Gcp

---
name: gcp
description: "Google Cloud Platform architecture and strategy: cost-aware service selection across compute (Compute Engine, Cloud Run, Cloud Functions, GKE, App Engine), storage, databases (BigQuery, Cloud SQL, AlloyDB, Spanner, Firestore, Bigtable), networking, security posture, AI/ML (Vertex AI, TPUs, BigQuery ML), and data platform (Pub/Sub, Dataflow, Dataproc). Use when choosing between GCP services, sizing a GCP architecture, or optimizing GCP spend -- \"GCP\", \"Compute Engine vs Cloud Run\", \"GKE Autopilot vs Standard\", \"BigQuery cost\", \"Cloud SQL vs AlloyDB\", \"Spanner\", \"Vertex AI\". Do NOT use for gcloud CLI syntax (`cli-scripting`), Terraform/Config Connector authoring (`devops`), GKE ops (`containers`), DB engine tuning (`database`), VPC depth (`gcp-vpc` in `networking`), Cloud Storage depth (`gcs` in `storage`), IAM hardening (`security`), or Compute Engine instance sizing/images/host ops (the `cloud-vms` skill in `virtualization`)."
license: MIT
---

# Google Cloud Platform Technology Expert

This skill covers Google Cloud Platform across all service categories: deep knowledge of:

- Compute services (Compute Engine, Cloud Run, Cloud Functions, GKE, App Engine)
- Storage services (Cloud Storage, Persistent Disks, Hyperdisk, Filestore)
- Database services (BigQuery, Cloud SQL, AlloyDB, Spanner, Firestore, Bigtable, Memorystore)
- Networking (global VPC, Shared VPC, Load Balancing, Cloud CDN, Cloud Armor, Interconnect)
- Security and identity (IAM hierarchy, Workload Identity, VPC Service Controls, Secret Manager, SCC)
- AI/ML (Vertex AI, TPUs, BigQuery ML, Model Garden)
- Data platform (Pub/Sub, Dataflow, Dataproc, Composer, Eventarc)
- Cost optimization (SUDs, CUDs, custom machine types, billing export to BigQuery)

Every recommendation addresses the tradeoff triangle: **performance**, **cost**, and **operational complexity**. Prices are us-central1 unless noted.

## How to Approach Tasks

When you receive a request:

1. **Classify** the request by service category:
   - **Compute** -- Load `references/compute.md`
   - **Storage** -- Load `references/storage.md`
   - **Database** -- Load `references/database.md`
   - **Networking** -- Load `references/networking.md`
   - **Security / Identity** -- Load `references/security.md`
   - **AI / ML / Data Analytics** -- Load `references/ai-data.md`
   - **Cost optimization** -- Load `references/cost.md`
   - **Architecture** -- Load the relevant category reference plus `references/cost.md`

2. **Identify constraints** -- Budget, compliance requirements, team expertise (K8s experience matters for GKE vs Cloud Run), existing cloud investments.

3. **Load context** -- Read the relevant reference file for deep knowledge.

4. **Analyze** -- Apply GCP-specific reasoning with real cost data, not generic cloud advice.

5. **Recommend** -- Provide actionable guidance with cost estimates, gcloud commands or Terraform examples, and clear trade-off explanations.

6. **Verify** -- Suggest validation steps (Recommender, Cloud Monitoring, billing export queries, SCC findings).

## Core Expertise

### GCP Strategic Differentiators

**1. Sustained Use Discounts (SUDs) -- automatic, no commitment:**
GCP automatically discounts instances running >25% of the month. 100% monthly usage = ~30% discount. No reservation needed, no upfront payment. Applies to N1, N2, N2D, C2 families. AWS/Azure require manual RI/SP purchases for equivalent savings.

**2. Custom Machine Types -- eliminate waste:**
Specify exact vCPU (1-96) and memory (0.9-6.5 GB/vCPU) instead of fixed sizes. Extended memory allows up to 12 GB/vCPU. Available for N1, N2, N2D, E2. AWS/Azure force fixed instance sizes.

**3. BigQuery -- serverless data warehouse:**
No clusters to provision, no nodes to manage. Scales from bytes to petabytes. $6.25/TB scanned (on-demand) or slot-based editions. Google's own Dremel engine. Nothing equivalent in AWS/Azure.

**4. Cloud Run -- best serverless container model:**
Full OCI containers on serverless. Up to 1000 concurrent requests per instance (vs Lambda's 1). Amortizes cold starts, dramatically lower cost for high-throughput. No cluster management.

**5. Global VPC -- single VPC spans all regions:**
Subnets are regional, but one VPC covers the world without peering. Simplifies multi-region architectures. AWS/Azure VPCs are regional.

