Learn Google Cloud

How Google Cloud is laid out physically (regions, zones) and how its services group into compute, storage, data and AI.

Find your way around the Google Cloud console and use Cloud Shell, a free browser terminal with gcloud already signed in.

The resource hierarchy: an organization node, nested folders and projects that own every resource, and what is inherited down the tree.

Install and initialise gcloud, manage named configurations, enable APIs, and shape output with --format and --filter.

How projects are linked to billing accounts, what the free trial and Always Free tier cover, and what happens when billing is removed.

Who can do what: principals, basic vs predefined roles, allow-policy bindings and how inheritance combines them.

Identities for workloads: create service accounts, attach them to resources, and avoid long-lived keys.

How client libraries find credentials (Application Default Credentials) and how to run local code as a service account without keys.

Create, connect to and manage virtual machines: machine types, images, disks, SSH and Spot VMs.

Run identical VMs from an instance template with autoscaling, autohealing and rolling updates.

Global VPC networks, regional subnets, auto vs custom mode, internal and external IPs, and routes.

Stateful VPC firewall rules: implied rules, priorities, and targeting by network tag or service account.

Choose between Application and Network load balancers, wire forwarding rule to backends, and cache at the edge with Cloud CDN.

Keep workloads off the public internet with Cloud NAT, Private Google Access, private service access, Shared VPC and Private Service Connect.

Store files as objects in buckets: create buckets, upload and download with gcloud storage, and control access.

Match storage class to access pattern, automate transitions and deletion with lifecycle rules, and protect data with versioning.

Managed PostgreSQL, MySQL and SQL Server: editions, high availability, backups and secure connections.

When to pick Firestore, Bigtable, Spanner, AlloyDB, Cloud SQL, Memorystore or BigQuery, by data model, scale and consistency needs.

How Spanner achieves external consistency with TrueTime, splits and Paxos, and how to design keys and interleaving to avoid hotspots.

Deploy a container (or source code) as an autoscaling HTTPS service that scales to zero, and control access, scaling and revisions.

Deploy single-purpose functions triggered by HTTP or by events from Cloud Storage, Pub/Sub and more via Eventarc.

Store container images and language packages in regional repositories, authenticate Docker, and manage access and cleanup.

Build, test and deploy with cloudbuild.yaml steps, substitutions and Git-triggered builds running as a dedicated service account.

Run Kubernetes on Google Cloud: Autopilot vs Standard clusters, release channels, VPC-native networking and exposing workloads.

Workload Identity Federation for GKE, private nodes and control-plane access, network policy, Binary Authorization and upgrade safety.

Decouple services with topics and subscriptions: pull vs push, acknowledgements, retries, dead-letter topics and ordering.

What BigQuery is, how datasets and tables are organised, how you are billed, and how to query and load data from the CLI.

Google Cloud's AI platform: Gemini and Model Garden models, custom training, endpoints, pipelines and the Gen AI SDK.

Find logs with the Logging query language, write structured logs, and route them with buckets and sinks.

Metrics, dashboards, uptime checks and alerting policies with notification channels, plus SLOs.

Manage Google Cloud resources declaratively with the Terraform google provider, remote state in Cloud Storage and service account impersonation.

Budgets and alerts, billing export to BigQuery, labels for attribution, committed use and Spot discounts, and recommenders.

Store API keys and passwords as versioned secrets, grant access per secret, and inject them into Cloud Run and code.

Key rings, keys and versions in Cloud KMS, envelope encryption, CMEK for Google services, and HSM or external keys.

Custom roles, IAM Conditions, deny policies, Workload Identity Federation for external workloads, and analysing effective access.

Guardrails that restrict how resources may be configured: list and boolean constraints, custom constraints, inheritance and dry run.

Service perimeters that block data exfiltration through Google APIs, with access levels, ingress/egress rules and dry-run rollout.

Which Cloud Audit Logs exist and are on by default, enabling Data Access logs, and centralising logs with aggregated sinks.