Back to All Cheatsheet Libraries cheatsheets

Google Cloud Platform

gcloud CLI command reference and core service reference for Google Cloud Platform.

Organization (tied to a Cloud Identity / Workspace domain) └── Folder (optional nesting — by department, environment, team) └── Project (billing + API + quota + IAM boundary) └── Resource (VM, bucket, database…) IAM policies inherit DOWNWARD and are ADDITIVE. A role granted at the org level cannot be revoked lower down.

Level	What it bounds	Notes
Organization	Everything. Root of the hierarchy.	Requires Cloud Identity or Workspace. Personal Gmail accounts get projects with no org above them.
Folder	Grouping for IAM and org policy.	Nestable. The usual pattern is folder per environment or per business unit.
Project	Billing, APIs, quotas, IAM.	Project ID is globally unique and permanent. The name can change; the ID never can.
Resource	The actual object.	Regional, zonal, or global depending on type — this distinction matters constantly.

Global, regional, zonal

Global: VPC networks, firewall rules, images, global load balancers. GCP's VPCs being global is unusual and genuinely useful — one VPC can span every region with no peering.
Regional: subnets, regional managed instance groups, Cloud Run services, regional disks.
Zonal: VM instances, standard persistent disks. A zone is a single failure domain.
Many commands need --zone or --region. Set defaults with gcloud config set compute/zone to stop typing them.
A zonal resource is lost if the zone is lost. Spread across zones for anything that matters.

APIs must be enabled per project

Every service is off by default in a new project. gcloud services enable compute.googleapis.com.
This is the most common "why doesn't this work" for newcomers — the error names the API and gives you the enable command.
Enabling can take a minute to propagate; an immediate retry may still fail.
gcloud services list --available shows everything; --enabled shows what's on.

Group	Command	Does
Auth	`gcloud auth login`	Sign in for CLI use.
Auth	`gcloud auth application-default login`	Separate credential for SDKs and Terraform. Not the same as the line above — you usually need both.
Auth	`gcloud auth list`	Which accounts are authenticated and which is active.
Config	`gcloud config list`	Active project, account, region, zone. Check before anything destructive.
Config	`gcloud config set project PROJECT_ID`	Set the active project.
Config	`gcloud config configurations create NAME`	Named profiles — switch project, account, and region as a set.
Projects	`gcloud projects list`	Every project you can see.
Projects	`gcloud services enable SERVICE.googleapis.com`	Turn on an API. Required before nearly anything else works.
Compute	`gcloud compute instances list`	VMs across all zones in the project.
Compute	`gcloud compute ssh NAME --zone ZONE`	SSH with automatic key provisioning. No key management needed.
Compute	`gcloud compute instances stop NAME`	Stops compute billing. Disks keep billing.
Compute	`gcloud compute ssh NAME -- -L 8080:localhost:80`	SSH tunnel — everything after `--` goes to ssh itself.
Storage	`gcloud storage ls gs://BUCKET`	The modern replacement for `gsutil`, and noticeably faster.
Storage	`gcloud storage rsync -r SRC gs://BUCKET`	Sync a directory tree.
Storage	`gcloud storage cp -r gs://BUCKET/path ./local`	Recursive copy in either direction.
GKE	`gcloud container clusters get-credentials C --region R`	Write cluster credentials into kubeconfig.
GKE	`gcloud container clusters list`	Clusters with version and node count.
Run	`gcloud run deploy SVC --source .`	Builds and deploys from source in one command. No Dockerfile required.
Run	`gcloud run services describe SVC --region R`	URL, revision, traffic split, and config.
Logs	`gcloud logging tail "resource.type=cloud_run_revision"`	Live log stream with a filter.
Logs	`gcloud logging read "severity>=ERROR" --limit 50 --freshness=1h`	Query historical logs from the CLI.
IAM	`gcloud projects get-iam-policy PROJECT`	Every binding on the project.
IAM	`gcloud projects add-iam-policy-binding P --member=... --role=...`	Grant a role. Members are prefixed `user:`, `group:`, or `serviceAccount:`.
Output	`gcloud ... --format="table(name,status)"`	Built-in formatter — table, json, yaml, value, csv.
Output	`gcloud ... --filter="status=RUNNING"`	Server-side filtering. Faster than piping to grep.

