Google Cloud Cloud Engineer

Structure comes before workloads. You set up organizations, folders and projects, understand how policy flows down, and apply organization policies that keep the environment inside safe limits.

• Organization, folders and projects
• How IAM and policy inherit
• Organization policy constraints
• Creating and managing projects
• Environments and separation of duties
• Resource deletion and recovery

You build A hierarchy with development and production folders and two organization policies applied.

Running costs and limits catch new engineers out. You manage users and groups, enable the APIs a project needs, handle quotas, and configure billing accounts, budgets and alerts.

• Users, groups and Workforce Identity at a working level
• Enabling and managing APIs
• Quotas and requesting increases
• Billing accounts and linking projects
• Budgets and alerts
• Reading a billing report

You build A project with linked billing, a budget and alert thresholds.

Virtual machines remain the most flexible compute option. You choose machine types and images, attach disks, group instances for scale and automate their setup.

• Machine families and sizing
• Images, startup scripts and metadata
• Persistent disks and local SSD
• Instance templates and managed instance groups
• Spot VMs and when they fit
• Connecting securely to instances

You build A managed instance group of web servers created from a template.

Containers are how most new applications ship. You deploy to Cloud Run and GKE, choose between them, and configure node pools, services and revisions for the workload.

• Containers and images in Artifact Registry
• Deploying to Cloud Run
• GKE Autopilot versus Standard
• Deployments and Services in GKE
• Exposing applications to users
• Choosing between Cloud Run and GKE

You build The same container deployed to Cloud Run and to GKE with notes comparing them.

Every workload keeps data somewhere. You compare Cloud Storage classes, managed databases and analytics services, and pick and configure the right one for each case.

• Cloud Storage buckets, classes and lifecycle rules
• Access control for buckets
• Cloud SQL basics
• Firestore, Bigtable and Spanner at a glance
• BigQuery datasets and loading data
• Choosing a data service

You build A storage and database setup for a small application with lifecycle rules.

Networking connects and protects your resources. You create VPCs and subnets, write firewall rules, give instances outbound access safely, and expose services with load balancers.

• VPC networks and subnets
• Firewall rules and tags
• External and internal IP addresses
• Cloud NAT for outbound access
• Load balancer basics
• DNS for your services

You build A two-tier network with firewall rules, outbound NAT and a load balancer.

Repeatable environments beat memory and screenshots. You define resources in Terraform, review plans before applying them, and use Gemini Cloud Assist to explain and troubleshoot while checking what it suggests.

• Terraform resources, variables and state
• Plan, apply and destroy
• Reusable modules at a basic level
• Using Gemini Cloud Assist for explanations and troubleshooting
• Checking AI suggestions before applying them
• Storing and reviewing infrastructure code

You build A Terraform configuration that rebuilds the course network and instances from scratch.

Systems need regular care. You take snapshots and create images, manage node pools and cluster updates, and shift traffic between Cloud Run revisions without downtime.

• Snapshots, images and scheduled backups
• Resizing and updating instances
• GKE node pools and upgrades
• Cloud Run revisions and traffic splitting
• Cleaning up unused resources
• Handling common operational tasks

You build An operations checklist with a tested snapshot restore and a traffic shift between revisions.

You cannot run what you cannot see. You collect metrics and logs across projects, build dashboards and uptime checks, and set alerts that reach the right people.

• Cloud Monitoring metrics and dashboards
• The Ops Agent for VMs
• Cloud Logging and log queries
• Alerting policies and notification channels
• Uptime checks
• Log sinks and monitoring across projects

You build A dashboard, uptime check and alert policy for a deployed application.

Access control keeps mistakes small. You grant the narrowest roles to people and workloads, create and use service accounts correctly, and review who has access to what.

• Principals, roles and policies
• Basic, predefined and custom roles
• Granting access at the right level
• Service accounts for applications and VMs
• Avoiding service account keys
• Reviewing and removing access

You build An IAM setup with least-privilege roles for two teams and a service account for an application.

Do the whole job once. You set up the project, deploy an application on compute and containers, add storage and networking, monitor it and lock down access, with the infrastructure written as code.

• Planning the environment
• Deploying compute, storage and networking
• Adding monitoring and logging
• Locking down access
• Reviewing cost and cleaning up

You build A complete small system defined as code, monitored, secured and costed.