**6. Per-second billing and generous free tier:**
All compute bills per second (1-min minimum for VMs). Free tier includes: e2-micro VM, 2M Cloud Functions invocations, 1 TB BigQuery queries, 5 GB Cloud Storage, 2M Cloud Run requests per month.

### Compute Selection Strategy

| Model | Best For | Scale-to-Zero | Ops Complexity | Starting Cost |
|-------|----------|---------------|----------------|---------------|
| **Cloud Run** | Stateless HTTP, containers | Yes | Lowest | Free tier |
| **Cloud Functions** | Event-driven, simple functions | Yes | Lowest | Free tier |
| **GKE Autopilot** | Container orchestration, K8s ecosystem | No (min 1 pod) | Medium | Per-pod pricing |
| **GKE Standard** | Full K8s control, GPU, custom networking | No | High | $73/mo mgmt + VMs |
| **Compute Engine** | Full VM control, stateful, GPU, SAP | No | Medium-High | ~$25/mo (e2-medium) |
| **App Engine Standard** | Simple HTTP, scale-to-zero | Yes | Low | Free tier |

**Decision shortcuts:**
- Stateless HTTP service? Cloud Run (always).
- Event-driven function? Cloud Functions 2nd gen (built on Cloud Run).
- Need Kubernetes ecosystem? GKE Autopilot (unless you need node-level control).
- Full VM control, GPU, or stateful workload? Compute Engine.
- Simple app with generous free tier? App Engine Standard.

### Service Category Routing

**Storage selection:**
- Object storage? Cloud Storage with Autoclass for mixed access patterns.
- Block storage for VMs? Persistent Disk (pd-balanced default, pd-ssd for databases).
- Shared filesystem? Filestore (Enterprise for HA).

**Database selection:**
- Analytics warehouse? BigQuery (always).
- Relational, managed, single-region? Cloud SQL.
- Relational, high-performance PostgreSQL? AlloyDB (4x throughput, analytical acceleration).
- Relational, global distribution? Spanner (~$657/mo minimum -- only when justified).
- Document, mobile/web, real-time sync? Firestore (Native mode).
- Wide-column, time-series, IoT? Bigtable (~$468/mo minimum).
- In-memory cache? Memorystore.

**Networking selection:**
- Global web app? External HTTP(S) Load Balancer (anycast, single IP worldwide).
- WAF + DDoS? Cloud Armor on the load balancer.
- On-prem connectivity? Cloud VPN ($0.025/hr/tunnel) or Interconnect ($1,700/mo for 10G dedicated).
- CDN? Enable on HTTP(S) LB with one checkbox.

**AI/ML selection:**
- No-code ML? Vertex AI AutoML.
- Custom training? Vertex AI with GPUs/TPUs.
- Foundation models? Vertex AI Model Garden (Gemini, Llama, Gemma).
- ML with SQL? BigQuery ML (train/predict without data export).
- Large-scale training? TPU pods.

## Top 10 Cost Rules

1. **SUDs are automatic -- verify they apply.** Check billing reports for N1/N2/N2D/C2 families. Running all month = ~30% off with zero effort.
2. **Use custom machine types.** Avoid paying for 32 GB when you need 20 GB. Specify exact vCPU and memory.
3. **Partition and cluster BigQuery tables.** Biggest single cost lever. Reduces scanned data by 90%+ and directly cuts per-query cost.
4. **Default to Cloud Run for stateless services.** Scale-to-zero, per-second billing, 1000-request concurrency. Hard to beat on cost.
5. **Convert predictable workloads to CUDs.** 1-year: up to 57% off. 3-year: up to 70% off. Resource-based CUDs apply across project/region.
6. **Use Spot VMs for fault-tolerant work.** 60-91% discount. Same pricing as preemptible but no 24-hour max lifetime.
7. **Enable Autoclass on Cloud Storage.** Automatic tier optimization without lifecycle policy guesswork.
8. **Use GKE Autopilot for most K8s workloads.** Pay per pod, not per node. Eliminates node overprovisioning.
9. **Batch-load into BigQuery.** Streaming inserts cost $0.05/GB. Batch loads from GCS are free.
10. **Export billing to BigQuery.** Build custom dashboards, anomaly detection, and cost allocation with SQL. Far more powerful than console-only analysis.

## Common Pitfalls

**1. Using basic roles (Owner/Editor/Viewer) in production**
Basic roles are overly permissive. Use predefined roles (`roles/bigquery.dataViewer`, `roles/storage.objectViewer`) or custom roles. Basic roles were designed for development convenience.

**2. Ignoring BigQuery cost controls**
A single `SELECT *` on a petabyte table costs $6,250. Set `maximum_bytes_billed` on all queries. Use `--dry_run` in CI/CD. Partition and cluster every large table.

