Google Cloud

This content was generated with the assistance of AI and should be verified against the official documentation before being relied on in production.

See the section bibliography for the reference material consulted while preparing these pages.

Welcome to the Google Cloud reference. It documents Google Cloud for practitioners who work from the Google Cloud console and the gcloud CLI — provisioning resources, wiring them together, and operating what results — rather than from the perspective of a certification-style conceptual overview. It is written for developers and operators who already build software (the rest of this site covers the Java, web and database sides) and now need to run it on Google Cloud. Examples across this section target the gcloud CLI (the 586 line), the Google Cloud Client Libraries for Java through the libraries-bom, Spring Cloud GCP 8.x (Spring Boot 4) and 7.4.x (Spring Boot 3), Terraform with the hashicorp/google provider v8, and GKE 1.35 on the Regular release channel; this baseline was re-verified as current on 2026-10-01, and each page also names the service-specific versions it depends on, since Google Cloud ships new capabilities to individual services on its own schedule. Prices are never quoted: each page describes the pricing model and cost drivers and links the dated official pricing page. Every page also states the launch stage (Preview or GA) of anything that is not generally available and records the dates of recent retirements and renames, because several products widely documented in older guides have since been replaced.

The Bookshelf scenario

Most pages in this section build up one running example, Bookshelf: a static web front end, a catalog-api (Spring Boot), an orders-api and a notifier worker that sends order-confirmation emails. It is the same application as in the Azure section and the AWS section, so the three clouds can be compared side by side. Every resource follows one naming convention, so a command copied from one page composes with a command copied from another:

Concern Name / value

Concern	Name / value
Project and region	`PROJECT_ID=$(gcloud config get-value project)` (placeholders `my-project-id` and `<project-number>`); region `us-central1` unless a page needs another
Artifact Registry	Docker repository `bookshelf` — images `us-central1-docker.pkg.dev/$PROJECT_ID/bookshelf/catalog-api`, `…/orders-api` and `…/notifier`
Cloud Run	services `catalog-api` (source deploy first, then an image, then revisions and traffic splits) and `orders-api`; job `nightly-report`; `notifier` as an Eventarc-triggered service or Cloud Run function on the Pub/Sub topic `orders`
Cloud Storage	`bookshelf-web-$PROJECT_ID` (static site, behind a global external Application Load Balancer and Cloud CDN), `bookshelf-uploads-$PROJECT_ID`
Databases	Cloud SQL for PostgreSQL `bookshelf-catalog` (database `catalog`; AlloyDB `bookshelf-alloy` as the scale-up variant); Firestore with MongoDB compatibility `orders` (or MongoDB Atlas); Memorystore for Valkey `bookshelf-cache`
Secrets and configuration	Secret Manager `catalog-db-password` and `sendgrid-api-key`; Parameter Manager parameter `bookshelf-settings`
GKE	Autopilot cluster `bookshelf-gke`, Workload Identity Federation for GKE, Gateway API
Gateways	API Gateway `bookshelf-api` (Apigee as the enterprise variant); Cloud Armor policy `bookshelf-policy`
VPN	HA VPN `bookshelf-vpn` with a Cloud Router to a simulated on-premises VPC; IAP TCP forwarding for administrator access
Email	a third-party SMTP relay or API (SendGrid), its key kept in Secret Manager
Java package	`com.example.bookshelf`
Shell variables	`PROJECT_ID`, `REGION`, `SERVICE`, `BUCKET` and so on — never real IDs or keys

Project and region

PROJECT_ID=$(gcloud config get-value project) (placeholders my-project-id and <project-number>); region us-central1 unless a page needs another

Artifact Registry

Docker repository bookshelf — images us-central1-docker.pkg.dev/$PROJECT_ID/bookshelf/catalog-api, …/orders-api and …/notifier

Cloud Run

services catalog-api (source deploy first, then an image, then revisions and traffic splits) and orders-api; job nightly-report; notifier as an Eventarc-triggered service or Cloud Run function on the Pub/Sub topic orders

Cloud Storage

bookshelf-web-$PROJECT_ID (static site, behind a global external Application Load Balancer and Cloud CDN), bookshelf-uploads-$PROJECT_ID

Databases

Cloud SQL for PostgreSQL bookshelf-catalog (database catalog; AlloyDB bookshelf-alloy as the scale-up variant); Firestore with MongoDB compatibility orders (or MongoDB Atlas); Memorystore for Valkey bookshelf-cache

