CertifyDeckCargando contenido…
The official Google Cloud Certified Associate Cloud Engineer syllabus, organized by domain. Check off each point as you review it.
Inicia sesión para guardar tu progreso entre sesiones.
Setting up cloud projects and accounts
The Google Cloud resource hierarchy runs from the organization (the root, which requires Cloud Identity or Google Workspace) to optional folders and to projects; each resource has exactly one parent. IAM roles and organization policies set at one level are inherited downwards, so folders group departments or environments and delegate their administration. Folders are created with gcloud resource-manager folders create.
Organization policies restrict which configurations are allowed (locations, service account keys, public access to Cloud Storage), while IAM decides who can act. They are set on the organization, folders or projects and are inherited; in list rules denied values take precedence, and a child's boolean rule replaces the parent's. Most are not retroactive.
To give access in a project you grant a role to a principal (user, group or service account) with gcloud projects add-iam-policy-binding, which adds a binding without overwriting the policy. Predefined or custom roles are preferred over basic roles, and grants should go to groups. IAM conditions allow expiring access, but not with legacy basic roles.
Manage access to projects, folders, and organizations ↗Roles overview ↗
Cloud Identity centrally manages company-controlled users and groups. They can be created manually in the console or automated with Google Cloud Directory Sync from Active Directory (one-way sync, no passwords) plus SAML SSO, or with gcloud identity groups. Organizational units apply settings such as 2-step verification; access is managed with groups.
Federate Google Cloud with Active Directory ↗Overview of Google identity management ↗
Each Google Cloud service must be enabled in the project before use, from the console API Library or with gcloud services enable, which accepts several services at once; gcloud services list shows enabled or available ones. The Service Usage Admin role is required. Disabling an API does not delete Cloud Storage or BigQuery data, and --force also disables dependent services.
In Cloud Monitoring, the metrics scope of a scoping project (ideally a new one without resources) lets you monitor several projects from one place. The Ops Agent collects VM logs and metrics and is deployed at scale with agent policies. Cloud Logging routes entries with sinks to log buckets, Cloud Storage, BigQuery or Pub/Sub; folder or organization aggregated sinks use --include-children.
Quotas restrict how much of a resource a project (and also folders or organizations) can use and are allocation, rate or concurrent, and global, regional or zonal. You review them in the console and request increases ahead of time; an override below the default caps usage. Usage alerts notify you and the quota adjuster requests increases automatically. System limits cannot be raised.
Managing billing configuration
A Cloud Billing account defines who pays for the linked projects, operates in a single currency and is associated with a Google payments profile. In an organization, creating one requires the Billing Account Creator role. Country and currency cannot be changed, so another country needs another account. An Organization-type payments profile supports several users; an Individual one does not.
Create a new self-serve Cloud Billing account ↗Cloud Billing overview ↗
A project can use Google Cloud services only when it is linked to an active Cloud Billing account; each project links to one account, which can pay for many projects. You link or switch it with gcloud billing projects link, holding Billing Account User on the account and Project Billing Manager or Project Owner on the project. Disabling billing stops services and can delete resources.
Enable, disable, or change billing for a project ↗gcloud billing projects link ↗
Cloud Billing budgets compare actual or forecasted spend with an amount and send alerts when thresholds are crossed; they can cover the account, projects, folders, services or a label. By default they notify Billing Account Administrators and Users; Cloud Monitoring channels add other recipients. An alerts-only budget does not cap spend: automated responses use Pub/Sub notifications.
Create, edit, or delete budgets and budget alerts ↗Set up programmatic notifications ↗
Cloud Billing exports standard usage cost, resource-level detailed cost, pricing and CUD metadata to BigQuery, each enabled separately. Use a FinOps project linked to the same billing account, a multi-region dataset (it backfills the previous month) without table expiration, and the Billing Account Costs Manager or Administrator role; pricing data needs the BigQuery Data Transfer Service API.
Export Cloud Billing data to BigQuery ↗Set up Cloud Billing data export to BigQuery ↗