
  project = var.project_id
  role    = "roles/viewer"
  member  = "serviceAccount:${google_service_account.app.email}"
}

IAM and security design

For Service Account Impersonation, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-service-account-impersonatio@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-service-account-impersonatio \
  --display-name="Service Account Impersonation runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-service-account-impersonatio@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.serviceAccountTokenCreator"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Service Account Impersonation is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Service Account Impersonation does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Service Account Impersonation with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Service Account Impersonation solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Workload Identity Federation

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Workload Identity Federation

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Workload Identity Federation.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud iam service-accounts create svc-workload-identity-federation --display-name="Workload Identity Federation service account"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-workload-identity-federation@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

Developer code / usage pattern

# Developer pattern for Workload Identity Federation
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Workload Identity Federation")

Terraform / IaC starter

# Terraform starter for Workload Identity Federation
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "workload_identity_fe" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}

IAM and security design

For Workload Identity Federation, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-workload-identity-federation@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-workload-identity-federation \
  --display-name="Workload Identity Federation runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-workload-identity-federation@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Workload Identity Federation is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Workload Identity Federation does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Workload Identity Federation with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Workload Identity Federation solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Workforce Identity Federation

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Workforce Identity Federation

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Workforce Identity Federation.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud iam service-accounts create svc-workforce-identity-federatio --display-name="Workforce Identity Federation service account"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-workforce-identity-federatio@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

Developer code / usage pattern

# Developer pattern for Workforce Identity Federation
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Workforce Identity Federation")

Terraform / IaC starter

# Terraform starter for Workforce Identity Federation
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "workforce_identity_f" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}

IAM and security design

For Workforce Identity Federation, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-workforce-identity-federatio@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-workforce-identity-federatio \
  --display-name="Workforce Identity Federation runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-workforce-identity-federatio@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Workforce Identity Federation is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Workforce Identity Federation does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Workforce Identity Federation with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Workforce Identity Federation solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Policy Troubleshooter

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Policy Troubleshooter

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Policy Troubleshooter.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud iam service-accounts create svc-policy-troubleshooter --display-name="Policy Troubleshooter service account"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-policy-troubleshooter@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

Developer code / usage pattern

# Developer pattern for Policy Troubleshooter
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Policy Troubleshooter")

Terraform / IaC starter

# Terraform starter for Policy Troubleshooter
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "policy_troubleshoote" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}

IAM and security design

For Policy Troubleshooter, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-policy-troubleshooter@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-policy-troubleshooter \
  --display-name="Policy Troubleshooter runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-policy-troubleshooter@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Policy Troubleshooter is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Policy Troubleshooter does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Policy Troubleshooter with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Policy Troubleshooter solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Policy Analyzer

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Policy Analyzer

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Policy Analyzer.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud iam service-accounts create svc-policy-analyzer --display-name="Policy Analyzer service account"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-policy-analyzer@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

Developer code / usage pattern

# Developer pattern for Policy Analyzer
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Policy Analyzer")

Terraform / IaC starter

# Terraform starter for Policy Analyzer
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "policy_analyzer" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}

IAM and security design

For Policy Analyzer, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-policy-analyzer@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-policy-analyzer \
  --display-name="Policy Analyzer runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-policy-analyzer@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Policy Analyzer is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Policy Analyzer does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Policy Analyzer with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Policy Analyzer solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Organization Policy Service

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Organization Policy Service

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Organization Policy Service.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud iam service-accounts create svc-organization-policy-service --display-name="Organization Policy Service service account"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-organization-policy-service@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

Developer code / usage pattern

# Developer pattern for Organization Policy Service
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Organization Policy Service")

Terraform / IaC starter

# Terraform starter for Organization Policy Service
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "organization_policy_" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}

IAM and security design

For Organization Policy Service, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-organization-policy-service@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-organization-policy-service \
  --display-name="Organization Policy Service runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-organization-policy-service@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Organization Policy Service is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Organization Policy Service does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Organization Policy Service with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Organization Policy Service solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Cloud Identity