Secrets and configuration

Secret Manager catalog-db-password and sendgrid-api-key; Parameter Manager parameter bookshelf-settings

GKE

Autopilot cluster bookshelf-gke, Workload Identity Federation for GKE, Gateway API

Gateways

API Gateway bookshelf-api (Apigee as the enterprise variant); Cloud Armor policy bookshelf-policy

VPN

HA VPN bookshelf-vpn with a Cloud Router to a simulated on-premises VPC; IAP TCP forwarding for administrator access

a third-party SMTP relay or API (SendGrid), its key kept in Secret Manager

Java package

com.example.bookshelf

Shell variables

PROJECT_ID, REGION, SERVICE, BUCKET and so on — never real IDs or keys

Bookshelf starts on Cloud Run, where catalog-api is first deployed from source, then from an image, with revisions and traffic splits, and later moves its services onto a GKE Autopilot cluster (bookshelf-gke), covered in GKE Clusters and Deploying Microservices on GKE. The figure below shows Bookshelf’s end state, once every group’s pages have been applied: a global external Application Load Balancer with Cloud CDN and Cloud Armor in front of a private Cloud Storage bucket and API Gateway, the GKE-hosted services, the databases, secrets and configuration reached over private connectivity, Pub/Sub and Eventarc feeding the notifier worker that sends email through a third-party provider, an HA VPN for the on-premises path, and Cloud Logging and Cloud Monitoring watching all of it. It is not the architecture a reader has running after just the Compute pages — see Choosing a Compute Service and Cloud Run for the earlier, Cloud Run-only stage.

Bookshelf end-state architecture on Google Cloud: a global external Application Load Balancer with Cloud CDN and Cloud Armor in front of a private Cloud Storage static site and an API Gateway, catalog-api and orders-api on a GKE Autopilot cluster and the notifier service and nightly-report job on Cloud Run inside a custom VPC, Cloud SQL, Firestore and Memorystore as data stores, Secret Manager and Parameter Manager for secrets and configuration, a Pub/Sub topic with an Eventarc trigger feeding notifier which calls a third-party email provider, Artifact Registry for images, an HA VPN to a simulated on-premises network, and Cloud Logging and Cloud Monitoring observing everything

Reading path

Read this section foundations first — the cloud model, accounts, regions, the resource hierarchy, identity and infrastructure as code — then compute, where Bookshelf’s services first get deployed. From there, storage and CDN put the static front end and its assets somewhere durable and fast to serve, and managed databases give catalog-api and orders-api somewhere to persist data. Security and runtime configuration then centralize the secrets and settings every earlier page referenced loosely, before networking, gateways and VPN lock the whole thing behind a private network and a proper API front door. Email and integration wire notifier up to the outside world, and operations, governance and beyond closes the loop: monitoring, cost, compliance, migration paths and the developer tooling that ties CI/CD back to everything above. A reader who only needs one topic can jump straight to its page; each page states which earlier pages it assumes.

What’s covered

Foundations

Cloud Concepts — cloud computing, IaaS/PaaS/SaaS, the shared responsibility and shared fate model, the Well-Architected Framework and the vocabulary the rest of this section assumes.
Getting Started with Google Cloud — creating an account, the free trial and Always Free tier, the console, Cloud Shell and installing and driving the gcloud CLI.
Google Cloud Global Infrastructure — zones, regions, dual-regions and multi-regions, the network edge and how they shape resiliency decisions.
Resource Hierarchy and Projects — organizations, folders and projects, labels, tags, organization policies, quotas and billing links.
Identity and Access — IAM principals, roles and policies, service accounts and impersonation, Application Default Credentials and Workload Identity Federation, the mechanisms every later page’s permissions build on.
Infrastructure as Code — Terraform, Infrastructure Manager and Config Connector for provisioning Bookshelf repeatably, instead of one-off CLI commands.

