Google Cloud: Networking, IAM & CLI

gcloud CLI Essentials

# Auth
gcloud auth login
gcloud auth application-default login   # for SDK/library auth
gcloud config set project my-project
gcloud config set compute/region europe-west1

# Switch between projects/configs
gcloud config configurations create staging
gcloud config configurations activate production

# Common shortcuts
gcloud projects list
gcloud services enable run.googleapis.com
gcloud services enable cloudbuild.googleapis.com

# Secrets
gcloud secrets create my-secret --data-file=secret.txt
gcloud secrets versions access latest --secret=my-secret
# Mount in Cloud Run:
#   --set-secrets DATABASE_URL=my-secret:latest

IAM

• Project IAM: who can do what across the entire project

• Service accounts: identity for GCP resources (Cloud Run, GKE pods) — not for humans

• Roles: Basic (Owner/Editor/Viewer), Predefined (roles/run.invoker), Custom

• Workload Identity: bind GKE pod's Kubernetes service account to a GCP service account — no key files

• Principle of least privilege: grant minimum permissions needed

# Grant role to a user
gcloud projects add-iam-policy-binding my-project \
  --member="user:alice@example.com" \
  --role="roles/run.invoker"

# Create service account
gcloud iam service-accounts create my-sa \
  --display-name="My Service Account"

# Grant service account access to a resource
gcloud storage buckets add-iam-policy-binding gs://my-bucket \
  --member="serviceAccount:my-sa@my-project.iam.gserviceaccount.com" \
  --role="roles/storage.objectViewer"

VPC & Networking

# Create VPC and subnet
gcloud compute networks create my-vpc --subnet-mode=custom
gcloud compute networks subnets create my-subnet \
  --network=my-vpc \
  --region=europe-west1 \
  --range=10.0.0.0/24

# Firewall rules
gcloud compute firewall-rules create allow-http \
  --network=my-vpc \
  --allow=tcp:80,tcp:443 \
  --target-tags=http-server

# Cloud Armor (WAF + DDoS protection)
gcloud compute security-policies create my-policy
gcloud compute security-policies rules create 1000 \
  --security-policy=my-policy \
  --expression="inIpRange(origin.ip, '0.0.0.0/0')" \
  --action=allow

# Cloud Load Balancing
# Global HTTP(S) LB → Backend services → NEGs (Network Endpoint Groups)
# Cloud Run NEG allows LB → Cloud Run directly (no proxy needed)

Cost Optimization

• Committed use discounts: 1-3 year commitments → 37-55% savings on GCE/GKE

• Spot VMs: 60-91% cheaper than on-demand — can be preempted, good for batch workloads

• Cloud Run: scale to zero — no cost when idle

• BigQuery: partition and cluster tables to minimize bytes scanned; use slots pricing for predictable cost

• Budget alerts: Billing → Budgets & Alerts → set threshold notifications

• Cloud billing export to BigQuery: analyze GCP costs with SQL

• Recommender API: automatic cost and performance recommendations per service