Sefism.Cloud engineering: Google Cloud

Tauseef Fayyaz

Chapter 02

Cloud concepts and billing

How a cloud is organised and paid for: service models, shared responsibility, regions, how accounts are structured, the free offers, pricing models and budgets. Includes a service name map across the three providers.

IaaS, PaaS and SaaS

Also called infrastructure as a service, platform as a service, software as a service, IaaS, PaaS, SaaS

What: IaaS rents you virtual machines, disks and networks to manage yourself. PaaS runs your code or database while the provider handles servers. SaaS is finished software you just use.
Why: The model decides how much you patch, scale and secure yourself, and so how much work and risk you take on.
Example: A VM running your own PostgreSQL is IaaS. A managed PostgreSQL service is PaaS. A hosted email product is SaaS.

Watch out

Running everything on VMs out of habit, then spending your weeks patching operating systems a managed service would handle.

Shared responsibility model

Also called security of the cloud, security in the cloud

What: The provider secures the physical data centres, hardware and the platform. You secure what you put on it: identities, data, network rules, and on IaaS the operating system too.
Why: Most cloud breaches are customer misconfiguration, such as a public bucket or an over-powerful key, not a provider failure.

Watch out

Assuming a managed service means the provider also decides who can read your data. Access is always your job.

Regions and availability zones

Also called region, availability zone, AZ, zone

What: A region is a geographic area with its own data centres. Inside it, zones are separate data centres with independent power and networking, close enough for fast links.
Why: Spreading an app across zones survives one data centre failing. The region you pick also sets latency to users, prices and which services exist.

Watch out

Building in the default region far from your users, or putting every instance in one zone and calling it highly available.

Projects, folders and the organisation

Also called project, folder, organization node, project ID

What: Every Google Cloud resource lives in a project, which has its own ID, enabled APIs, IAM and billing link. Projects can sit in folders under an organisation node.
Why: A project is the unit you secure, bill and delete. One project per app and environment keeps mistakes and costs contained.

Shell

gcloud projects create shop-dev-4821
gcloud config set project shop-dev-4821
gcloud services enable compute.googleapis.com
gcloud projects delete shop-dev-4821

Watch out

Doing everything in the auto-created "My First Project" and never knowing which resources belong to what.

Google Cloud Free Trial and Free Tier

Also called free trial, welcome credit, always free, free tier

What: As of September 2026, new customers get 300 USD of welcome credit over 90 days. The Free Tier adds ongoing limits, such as one e2-micro VM a month in us-west1, us-central1 or us-east1 and 2 million Cloud Run requests a month.
Why: If you do not upgrade, the trial billing account closes and its resources stop, so the trial cannot bill you by surprise.

Watch out

Creating the free e2-micro in a region outside the three listed, where it is billed like any other VM.

On-demand, committed and spot pricing

Also called on-demand, reserved instances, savings plans, committed use discounts, spot

What: On-demand is pay per second or hour with no commitment. Committing to one or three years of usage buys a large discount. Spot capacity is spare capacity sold cheaply that can be taken back at short notice.
Why: The same workload can cost very different amounts depending on how you buy it, which is most of what cloud cost work is.
Example: AWS calls commitments Savings Plans and Reserved Instances, Azure calls them reservations and savings plans, Google Cloud calls them committed use discounts.

Watch out

Running a stateful database or a single important server on spot capacity and losing it mid-day.

Budgets and billing alerts

Also called budget, billing alarm, cost alert

What: A budget watches actual or forecast spend and emails you, or triggers an action, when it crosses thresholds you set, such as 50, 80 and 100 percent.
Why: It is the first thing to set up in any new account: most surprise bills are forgotten resources that a 10 USD alert would have caught in a day.

Watch out

Believing a budget is a hard cap. It alerts; it does not switch off your resources unless you wire up an action to do so.

Well-Architected frameworks

Also called Well-Architected Framework, pillars, architecture review

What: Each provider publishes a framework of design principles grouped in pillars such as security, reliability, performance, cost and operations, with review questions for a workload.
Why: It gives you a checklist for your own designs and the vocabulary that architecture reviews and associate-level exams use.

Watch out

Reading it cover to cover before building anything. Use it as a review checklist once you have something running.

Service map: compute and data

Also called AWS vs Azure vs GCP, service comparison, equivalent services

What: The same job has a different product name on each cloud. This table maps the compute, storage and database services you meet first.
Why: Knowing the equivalents lets you read tutorials, job posts and diagrams written for another provider and translate them to yours.

Code

Job        AWS            Azure            Google Cloud
VM         EC2            Virtual Machines Compute Engine
Scale set  Auto Scaling   VM Scale Sets    Managed inst. groups
Functions  Lambda         Functions        Cloud Run functions
Containers ECS, Fargate   Container Apps   Cloud Run
Kubernetes EKS            AKS              GKE
Objects    S3             Blob Storage     Cloud Storage
Disks      EBS            Managed Disks    Persistent Disk
Files      EFS            Azure Files      Filestore
SQL        RDS, Aurora    Azure SQL        Cloud SQL
NoSQL      DynamoDB       Cosmos DB        Firestore, Bigtable

Watch out

Assuming equivalent means identical: limits, pricing units and defaults differ, so check the docs of your provider.

Service map: network, identity and operations

Also called AWS Azure GCP equivalents, service names

What: The networking, identity, monitoring and infrastructure as code services on each cloud, side by side.
Why: These are the services every project touches, whatever it runs on, and the ones exam questions compare most.

Code

Job         AWS             Azure             Google Cloud
Network     VPC             Virtual Network   VPC
Firewall    Security group  NSG               Firewall rules
L7 LB       ALB             App Gateway       App Load Balancer
DNS         Route 53        Azure DNS         Cloud DNS
CDN         CloudFront      Front Door        Cloud CDN
Identity    IAM             Entra ID, RBAC    IAM
Secrets     Secrets Manager Key Vault         Secret Manager
Metrics     CloudWatch      Azure Monitor     Cloud Monitoring
Audit log   CloudTrail      Activity log      Cloud Audit Logs
IaC         CloudFormation  Bicep             Terraform

Watch out

Mapping VPC to VPC and stopping there: a Google Cloud VPC is global while AWS VPCs and Azure virtual networks are regional.

Go deeper