Compute

Choosing a Compute Service — a decision guide across Cloud Run, GKE, Compute Engine, App Engine and the specialist options.
Compute Engine — machine families, disks, images, Spot VMs, OS Login, IAP TCP forwarding and managed instance groups.
Container Registry and Builds — the Bookshelf Artifact Registry repository, pushing and pulling images, cleanup policies and Cloud Build.
Cloud Run — services, revisions, source and image deploys, configuration, secrets and invoker IAM, deploying catalog-api end to end.
Cloud Run Scaling, Traffic and Jobs — autoscaling, concurrency, canary traffic splits, jobs and worker pools.
Cloud Run Functions and Events — functions (formerly Cloud Functions), Eventarc triggers and Pub/Sub push, and the notifier function.
GKE Clusters — creating bookshelf-gke: Autopilot versus Standard, release channels, node pools, upgrades and Workload Identity Federation for GKE.
Deploying Microservices on GKE — moving the Bookshelf services onto that cluster with manifests, Helm, Skaffold and the Gateway API.

Storage and CDN

Block and File Storage on Google Cloud — Hyperdisk and Persistent Disk, Local SSD, snapshots, Backup and DR and Filestore.
Cloud Storage — buckets, location types, storage classes, Autoclass, lifecycle rules, soft delete and versioning.
Cloud Storage Security and Static Sites — uniform bucket-level access, public access prevention, signed URLs, CMEK and the private static site.
Cloud CDN and Media CDN — serving Bookshelf through Cloud CDN on the global load balancer: cache modes, invalidation and signed URLs.

Managed databases

Managed Databases on Google Cloud — a map from every engine this site documents to its Google Cloud option.
Cloud SQL — PostgreSQL, MySQL and SQL Server, private connectivity, the Auth Proxy and connectors, bookshelf-catalog and where catalog-api persists its catalog.
AlloyDB for PostgreSQL — clusters, read pools, the columnar engine and vector search as the scale-up variant of the catalog database.
Spanner, Firestore and Bigtable — Google’s first-party distributed databases and when each fits.
MongoDB on Google Cloud — Firestore with MongoDB compatibility, MongoDB Atlas and the MongoDB variant of orders.
Memorystore and Partner Databases — Memorystore for Valkey and Redis, plus Marketplace and self-hosted options for Elasticsearch, Neo4j, Qdrant and others.

Security and runtime configuration

Secret Manager and Cloud KMS — secrets, versions, keys and how Cloud Run, GKE and Spring Boot consume them.
Runtime Configuration — Parameter Manager, environment variables, secret volumes and Kubernetes ConfigMaps.

Networking, gateways and VPN

VPC Networking on Google Cloud — custom-mode networks, subnets, firewall rules, Cloud NAT and Private Service Connect for the Bookshelf VPC.
Cloud DNS and Certificate Manager — zones, DNSSEC, routing policies and Google-managed certificates.
Load Balancing and Cloud Armor — the global external Application Load Balancer, serverless NEGs and the bookshelf-policy WAF.
API Gateway, Apigee and Cloud Endpoints — bookshelf-api and the enterprise API management options.
VPN and Hybrid Connectivity — HA VPN, Cloud Interconnect, Network Connectivity Center and IAP, the administrator path into private resources.

Email and integration

Sending Email from Google Cloud — why there is no first-party transactional email service and how notifier sends order-confirmation email through a third-party provider.
Messaging and Integration — Pub/Sub, Eventarc, Cloud Tasks, Cloud Scheduler and Workflows, including the orders topic.

Operations, governance and beyond

Monitoring and Observability — Cloud Logging, Cloud Monitoring, Trace, Error Reporting and managed Prometheus.
Governance, Security and Compliance — Organization Policy, Cloud Audit Logs, Security Command Center and VPC Service Controls.
Cost Management and Billing — billing accounts, budgets, discounts and cost controls.
Architecture, Migration and Multicloud — the Well-Architected Framework, migration paths, hybrid and multicloud options and disaster recovery.
AI, Data and Analytics Overview — a survey of BigQuery, Dataflow, Vertex AI and the other services this section doesn’t otherwise cover.
Developer Tools and DevOps — Cloud Code, Cloud Workstations, Cloud Build, Cloud Deploy and GitHub Actions with Workload Identity Federation.

