Free preview · Beginner · 17 min read
GCP Cloud Engineering Mental Model & Shared Responsibility
Understand Google Cloud as a programmable platform: resource hierarchy, APIs, identity, networks, managed services, operations, failure domains, and the cloud engineer’s responsibility boundary.
Google Cloud is not a menu of products to memorize. For a cloud engineer it is a programmable operating environment built from resource hierarchy, identities, APIs, networks, compute platforms, managed data services, observability and policy.
The cloud-engineering loop
Text
REQUIREMENT
↓
PROJECT + LOCATION + IDENTITY
↓
NETWORK + COMPUTE + DATA
↓
AUTOMATE / DEPLOY
↓
OBSERVE
↓
SECURE + SCALE + OPTIMIZE
↓
RECOVER + IMPROVE
For every workload, be able to answer:
- Where does it live? Organization/folder/project, region or zone, VPC and subnet.
- Who can access it? IAM principal, role, service account, network path and policy.
- Where is state stored? Cloud Storage, Persistent Disk, Cloud SQL, Spanner, Firestore, Bigtable, Memorystore, etc.
- How is it operated? Monitoring, Logging, Audit Logs, alerts, CI/CD, IaC, backup and incident response.
Shared responsibility changes with the service
| Service model | Google manages more of | You still own |
|---|---|---|
| Compute Engine | facilities, hardware, hypervisor | guest OS, packages, application, firewall design, data |
| GKE | managed Kubernetes control plane and platform components | workload config, IAM/RBAC, policies, images, application reliability |
| Cloud SQL | database infrastructure, maintenance options, backups/HA features | schema, users, queries, access, capacity choices, application behavior |
| Cloud Run | infrastructure, scaling platform, HTTPS endpoint | container/code, identity, configuration, concurrency, dependencies |
| Cloud Storage | object-storage infrastructure | IAM, lifecycle, retention, encryption choices, object exposure |
Popular service-selection map
| Need | Common GCP service |
|---|---|
| virtual machines | Compute Engine |
| managed Kubernetes | GKE |
| serverless containers | Cloud Run |
| object storage | Cloud Storage |
| relational database | Cloud SQL / AlloyDB / Spanner |
| document database | Firestore |
| wide-column database | Bigtable |
| cache | Memorystore |
| container/package registry | Artifact Registry |
| messaging | Pub/Sub |
| event routing | Eventarc |
| data warehouse | BigQuery |
| metrics/alerts | Cloud Monitoring |
| logs | Cloud Logging |
| secrets | Secret Manager |
| keys | Cloud KMS |
| IaC execution | Terraform / Infrastructure Manager |