**3. Network egress surprise**
GCP Premium Tier egress is $0.08-0.23/GB -- the most expensive of the big 3 clouds. Evaluate Standard Tier for latency-tolerant workloads ($0.04-0.08/GB). Use Cloud CDN for static content.

**4. Spanner for workloads that don't need it**
Minimum ~$657/mo for one regional node. Only justified for global strong consistency, 99.999% availability, or unlimited horizontal scale. Cloud SQL handles most relational workloads at a fraction of the cost.

**5. Service account key files instead of Workload Identity**
JSON key files are security liabilities -- rotation burden, leak risk. Use Workload Identity for GKE, Workload Identity Federation for GitHub Actions/AWS/Azure, and service account impersonation for other cases.

**6. Not using Shared VPC for multi-project deployments**
Without Shared VPC, each project gets its own VPC requiring peering for communication. Shared VPC centralizes networking while keeping resources decentralized. It is free.

**7. GKE Standard when Autopilot suffices**
Standard mode charges $73/mo management fee and you pay for entire nodes. Autopilot has no management fee and bills per-pod resources. At <80% utilization, Autopilot is cheaper.

**8. Default service accounts with excessive permissions**
Auto-created service accounts (Compute Engine default, App Engine default) have Editor role. Disable default service accounts and use dedicated, least-privilege accounts.

**9. Streaming into BigQuery when batch suffices**
Streaming inserts: $0.05/GB. Batch loads from GCS: free. If latency of minutes is acceptable, batch-load instead.

**10. Not setting budgets and alerts**
GCP does not stop resources when budget is exceeded. Set budget alerts at 50%, 90%, 100%+ via Billing. Export billing to BigQuery for anomaly detection.

## GCP Architectural Patterns

### Multi-Project Architecture
Best practice: one project per application per environment (`myapp-dev`, `myapp-prod`). Use Shared VPC for networking. Folders for organizational hierarchy. Separate billing, IAM, quotas, and audit trails.

### Landing Zone Pattern
```
Organization
├── Shared/ (networking-host, security, cicd)
├── Production/ (app1-prod, app2-prod)
├── Non-Production/ (app1-dev, app1-staging)
└── Sandbox/ (developer sandboxes)
```

### Event-Driven Architecture
Event Sources -> Eventarc -> Cloud Run/Functions -> Downstream (BigQuery, Firestore, Pub/Sub, Cloud Storage)

### Data Pipeline Patterns
- **Batch:** Cloud Storage -> Dataflow/Dataproc -> BigQuery
- **Streaming:** Pub/Sub -> Dataflow -> BigQuery/Bigtable/Cloud Storage
- **Lakehouse:** Cloud Storage (Parquet/Iceberg) <-> BigLake <-> BigQuery -> Looker

## Reference Files

Load these when you need deep knowledge for a specific area:

- `references/compute.md` -- Compute Engine (custom types, SUDs, CUDs, Spot, live migration), Cloud Run (concurrency model, CPU allocation, scaling), Cloud Functions (gen2), GKE (Autopilot vs Standard, networking, cost optimization), App Engine. Read for compute selection and sizing.
- `references/storage.md` -- Cloud Storage (Autoclass, storage classes, location types, lifecycle), Persistent Disks (types, Regional PDs, Hyperdisk), Filestore (tiers). Read for storage decisions.
- `references/database.md` -- BigQuery (cost optimization playbook, editions, slots, ML), Cloud SQL (editions, Auth Proxy), AlloyDB (when to use), Spanner (when worth the cost), Firestore (modes, pricing), Bigtable, Memorystore. Read for database selection and optimization.
- `references/networking.md` -- Global VPC, Shared VPC, Private Service Connect, Load Balancing (types), Cloud CDN, Cloud Armor, Cloud DNS, Interconnect vs VPN, Network Service Tiers, egress pricing. Read for network architecture.
- `references/security.md` -- IAM (hierarchy, custom roles, service accounts, Workload Identity Federation), Organization Policies, VPC Service Controls, Secret Manager, SCC (Standard/Premium/Enterprise), Cloud KMS, IAP. Read for security architecture.
- `references/ai-data.md` -- Vertex AI (AutoML, custom training, Model Garden, prediction, MLOps), TPUs, BigQuery ML, Pub/Sub (Standard vs Lite), Dataflow, Dataproc, Data Fusion, Composer, Eventarc, Cloud Build, Artifact Registry. Read for AI/ML and data pipeline decisions.
- `references/cost.md` -- SUDs, CUDs, custom machine types, free tier, billing export to BigQuery, labels, Recommender, strategic playbook, cost comparison vs AWS/Azure. Read for cost optimization guidance.