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Cloud Identity

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Cloud Identity.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud iam service-accounts create svc-cloud-identity --display-name="Cloud Identity service account"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-cloud-identity@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

Developer code / usage pattern

# Developer pattern for Cloud Identity
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Cloud Identity")

Terraform / IaC starter

# Terraform starter for Cloud Identity
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "cloud_identity" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}

IAM and security design

For Cloud Identity, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-cloud-identity@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-cloud-identity \
  --display-name="Cloud Identity runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-cloud-identity@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Cloud Identity is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Cloud Identity does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Cloud Identity with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Cloud Identity solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Identity Platform

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Identity Platform

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Identity Platform.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud iam service-accounts create svc-identity-platform --display-name="Identity Platform service account"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-identity-platform@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

Developer code / usage pattern

# Developer pattern for Identity Platform
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Identity Platform")

Terraform / IaC starter

# Terraform starter for Identity Platform
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "identity_platform" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}

IAM and security design

For Identity Platform, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-identity-platform@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-identity-platform \
  --display-name="Identity Platform runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-identity-platform@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Identity Platform is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Identity Platform does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Identity Platform with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Identity Platform solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Identity-Aware Proxy IAP

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Identity-Aware Proxy IAP

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Identity-Aware Proxy IAP.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud iam service-accounts create svc-identity-aware-proxy-iap --display-name="Identity-Aware Proxy IAP service account"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-identity-aware-proxy-iap@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

Developer code / usage pattern

# Developer pattern for Identity-Aware Proxy IAP
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Identity-Aware Proxy IAP")

Terraform / IaC starter

# Terraform starter for Identity-Aware Proxy IAP
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "identity_aware_proxy" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}

IAM and security design

For Identity-Aware Proxy IAP, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-identity-aware-proxy-iap@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-identity-aware-proxy-iap \
  --display-name="Identity-Aware Proxy IAP runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-identity-aware-proxy-iap@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Identity-Aware Proxy IAP is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Identity-Aware Proxy IAP does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Identity-Aware Proxy IAP with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Identity-Aware Proxy IAP solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Secret Manager

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Secret Manager

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Secret Manager.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud iam service-accounts create svc-secret-manager --display-name="Secret Manager service account"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-secret-manager@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/secretmanager.secretAccessor"

Developer code / usage pattern

from google.cloud import secretmanager

client = secretmanager.SecretManagerServiceClient()
name = "projects/PROJECT_ID/secrets/db-password/versions/latest"
response = client.access_secret_version(request={"name": name})
secret_value = response.payload.data.decode("UTF-8")
print("Secret loaded securely")

Terraform / IaC starter

# Terraform starter for Secret Manager
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "secret_manager" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}

IAM and security design

For Secret Manager, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-secret-manager@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-secret-manager \
  --display-name="Secret Manager runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-secret-manager@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/secretmanager.secretAccessor"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Secret Manager is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Secret Manager does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Secret Manager with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Secret Manager solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Cloud KMS

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Cloud KMS

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Cloud KMS.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud iam service-accounts create svc-cloud-kms --display-name="Cloud KMS service account"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-cloud-kms@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

Developer code / usage pattern

# Encrypt/decrypt is normally done with client libraries or integrated CMEK.
# Example CLI pattern:
gcloud kms keyrings create app-keyring --location=global
gcloud kms keys create app-key --keyring=app-keyring --location=global --purpose=encryption

Terraform / IaC starter

# Terraform starter for Cloud KMS
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "cloud_kms" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}

IAM and security design

For Cloud KMS, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-cloud-kms@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-cloud-kms \
  --display-name="Cloud KMS runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-cloud-kms@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/cloudkms.cryptoKeyEncrypterDecrypter"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Cloud KMS is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Cloud KMS does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Cloud KMS with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Cloud KMS solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Cloud HSM

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Cloud HSM

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Cloud HSM.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud iam service-accounts create svc-cloud-hsm --display-name="Cloud HSM service account"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-cloud-hsm@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

Developer code / usage pattern

# Developer pattern for Cloud HSM
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Cloud HSM")

Terraform / IaC starter

# Terraform starter for Cloud HSM
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "cloud_hsm" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}

IAM and security design

For Cloud HSM, avoid using broad project Owner or Editor roles. Prefer a dedicated service account such as svc-cloud-hsm@PROJECT_ID.iam.gserviceaccount.com, grant only required roles, and document why each permission is needed.

gcloud iam service-accounts create svc-cloud-hsm \
  --display-name="Cloud HSM runtime identity"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-cloud-hsm@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

# Production note:
# Replace broad roles with the narrowest predefined or custom role.
# Review the official IAM roles reference before granting access.

