Rules & Shortcuts

The reasoning rules that decide questions, and the traps that are easiest to get backwards. Product-choice matrices live in Decision Tables; raw figures live in Numbers to Memorize. This page is everything else.

How to read a question

1. Find the constraint sentence. "Least privilege", "minimal downtime", "lowest cost", "cannot be bypassed", "must remain queryable", "global". Several options usually work - only one satisfies the constraint.
2. Eliminate impossible features. Options often describe a capability that does not exist (kubectl scale nodepool, "enable multi-format support on the repository"). Knowing the product eliminates these instantly.
3. Eliminate basic roles the moment "least privilege" appears.
4. Match signal words to products before reasoning any further.

Role names: read left of the dot

A predefined role is roles/<SERVICE>.<capability>. The service prefix is the truth; the noun after the dot is bait.

⚠GotchaThe four that catch everyone

• compute.storageAdmin - GCE disks, images, snapshots. Not Cloud Storage.
• storage.admin - GCS buckets. storage.objectAdmin - objects only, no bucket create/delete.
• compute.securityAdmin - firewall rules and SSL certificates.
• compute.networkAdmin - VPC, subnets, routes, but not firewall rules.

The iam.* family splits by what it acts on: securityAdmin = policies, serviceAccountAdmin = the SA objects, serviceAccountUser = using an SA, serviceAccountTokenCreator = tokens, serviceAccountKeyAdmin = keys.

⚠GotchaAnything that RUNS AS a service account needs serviceAccountUser

roles/run.admin alone cannot deploy Cloud Run - the revision runs as a service account, so the deployer also needs roles/iam.serviceAccountUser on it. Same for Compute Engine, App Engine and Cloud Run functions. The general shape: grant on the service account being borrowed, naming the borrower as the member. Impersonation, attach-to-VM and Workload Identity are all this same rule.

Billing roles

?DECISIONWhich billing role?

• Attach and detach projects - billing.user on the billing account plus billing.projectManager on the projects.
• Manage payment methods, budgets, exports - billing.admin on the billing account.
• View costs only - billing.viewer.

Pick this when: separate the account from the projects

⚠GotchaReports view vs BigQuery export

Quick cost breakdown by label, no setup - the Reports view in the Billing Console, grouped by Label. Long-term, SKU-level, joinable against your own data - billing export to BigQuery. The question's verb picks the answer.

Pairs that are easy to swap

⚠GotchaCloud NAT vs Private Google Access

Cloud NAT reaches the general internet (OS patches, third-party APIs). Egress only, regional, attaches to a Cloud Router. Private Google Access reaches Google Cloud APIs only (Cloud Storage, BigQuery) and is enabled on the subnet. A private subnet often needs both.

⚠GotchaMetrics scope vs aggregated sink

Monitoring and Logging are separate systems. One dashboard across many projects is a metrics scope with a scoping project. Exporting logs from many projects is an aggregated sink at the org or folder level.

⚠GotchaLog sink destination follows the verb

"Retain cheaply" - Cloud Storage with an Archive lifecycle rule. "Retain and query"

• BigQuery. Cost and queryability pull in opposite directions; the question says which one it wants.

⚠GotchaSLI, SLO, SLA

SLI is the measured number, SLO is your internal target, SLA is the customer contract that pays out. Measure, target, promise.

Firewall targeting

⚠GotchaService accounts beat network tags

Anyone who can edit an instance can change its network tags, so tag-based rules can be bypassed. Changing a VM's service account requires iam.serviceAccountUser. When a question stresses security, scale, or "cannot be bypassed by a developer", the answer is source and target service accounts.

Routes and firewall rules are evaluated independently - a route says where the next hop is, but without an allow rule the packet is still dropped. Implied rules sit at priority 65535: allow egress, deny ingress.

Things that are more flexible than they look

• Persistent disks resize up, online, no detach, and can be attached read-only to many VMs at once. They never shrink.
• Subnets expand with gcloud compute networks subnets expand-ip-range, no downtime.
• Machine type can change - but only while the VM is stopped.

Things that are less automatic than they look

• Spot VMs never auto-restart and never live-migrate. Put them in a MIG so something recreates them. ~30s shutdown warning (normal VMs get ~90s), 24 hour maximum.
• Budgets never stop spending. A real hard stop is budget -> Pub/Sub -> a function that unlinks the billing account.
• Active Assist only recommends. It never resizes or deletes anything.
• Instance templates are immutable - new template plus a rolling update.

Permanent for life

Name, zone, CPU platform and preemptibility on a VM. A bucket's location type. An App Engine application's region. A project ID. A custom role ID.

Not AWS

⚠GotchaGCS Archive is not Glacier

Every Cloud Storage class has identical 11-nines durability and millisecond first-byte latency. There is no thaw, no restore job. Only price and the availability SLA differ. The fee for deleting early is an early-delete fee - you are billed the full minimum duration (Nearline 30 days, Coldline 90, Archive 365).

Bigtable has no secondary indexes at all - the row key is the only access path, so a monotonic key such as a timestamp prefix creates hotspots.