Category	Service	Use for	AWS analogue
Compute	Compute Engine	VMs. Custom machine types let you pick exact vCPU and RAM.	EC2
Compute	Cloud Run	Serverless containers, scale to zero. GCP's standout service — deploy from source in one command.	App Runner / Fargate
Compute	GKE	Managed Kubernetes. Autopilot mode manages nodes for you.	EKS
Compute	Cloud Functions	Event-driven functions. Gen 2 runs on Cloud Run underneath.	Lambda
Storage	Cloud Storage	Objects. Standard / Nearline / Coldline / Archive.	S3
Storage	Persistent Disk	Block storage. Resizable while attached.	EBS
Storage	Filestore	Managed NFS.	EFS
Data	BigQuery	Serverless analytics warehouse. The reason many teams choose GCP.	Redshift / Athena
Data	Cloud SQL	Managed MySQL, PostgreSQL, SQL Server.	RDS
Data	Firestore	Serverless document database with realtime sync.	DynamoDB
Data	Spanner	Globally distributed relational with strong consistency. Expensive but unique.	Aurora Global (roughly)
Data	Pub/Sub	Global messaging. At-least-once delivery.	SNS + SQS
Network	VPC	Global by default — one network spanning every region, no peering.	VPC (regional)
Network	Cloud Load Balancing	Global anycast load balancing with a single IP.	ALB / NLB
Network	Cloud Armor	WAF and DDoS protection.	AWS WAF + Shield
Ops	Cloud Logging / Monitoring	Logs, metrics, alerts, uptime checks.	CloudWatch
Ops	Secret Manager	Versioned secrets with IAM control.	Secrets Manager
Ops	Artifact Registry	Container images and packages. Replaces Container Registry.	ECR

# From a directory containing your app — no Dockerfile needed, # Cloud Build detects the language and uses buildpacks. gcloud run deploy my-api \ --source . \ --region us-central1 \ --allow-unauthenticated # Private by default instead (omit --allow-unauthenticated), # then grant a specific caller: gcloud run services add-iam-policy-binding my-api \ --member="serviceAccount:caller@project.iam.gserviceaccount.com" \ --role="roles/run.invoker" --region us-central1 # Gradual rollout — 10% to the newest revision gcloud run services update-traffic my-api \ --to-revisions=LATEST=10 --region us-central1 # Wire a secret in as an env var gcloud run services update my-api \ --set-secrets=DB_PASSWORD=my-secret:latest --region us-central1

How IAM actually works here

A policy binds members to roles at a resource. Bindings inherit downward and are purely additive.
There is no simple deny. A role granted at the org or folder level cannot be taken away at the project level. IAM Deny Policies exist but are a separate, more limited mechanism.
Three role types: basic (Owner/Editor/Viewer — far too broad, avoid), predefined (per-service, the right default), and custom.
Editor is close to Owner in practice. It can modify almost everything. Don't hand it out casually.
Grant to groups, not individuals.
gcloud projects get-iam-policy plus the Policy Troubleshooter in the console answers "why can this account do that".

Service accounts

A service account is both an identity and a resource — you grant it roles, and you grant others the right to use it.
Attach a service account to the resource (VM, Cloud Run, GKE workload) rather than downloading a key. Credentials are then handled automatically.
Downloaded JSON keys are the single biggest GCP security risk. They don't expire, they're frequently committed to repos, and they're the root cause of most GCP breaches. Use constraints/iam.disableServiceAccountKeyCreation to block them org-wide.
Workload Identity Federation lets GitHub Actions, AWS, or any OIDC provider assume a service account with no key at all. This is the correct answer for CI.
The default Compute Engine service account has Editor on the whole project. Replace it on anything you care about.
--impersonate-service-account lets you test as a service account without a key.

