ACE question patterns

Grant a predefined role such as roles/compute.instanceAdmin.v1 to a group at the project level or lower.

Basic roles (Owner, Editor) are too broad; predefined roles are maintained by Google and scoped to one service.

Create a custom role at the project or organization level with just those permissions.

Custom roles are for exact permission sets, but you must maintain them as services add permissions.

Deploy the container to Cloud Run.

It scales to zero and has no cluster or VM to manage.

Attach a dedicated service account to the resource and let Application Default Credentials find it.

Tokens come from the metadata server; there is no JSON key to leak or rotate.

Add a binding with a request.time condition.

Conditions give time-limited access without a follow-up cleanup task.

Set the resource locations organization policy.

It blocks creating resources outside the listed locations.

Run Google Cloud Directory Sync one way into Cloud Identity.

It automates provisioning so accounts aren't created by hand.

Open the Quotas page and request an increase, or use another region.

CPU quotas are regional allocation quotas.

Make one scoping project and add the other projects to its metrics scope.

A single scoping project gives shared dashboards and alerts.

Create a budget with threshold rules; add a Pub/Sub topic for automation.

Budgets notify only; they don't stop spend.

Enable billing export and use labels, then query in BigQuery.

Export holds detailed cost data but only from the day it is enabled.

Run it on Spot VMs, ideally in a managed instance group.

Spot is deeply discounted and can be preempted with 30 seconds' notice.

Create the VM with --custom-cpu and --custom-memory.

Custom types fit odd ratios and avoid paying for unused size.

Use Spanner, multi-region if needed.

It is the globally consistent horizontally scalable relational service.

Use Bigtable with a well-designed row key.

Wide-column NoSQL for high throughput and low latency; no joins.

Load or stream data into BigQuery.

It is the serverless data warehouse; not for OLTP.

Use Firestore in Native mode.

Serverless document database with client SDK sync.

Create a Cloud SQL instance; use Database Migration Service to move data.

Managed standard engines with automated backups and HA.

Store in Archive class, or use lifecycle rules to move there.

Lowest price; 365 day minimum; still millisecond access.

Use a regional persistent disk replicated across two zones.

Zonal disks fail with their zone.

Use the global external Application Load Balancer with Cloud CDN and Cloud Armor.

It is Layer 7, global and needs the Premium tier.

Use the external passthrough Network Load Balancer.

It doesn't proxy, so the source IP is preserved.

Configure Cloud NAT on a Cloud Router.

It gives outbound access without external IPs and accepts no inbound connections.

Make a host project and attach service projects; grant networkUser.

Central control with delegated use of subnets.

Create a peering from each side.

Not transitive; works across projects and organizations.

Use HA VPN with two tunnels and Cloud Router.

Interconnect is for bandwidth; VPN is fast to set up.

Create an allow rule with source tag/service account web and target db.

Targets by identity are tighter than IP ranges; service accounts are the safest.

Run gcloud compute networks subnets expand-ip-range with a shorter prefix.

Subnets can grow without disruption, never shrink.

Use gcloud compute ssh --tunnel-through-iap, allow 35.235.240.0/20 and grant iap.tunnelResourceAccessor.

No public IP or bastion host is needed.

Set enable-oslogin=TRUE and grant roles/compute.osLogin or osAdminLogin.

Access follows the IAM identity and can use 2-Step Verification.

Create a new template and run a rolling update.

Templates are immutable.

Attach a health check and set an autoscaling policy with a cool-down.

Autohealing recreates failed VMs; autoscaling follows CPU or other signals.

Use OS patch management with patch deployments.

It uses the OS Config agent across the fleet.

Run gcloud container clusters get-credentials and install the auth plugin.

It writes the kubeconfig context.

Enable autoscaling with min and max nodes on the node pool.

It adds nodes for pending Pods.

kubectl autoscale deployment with a CPU target.

HPA changes replica count; VPA changes resource requests.

Use a StatefulSet with volumeClaimTemplates.

Deployments give no stable identity.

Grant the node service account Artifact Registry Reader on the repository.

The node identity pulls the image.

Deploy with --no-traffic and a tag, then split with gcloud run services update-traffic.

Revisions are immutable and traffic is per revision.

Deploy a function with a storage object finalized event filter.

Events arrive as CloudEvents.

Set SetStorageClass and Delete rules with age conditions.

Automatic and no scripts.

Enable PITR (binary logs) and restore or clone to a timestamp.

Automated backups alone only restore to backup times.

Raise bucket retention, use Log Analytics, or route to BigQuery or Cloud Storage.

_Default keeps 30 days.

Grant the sink's writer identity access on the destination.

The sink service account needs write rights.

Install the Ops Agent.

The hypervisor doesn't see inside the guest.

Search Admin Activity logs in Logs Explorer.

Always on; Data Access logs are off by default.

Grant roles/iam.serviceAccountUser on that service account.

Attaching needs actAs on the account.

Grant serviceAccountTokenCreator and use --impersonate-service-account.

Short-lived tokens, and the caller is logged.

Create a pool and provider and map the external identity.

No service account keys.

Bind the Kubernetes service account to an IAM service account.

Per-Pod identity without node-wide access.