Cheat Sheet — a single-page, printable summary of this section, with a downloadable PDF.

mindmap root((Google Cloud)) Foundations Cloud Concepts Getting Started Global Infrastructure Resource Hierarchy and Projects Identity and Access Infrastructure as Code Compute Choosing a Compute Service Compute Engine Container Registry and Builds Cloud Run Cloud Run Scaling and Jobs Cloud Run Functions and Events GKE Clusters GKE Microservices Storage and CDN Block and File Storage Cloud Storage Storage Security and Static Sites Cloud CDN Managed databases Databases Overview Cloud SQL AlloyDB Spanner, Firestore and Bigtable MongoDB on Google Cloud Memorystore and Partner Security and runtime configuration Secret Manager and KMS Runtime Configuration Networking, gateways and VPN VPC Networking Cloud DNS and Certificates Load Balancing and Cloud Armor API Gateway and Apigee VPN and Hybrid Connectivity Email and integration Sending Email Messaging and Integration Operations, governance and beyond Monitoring and Observability Governance and Compliance Cost Management Architecture and Migration AI, Data and Analytics Developer Tools and DevOps

Media Optimization

The Media Optimization page covers media processing on Google Cloud: the Transcoder API, the Live Stream and Video Stitcher APIs, Media CDN and Cloud CDN signed requests, storage-triggered image resizing with Eventarc and Cloud Run, and FFmpeg in Cloud Run jobs.

Coming from Azure

Readers who know the Azure section can use the table below to find the Google Cloud page that covers the closest counterpart. The mapping is a starting point, not an equivalence: the services differ in defaults, limits, pricing and identity model, and each Google Cloud page says where.

Azure Google Cloud Notes

Azure	Google Cloud	Notes
Resource Organization (management groups, subscriptions, resource groups)	Resource Hierarchy and Projects	Organization, folders and projects replace management groups, subscriptions and resource groups; the project is the unit of billing link, quota and API enablement.
Identity and Access (Entra ID, RBAC, managed identities)	Identity and Access	Attached service accounts take the place of managed identities; IAM roles are granted on the resource hierarchy.
Infrastructure as Code (Bicep, `azd`)	Infrastructure as Code	Terraform is the mainstream tool; Infrastructure Manager runs it as a managed service, and Deployment Manager is shut down.
Azure Global Infrastructure	Google Cloud Global Infrastructure	Regions and zones, plus dual-region and multi-region locations; VPC networks are global.
Choosing a Compute Service	Choosing a Compute Service	Same decision, different catalog.
Azure Container Registry (ACR)	Container Registry and Builds (Artifact Registry)	Container Registry has been shut down; Artifact Registry also hosts Maven, npm and Python packages.
Container Apps and Container Apps: Scaling, Jobs and Dapr (Container Apps)	Cloud Run and Cloud Run Scaling, Traffic and Jobs (Cloud Run)	Revisions, traffic splits, scale to zero and jobs are all built in.
App Service and Azure Functions (Functions)	Cloud Run Functions and Events (Cloud Run functions)	Functions are Cloud Run services with a function-shaped developer experience.
AKS Clusters and Deploying Microservices on AKS (AKS)	GKE Clusters and Deploying Microservices on GKE (GKE)	GKE Autopilot compares to AKS Automatic; Workload Identity Federation for GKE compares to workload identity.
Storage Accounts and Blob Storage (Blob Storage)	Cloud Storage and Block and File Storage on Google Cloud (Hyperdisk, Filestore)	There is no storage-account layer: buckets are the top-level container.
Front Door and CDN (Front Door)	Cloud CDN and Media CDN (Cloud CDN) with Load Balancing and Cloud Armor (global external Application Load Balancer)	Cloud CDN is switched on at the load balancer’s backend rather than being a separate profile.
Managed Databases on Azure	Managed Databases on Google Cloud	Engine-by-engine map on both sides.
Azure SQL and PostgreSQL and MySQL on Azure	Cloud SQL and AlloyDB for PostgreSQL	Cloud SQL for managed engines, AlloyDB for the PostgreSQL-compatible scale-up option.
Cosmos DB and Azure DocumentDB (Cosmos DB, Azure DocumentDB)	Spanner, Firestore and Bigtable and MongoDB on Google Cloud	Firestore for documents, Spanner for global relational scale, Firestore with MongoDB compatibility for the MongoDB API.
Redis and Partner Databases on Azure (Azure Managed Redis)	Memorystore and Partner Databases (Memorystore for Valkey and Redis)	Valkey is the default open-source engine.
Key Vault and Secrets (Key Vault)	Secret Manager and Cloud KMS (Secret Manager and Cloud KMS)	Secrets and keys are separate services on Google Cloud.
Runtime Configuration (App Configuration)	Runtime Configuration (Parameter Manager)	ConfigMaps on GKE work as they do on AKS.
Virtual Networks (virtual networks, NSGs)	VPC Networking on Google Cloud (VPC, firewall rules)	A VPC network is global and its subnets are regional.
Gateways and Load Balancing	Load Balancing and Cloud Armor (Cloud Load Balancing, Cloud Armor)	One global anycast front end instead of separate regional gateways.
API Management (API Management)	API Gateway, Apigee and Cloud Endpoints (API Gateway, Apigee)	API Gateway is the lightweight option, Apigee the full API management platform.
VPN Gateway and Hybrid Connectivity (VPN Gateway)	VPN and Hybrid Connectivity (HA VPN)	IAP TCP forwarding is the VPN-less administrator path.
Email with Azure Communication Services (Communication Services Email)	Sending Email from Google Cloud (third-party providers)	There is no first-party transactional email service; outbound port 25 is blocked.
Messaging and Integration Services (Service Bus, Event Grid, Event Hubs)	Messaging and Integration (Pub/Sub, Eventarc)	Pub/Sub covers the queue and topic roles; Eventarc routes events from Google Cloud services.
Monitoring and Observability (Azure Monitor)	Monitoring and Observability (Cloud Logging, Cloud Monitoring)	Logs, metrics, traces and alerting policies.
Governance and Compliance (Azure Policy)	Governance, Security and Compliance (Organization Policy, Security Command Center)	Organization Policy constraints are the closest guard rail.
Cost Management	Cost Management and Billing	Budgets alert but do not cap spend on either cloud.
Architecture, Migration and Hybrid Cloud	Architecture, Migration and Multicloud	Well-Architected Framework and Cloud Adoption Framework on both sides.
Developer Tools and DevOps	Developer Tools and DevOps	GitHub Actions with OIDC and Workload Identity Federation works with both clouds.