Monitoring, logs, audit, and operations

• Enable Cloud Audit Logs and review admin activity for creation, deletion, and IAM changes.
• Use Cloud Logging for application events, errors, request logs, and security-relevant events.
• Create Cloud Monitoring dashboards and alert policies for latency, errors, saturation, cost, and quota signals.
• Tag or label resources with env, owner, app, and cost-center.
• Create a runbook: how to deploy, rollback, rotate credentials, handle incidents, and clean up safely.

Production architecture scope

In production, Cloud HSM is rarely used alone. It normally connects with IAM, service accounts, Cloud Logging, Cloud Monitoring, VPC or private connectivity when applicable, Secret Manager, Cloud KMS/CMEK if required, CI/CD, budgets, quotas, and architecture review. Decide whether the workload is dev/test/prod, whether it must be regional or multi-regional, and how data will be backed up or recovered.

Business use cases

Common mistakes and fixes

• Using Owner or Editor roles instead of least-privilege predefined/custom roles.
• Forgetting to enable billing alerts, quotas, logs, or cleanup policies.
• Testing only from the console and not saving repeatable CLI/IaC steps.

Beginner to expert practice path

• Beginner: open the official documentation and identify what Cloud HSM does, what problem it solves, and what resource is created.
• Junior developer: create a small lab resource in a dev project, test it with gcloud or SDK, and delete it after testing.
• Intermediate developer: connect Cloud HSM with IAM, logging, monitoring, networking, and another Google Cloud service.
• Production developer: define Terraform/IaC, least-privilege roles, alerts, backups or rollback, cost labels, and runbook.
• Expert: design multi-environment, secure, observable, cost-optimized architecture and explain trade-offs to stakeholders.

Interview / viva questions

1. What problem does Cloud HSM solve and when should you not use it?
2. Which IAM roles or service account pattern would you use for a production workload?
3. How do you monitor failures, cost, quota usage, and security events?
4. How would you create the same setup using Console, gcloud, and Terraform?
5. What are the most common production mistakes for this service?

Official Google Cloud links

Certificate Authority Service

Core concepts you must know

Capability-by-capability learning checklist

How to create / configure Certificate Authority Service

1. Step 1: Create or select the correct project and billing account.
2. Step 2: Enable the API or product needed for Certificate Authority Service.
3. Step 3: Create a dedicated service account for application/runtime access.
4. Step 4: Grant only the minimum IAM roles needed for the lab or workload.
5. Step 5: Create the resource using Console, gcloud, SDK, Terraform, or CI/CD.
6. Step 6: Configure region, networking, encryption, logging, monitoring, labels, and budget controls.
7. Step 7: Test success and failure paths, then document cleanup commands and production runbook.

gcloud / CLI starter

gcloud iam service-accounts create svc-certificate-authority-servic --display-name="Certificate Authority Service service account"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:svc-certificate-authority-servic@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

Developer code / usage pattern

# Developer pattern for Certificate Authority Service
# 1. Enable the service API.
# 2. Create the resource using console, gcloud, Terraform, or SDK.
# 3. Attach least-privilege IAM.
# 4. Enable logs/metrics/alerts.
# 5. Test in dev, then promote with IaC.

print("Ready to build with Certificate Authority Service")

Terraform / IaC starter

# Terraform starter for Certificate Authority Service
# Find exact resource names in the Google provider docs.
# Use variables for project_id, region, environment, labels, and IAM bindings.

resource "google_project_service" "certificate_authorit" {
  project = var.project_id
  service = "SERVICE_API_NAME"
}