GCP Cloud Engineer Foundations — Review Deck
A visual review companion to the 8-part GCP Cloud Engineer Foundations course, aligned to the Associate Cloud Engineer exam: resource hierarchy, billing and IaC tooling, IAM, compute, GKE and serverless, storage and databases, networking, and observability.
Slides
GCP foundations in one line
Opening slide framing the course as the operational core every other GCP specialization builds on top of.
How the ACE exam maps to this course
Shows the four ACE exam domains and how the eight chapters cover them, plus where this course sits in the six-course GCP track.
GCP's geography and the project as the unit of isolation
GCP's VPC is global by default, unlike AWS/Azure's regional VPCs — and the project, not the account, is GCP's real isolation and billing boundary.
Organization, folders, and projects
The four-level resource hierarchy that GCP uses to inherit IAM and org policies downward from one root.
Org policies and how inheritance works
Org policies constrain what's allowed to exist, not who can act — and policy always flows down the hierarchy as a union that only gets stricter.
Labels, network tags, and resource manager tags
Three GCP mechanisms with overlapping names and genuinely different jobs — only one of them can gate an org policy or firewall rule.
Billing accounts, budgets, and cost control
A Cloud Billing account is a separate object from a project with its own IAM roles, and a budget only alerts unless you wire it to automation.
gcloud CLI, Cloud Shell, and client libraries
The operator toolkit for scripting, imperative changes, and quick debugging — distinct from the IaC tools on the next slide.
Terraform on GCP and the end of Deployment Manager
Terraform is the default IaC choice for foundational infrastructure; Deployment Manager is deprecated on a firm 2026-2027 timeline.
Gemini CLI, Cloud Assist, and Application Design Center
AI-generated infrastructure accelerates a first draft — it does not replace understanding what the output actually provisions.
Principals, roles, bindings, and policies
Four precise terms that describe how a permission ever reaches a resource — a permission is never granted directly, only through a role.
Primitive, predefined, custom roles, and IAM conditions
Primitive roles are a legacy compatibility layer that should almost never be used in production; conditions add context-aware narrowing to any binding.
Service accounts, keys, and impersonation
A service account is dual-natured — both a principal that holds roles and a resource that others can be granted access to act as — and a key file is the risky option, not the default one.
Workload Identity Federation
External workloads exchange their own platform's native identity for a short-lived GCP token — no GCP key file ever exists in the flow.
Break-glass access and IAM auditing
A sanctioned emergency access path is only legitimate if its use is heavily alerted — and three tools close the loop on every IAM decision this chapter made.
Choosing a machine family: E2, N4, C4
Three current machine families split cleanly by cost versus performance, and guessing the family without a load test leads to a permanently over-provisioned fleet.
Disks, OS Login, and VM Manager
Hyperdisk decouples IOPS from disk size where Persistent Disk doesn't, OS Login replaces per-instance SSH keys with IAM, and VM Manager makes fleet patching queryable.
Spot VMs and managed instance groups
Spot VMs trade a 60-91% discount for 30-second reclaim notice — a sound trade only when the workload's own architecture already tolerates losing an instance.
Autoscaling policies, health checks, GPUs and TPUs
An autoscaler always takes the largest signal recommendation, a badly-tuned health check causes false-positive churn, and GPUs/TPUs attach very differently.
GKE Autopilot vs Standard vs the 2026 hybrid option
Autopilot trades node-level control for zero operational overhead; Standard keeps full control at full VM cost; the 2026 hybrid mode ends the all-or-nothing choice.
Node pools and pod autoscaling
A node pool is Standard mode's own instance-group equivalent, and three distinct autoscalers each scale a genuinely different dimension inside Kubernetes.
Cloud Run revisions, traffic splitting, and functions
Every deploy creates a new immutable revision with zero traffic until explicitly assigned — the mechanism that makes canary rollouts and instant rollback both possible.
Choosing between GKE, Cloud Run, and Compute Engine
Three genuinely different workload shapes point to three different platforms — and Meridian's own three-way split proves the decision table rather than being arbitrary.
Cloud Storage classes and lifecycle management
Five storage classes trade access latency and retrieval cost against storage price, and Autoclass automates the choice when the access pattern isn't already well understood.
Choosing a managed database
Cloud SQL is the safe, well-lit default — every other product requires a specific, named reason Cloud SQL can't satisfy, not general enthusiasm for a more advanced-sounding name.
The managed database lineup
Six products covering genuinely different data shapes and scale profiles, each earning its complexity only for the specific problem it solves.
Connection pooling, read replicas, and Pub/Sub
A database can run out of connections before it runs out of capacity, a read replica solves read-scaling but not query performance, and Pub/Sub decouples ingestion from storage.
Backup, regional failover, and CMEK
Every managed database has a native backup mechanism, but an unrestored backup is an unverified assumption — and CMEK adds the ability to revoke data access by revoking a key.
VPC networks, subnets, and Shared VPC
Custom-mode VPCs give deliberate IP planning that auto-mode trades away, and Shared VPC reconciles project-per-environment isolation with the need for one consistent network.
Firewall rules, tags, and Cloud NAT
Firewall policies at the org level override project-level rules just like org policies do, service-account targeting beats network tags, and Cloud NAT is what makes no-public-IP still functional.
Load balancers, Cloud DNS, and Cloud CDN
Nine load balancer combinations exist across scope, exposure, and layer — picking the wrong tier can mean a routing requirement simply can't be implemented at all.
VPN, Interconnect, and private access
On-premises connectivity trades setup speed against bandwidth ceiling, and Private Google Access plus Private Service Connect solve two different private-connectivity problems.
How a request actually reaches shipment-api
Every networking mechanism this chapter covered sits on one ordered request path, not as independent, unrelated features.
Cloud Monitoring: metrics, dashboards, alerts
Cloud Monitoring collects metrics automatically with zero setup, and a log-based metric turns any log pattern into a first-class, alertable metric.
Cloud Logging: router, buckets, and audit logs
Every log entry passes through the Log Router before landing anywhere, and only one of three audit log types is enabled by default.
Trace, Profiler, Error Reporting, and Managed Prometheus
Four more tools each answer a genuinely different diagnostic question, and two of them are free with no cost barrier to adoption at all.
How the five Cloud Operations products fit together
Five products answer five genuinely different questions, and reaching for the wrong one for a given question is a common, avoidable inefficiency.
Readiness checklist
The minimum signals that a GCP foundation is actually production-ready, not just technically deployed.