Resource Organization (management groups, subscriptions, resource groups)

Resource Hierarchy and Projects

Organization, folders and projects replace management groups, subscriptions and resource groups; the project is the unit of billing link, quota and API enablement.

Identity and Access (Entra ID, RBAC, managed identities)

Identity and Access

Attached service accounts take the place of managed identities; IAM roles are granted on the resource hierarchy.

Infrastructure as Code (Bicep, azd)

Infrastructure as Code

Terraform is the mainstream tool; Infrastructure Manager runs it as a managed service, and Deployment Manager is shut down.

Azure Global Infrastructure

Google Cloud Global Infrastructure

Regions and zones, plus dual-region and multi-region locations; VPC networks are global.

Choosing a Compute Service

Same decision, different catalog.

Azure Container Registry (ACR)

Container Registry and Builds (Artifact Registry)

Container Registry has been shut down; Artifact Registry also hosts Maven, npm and Python packages.

Container Apps and Container Apps: Scaling, Jobs and Dapr (Container Apps)

Cloud Run and Cloud Run Scaling, Traffic and Jobs (Cloud Run)

Revisions, traffic splits, scale to zero and jobs are all built in.

App Service and Azure Functions (Functions)

Cloud Run Functions and Events (Cloud Run functions)

Functions are Cloud Run services with a function-shaped developer experience.

AKS Clusters and Deploying Microservices on AKS (AKS)

GKE Clusters and Deploying Microservices on GKE (GKE)

GKE Autopilot compares to AKS Automatic; Workload Identity Federation for GKE compares to workload identity.

Storage Accounts and Blob Storage (Blob Storage)

Cloud Storage and Block and File Storage on Google Cloud (Hyperdisk, Filestore)

There is no storage-account layer: buckets are the top-level container.

Front Door and CDN (Front Door)

Cloud CDN and Media CDN (Cloud CDN) with Load Balancing and Cloud Armor (global external Application Load Balancer)

Cloud CDN is switched on at the load balancer’s backend rather than being a separate profile.

Managed Databases on Azure

Managed Databases on Google Cloud

Engine-by-engine map on both sides.

Azure SQL and PostgreSQL and MySQL on Azure

Cloud SQL and AlloyDB for PostgreSQL

Cloud SQL for managed engines, AlloyDB for the PostgreSQL-compatible scale-up option.

Cosmos DB and Azure DocumentDB (Cosmos DB, Azure DocumentDB)

Spanner, Firestore and Bigtable and MongoDB on Google Cloud

Firestore for documents, Spanner for global relational scale, Firestore with MongoDB compatibility for the MongoDB API.

