📘 Day 1: GCP Fundamentals & IAM

---

🔹 1. What is GCP?

GCP (Google Cloud Platform) is Google’s public cloud offering that provides services for:

• Compute (e.g., VMs, Kubernetes)

• Storage (e.g., Cloud Storage, Cloud SQL)

• Networking (e.g., VPC, Load Balancer)

• AI/ML, Big Data, DevOps tools

✅ Pay-as-you-go, scalable, reliable, and secure.

---

🔹 2. GCP Global Infrastructure

📌 Best Practice: Use multi-zone or multi-region services for high availability.

---

🔹 3. GCP Resource Hierarchy

scssCopyEditOrganization (Optional)
 └── Folder (Optional)
      └── Project (Mandatory)
           └── Resources (VMs, Buckets, etc.)

• A Project is the main boundary for billing, APIs, permissions, and quotas.

• Resources must belong to a project.

• Each project has a Project ID, Project Name, and Project Number.

---

🔹 4. Billing in GCP

• Billing is linked at the project level.

• You can set budgets, alerts, and quotas to control costs.

• Use Billing Reports to track usage.

• One billing account can be shared across multiple projects.

🔧 Try this later:
Go to Billing → Budgets & alerts and create a budget with 50% and 90% thresholds.

---

🔹 5. Identity & Access Management (IAM)

IAM controls who can do what on which resource.

✳️ IAM Components

✳️ IAM Role Types

✅ Principle of Least Privilege: Always give minimum required permissions.

🧠 Example:

You want a user to just read storage objects in a bucket:

• Assign the Storage Object Viewer role: roles/storage.objectViewer

---

🔐 Service Accounts

• Used by applications/VMs, not humans.

• Acts as an identity for apps to access GCP services securely.

• Attach a service account to a VM or GKE pod to grant it access to APIs (like writing to Cloud Storage).

---

🧪 Practice/Review Questions

1. What is the fundamental boundary for billing and resources in GCP?

   • A. Folder

   • B. Organization

   • ✅ C. Project

   • D. Region

2. Which IAM role is more secure and specific?

   • A. Owner

   • B. Viewer

   • ✅ C. Predefined role (e.g., Compute Viewer)

   • D. Editor

3. What's the best way to allow a VM to access Cloud Storage securely?

   • ✅ Use a service account with storage access role

---

✅ Summary: Day 1 Key Takeaways

• Understand the resource hierarchy and billing basics.

• Projects are the core unit of work.

• IAM is how access is controlled (Members + Roles + Resources).

• Always apply the least privilege principle.

• Service accounts = app identity.

🧠 GCP Day 1 Cheat Sheet: Fundamentals + IAM

---

🌍 1. GCP Global Infrastructure

✅ Key Concepts:

🧠 Why this matters:

• Deploying across multiple zones = High Availability.

• Multi-region = Great for services needing global redundancy (e.g., Cloud Storage multi-regional buckets).

---

📁 2. GCP Resource Hierarchy

scssCopyEdit(Optional) Organization
 └── (Optional) Folders (for grouping teams/departments)
      └── Project (Required)
           └── Resources (VMs, Buckets, Databases, etc.)

✅ Key Points:

• Every resource must be in a project.

• Projects are the core unit for:

  • Billing

  • API enablement

  • Access control

  • Resource management

• Each project has:

  • Project ID (unique, unchangeable)

  • Project Name (editable label)

  • Project Number (system-generated)

---

💰 3. Billing

• Billing is tied to projects.

• You can:

  • Set budgets and alerts

  • Use labels to track costs by team/service

  • Link multiple projects to one billing account

✅ Tools:

• Billing Reports: Visualize usage.

• Budgets & Alerts: Get notified at 50%, 90%, 100% usage.

• Cost Table Reports: CSV-style data export.

---

🔐 4. Identity and Access Management (IAM)

IAM = Who can do What on Which resource

🎯 Components:

---

🔑 Role Types

✅ Always prefer Predefined roles unless your use case is highly specific.

---

⚙️ How IAM Works

Policy Structure:

jsonCopyEdit{
 "bindings": [
   {
     "role": "roles/storage.admin",
     "members": [
       "user:john@example.com"
     ]
   }
 ]
}

• Policies are attached to resources (project, bucket, VM).

• Permissions flow down the hierarchy:

  • If a user has roles/storage.admin on the project, they can manage all buckets inside.

---

🤖 5. Service Accounts (SA)

Used for apps/scripts/services to interact with GCP securely.

• A non-human identity.

• Has IAM roles just like users.

• Can be attached to:

  • VMs

  • GKE pods

  • Cloud Functions

• GCP uses OAuth tokens or signed keys for SA auth.

---

📌 Best Practices Summary

---

✅ Quick Quiz for You

1. What’s the smallest deployable unit in GCP?

   • ✅ Project (everything is created inside it)

2. Can you create a resource (e.g., VM) without a project?

   • ❌ No – Every resource needs a project.

3. How do you grant a VM access to Cloud Storage?

   • ✅ Create a Service Account, assign roles/storage.objectViewer and attach to VM.