gcloud Cheat Sheet
The CLI family: gcloud (most things), gcloud storage (objects; successor to
gsutil), bq (BigQuery), kubectl (GKE workloads), cbt (Bigtable). Exam questions
test which tool AND rough syntax.
Identity & projects
gcloud init # interactive setup
gcloud config set project MY_PROJECT
gcloud config set compute/zone us-central1-a
gcloud config configurations create dev # named profiles
gcloud auth list # accounts with stored credentials
gcloud config list project # active project
echo $DEVSHELL_PROJECT_ID # active project ID (Cloud Shell env var)
gcloud projects list
gcloud services enable compute.googleapis.com
gcloud projects add-iam-policy-binding MY_PROJECT \
--member="user:jane@example.com" --role="roles/viewer"
gcloud iam service-accounts create my-sa
gcloud iam service-accounts disable my-sa@PROJECT.iam.gserviceaccount.com # prefer over delete
# let a caller impersonate an SA
gcloud iam service-accounts add-iam-policy-binding TARGET_SA \
--member="user:jane@example.com" --role="roles/iam.serviceAccountTokenCreator"
gcloud compute instances list --impersonate-service-account=TARGET_SA
gcloud auth print-access-token --impersonate-service-account=TARGET_SA
gcloud auth activate-service-account --key-file=key.json # off-GCP only
gcloud iam roles create bucketReader --project=PROJECT \
--permissions=storage.buckets.get,storage.objects.get --stage=GA
gcloud iam roles describe roles/storage.objectViewer
gcloud resource-manager org-policies enable-enforce \
constraints/iam.disableServiceAccountKeyCreation --project=PROJECT
gcloud projects add-iam-policy-binding PROJECT \
--member="serviceAccount:PROJECT.svc.id.goog[NS/KSA]" \
--role="roles/iam.workloadIdentityUser"
kubectl annotate serviceaccount KSA -n NS \
iam.gke.io/gcp-service-account=GSA@PROJECT.iam.gserviceaccount.com
Compute & containers
gcloud compute instances create vm1 --machine-type=e2-medium
gcloud compute instances list
gcloud compute ssh vm1 --zone=us-central1-a
gcloud compute ssh vm1 --zone=us-central1-a --tunnel-through-iap # no external IP
gcloud compute scp local.txt vm1:remote.txt --zone=us-central1-a # copy file to VM
gcloud compute snapshots create snap1 --source-disk=disk1
gcloud compute instance-groups managed create ... # MIG from a template
gcloud container clusters create-auto my-cluster --region=us-central1
gcloud container clusters get-credentials my-cluster # wires kubectl
kubectl get pods / kubectl get services
kubectl create deployment app --image=gcr.io/proj/img
kubectl scale deployment app --replicas=3
gcloud compute resource-policies create snapshot-schedule daily-snap \
--region=us-central1 --max-retention-days=14 --daily-schedule --start-time=03:00
gcloud compute disks add-resource-policies disk1 --resource-policies=daily-snap --zone=us-central1-a
gcloud compute images create img1 --source-disk=disk1 --source-disk-zone=us-central1-a
gcloud compute project-info add-metadata --metadata enable-oslogin=TRUE
gcloud run deploy my-svc --image=REGION-docker.pkg.dev/PROJECT/repo/img --region=us-central1
gcloud run services update-traffic my-svc --to-revisions=my-svc-00002=10 # 10% canary
gcloud run services update-traffic my-svc --to-latest # promote / rollback
Data
gcloud storage buckets create gs://my-bucket --location=US
gcloud storage cp local.txt gs://my-bucket/
gcloud storage ls gs://my-bucket
gcloud storage buckets update gs://my-bucket --lifecycle-file=policy.json
bq ls
bq query --use_legacy_sql=false 'SELECT ... FROM `ds.table`'
bq load ds.table gs://bucket/data.csv schema.json
Ops
gcloud billing accounts list
gcloud billing projects link MY_PROJECT --billing-account=XXXXXX-XXXXXX-XXXXXX
gcloud services list --available # see enable-able APIs; --enabled for current
gcloud logging read 'severity>=ERROR' --limit=20 --freshness=1h
gcloud logging logs list
gcloud logging sinks create my-sink bigquery.googleapis.com/projects/P/datasets/D --log-filter='...'
gcloud beta monitoring channels list
gcloud alpha monitoring policies list
terraform init # download providers
terraform plan # preview changes
terraform apply # provision
terraform destroy # tear down