Org policy constraints

Separate from IAM: guardrails on what can be configured, not who can do it.
High-value ones: disable service-account key creation, require OS Login, restrict public IPs, restrict which regions can be used, enforce uniform bucket-level access.
Set at org or folder level and inherited. A blocked action returns a policy error naming the constraint.
Worth configuring before handing projects to teams — retrofitting means breaking existing workloads.

Gotchas

Billing surprises

BigQuery on-demand bills per byte scanned, not per row returned. A SELECT * on a large table is a genuinely expensive keystroke. Always select specific columns, use partitioned tables, and check the estimate the console shows before running.
Set maximum bytes billed on BigQuery queries as a hard stop.
Stopping a VM doesn't stop disk billing. Persistent disks bill while they exist.
Egress is charged, including between regions and between zones. Cross-zone chatter adds up quietly.
Cloud Run scales to zero and bills per request — but a minimum-instances setting bills continuously.
A billing budget alert doesn't cap spend, it only notifies. There is no hard spending cap; wire the alert to a Pub/Sub function if you need one.

Other things that catch people

APIs are disabled by default in every new project. The first error in any new project is usually this.
Project ID is permanent and globally unique. Choose carefully — you cannot rename it later, only the display name.
gcloud auth login and gcloud auth application-default login are different credentials. Terraform and client libraries use the second; the CLI uses the first. "It works in gcloud but not Terraform" is nearly always this.
Deleting a project is a 30-day soft delete — recoverable, but it still stops everything immediately.
Quotas are per project per region and often surprisingly low on new accounts. Increases go through a request form.
gsutil is legacy; gcloud storage is the supported and much faster replacement.
Firewall rules are global and priority-ordered, applied by network tag or service account. There's an implied deny-ingress and allow-egress at the bottom.
Basic roles (Owner/Editor/Viewer) predate predefined roles and are far too broad. Their continued prominence in tutorials is a trap.

Tips

Named configurations

gcloud config configurations create prod then activate switches project, account, and region as a set. Far safer than editing one property at a time.

--filter and --format

Filtering happens server-side, so it's faster than grep, and --format="value(name)" gives clean output for shell loops with no parsing.

Workload Identity Federation

Lets GitHub Actions authenticate to GCP with no service-account key at all. If you have a JSON key in a CI secret today, this replaces it.

Impersonate, don't download

--impersonate-service-account=SA@project.iam.gserviceaccount.com tests as a service account using your own login. No key file involved.

Cap BigQuery queries

--maximum_bytes_billed refuses to run a query that would scan more than you allow. Cheap insurance against an accidental full-table scan.

Cloud Shell

shell.cloud.google.com — authenticated, with gcloud, kubectl, and Terraform preinstalled, plus 5 GB of persistent home directory. Free.

Resources

gcloud CLI reference Every command group and flag, with examples. cloud.google.com Cloud Architecture Center Reference architectures and the GCP Well-Architected Framework. cloud.google.com Workload Identity Federation Keyless authentication from GitHub Actions, AWS, or any OIDC provider. cloud.google.com BigQuery cost controls Partitioning, clustering, and byte limits — read this before your first large query. cloud.google.com Organization policy constraints Guardrails worth setting before handing projects to teams. cloud.google.com Always Free tier A genuinely usable permanent free tier — e2-micro, 5 GB storage, 2M Cloud Run requests. cloud.google.com Kubernetes GKE is managed Kubernetes — the object model and kubectl are identical. build.ty1er.com Terraform Remember it needs application-default credentials, not your gcloud login. build.ty1er.com

Google Cloud Platform

The project is the unit of everything

Cloud Run from zero

Gotchas

Tips

Resources