Redis and Partner Databases on Azure (Azure Managed Redis)

Memorystore and Partner Databases (Memorystore for Valkey and Redis)

Valkey is the default open-source engine.

Key Vault and Secrets (Key Vault)

Secret Manager and Cloud KMS (Secret Manager and Cloud KMS)

Secrets and keys are separate services on Google Cloud.

Runtime Configuration (App Configuration)

Runtime Configuration (Parameter Manager)

ConfigMaps on GKE work as they do on AKS.

Virtual Networks (virtual networks, NSGs)

VPC Networking on Google Cloud (VPC, firewall rules)

A VPC network is global and its subnets are regional.

Gateways and Load Balancing

Load Balancing and Cloud Armor (Cloud Load Balancing, Cloud Armor)

One global anycast front end instead of separate regional gateways.

API Management (API Management)

API Gateway, Apigee and Cloud Endpoints (API Gateway, Apigee)

API Gateway is the lightweight option, Apigee the full API management platform.

VPN Gateway and Hybrid Connectivity (VPN Gateway)

VPN and Hybrid Connectivity (HA VPN)

IAP TCP forwarding is the VPN-less administrator path.

Email with Azure Communication Services (Communication Services Email)

Sending Email from Google Cloud (third-party providers)

There is no first-party transactional email service; outbound port 25 is blocked.

Messaging and Integration Services (Service Bus, Event Grid, Event Hubs)

Messaging and Integration (Pub/Sub, Eventarc)

Pub/Sub covers the queue and topic roles; Eventarc routes events from Google Cloud services.

Monitoring and Observability (Azure Monitor)

Monitoring and Observability (Cloud Logging, Cloud Monitoring)

Logs, metrics, traces and alerting policies.

Governance and Compliance (Azure Policy)

Governance, Security and Compliance (Organization Policy, Security Command Center)

Organization Policy constraints are the closest guard rail.

Cost Management

Cost Management and Billing

Budgets alert but do not cap spend on either cloud.

Architecture, Migration and Hybrid Cloud

Architecture, Migration and Multicloud

Well-Architected Framework and Cloud Adoption Framework on both sides.

Developer Tools and DevOps

GitHub Actions with OIDC and Workload Identity Federation works with both clouds.

Coming from AWS

Readers who know the AWS section can use the table below in the same way.

AWS	Google Cloud	Notes
Accounts and Organizations (Organizations, accounts, SCPs)	Resource Hierarchy and Projects	Projects inside folders replace accounts inside OUs; Organization Policy and deny policies take the place of service control policies.
Identity and Access (IAM roles)	Identity and Access	Service accounts with impersonation replace assumed roles; Workload Identity Federation replaces OIDC role assumption.
Infrastructure as Code (CloudFormation, CDK, SAM)	Infrastructure as Code	Terraform and Infrastructure Manager; there is no native CDK.
AWS Global Infrastructure	Google Cloud Global Infrastructure	Zones are not tied to fixed per-account names, and VPCs span regions.
Choosing a Compute Service	Choosing a Compute Service	Same decision, different catalog.
Amazon EC2 and Auto Scaling (EC2, Auto Scaling)	Compute Engine (Compute Engine, managed instance groups)	Machine families and Hyperdisk; instance templates feed managed instance groups.
Container Registry (ECR)	Container Registry and Builds (Artifact Registry)	Repositories are regional or multi-regional and hold several package formats.
ECS and Fargate and ECS Deployments, Scaling and Networking (ECS on Fargate, Express Mode)	Cloud Run and Cloud Run Scaling, Traffic and Jobs (Cloud Run)	Cloud Run is the closest match to ECS Express Mode, with revisions and traffic splitting built in.
AWS Lambda and Lambda: Event-Driven and Serverless Apps (Lambda)	Cloud Run Functions and Events (Cloud Run functions)	Event sources arrive through Eventarc triggers or Pub/Sub push subscriptions.
EKS Clusters and Deploying Microservices on EKS (EKS)	GKE Clusters and Deploying Microservices on GKE (GKE)	GKE Autopilot compares to EKS Auto Mode; Workload Identity Federation for GKE compares to Pod Identity.
Block and File Storage on AWS (EBS, EFS, FSx)	Block and File Storage on Google Cloud (Hyperdisk, Persistent Disk, Filestore)	Disks are zonal or regional resources.
S3 Object Storage and S3 Security and Static Hosting (S3)	Cloud Storage and Cloud Storage Security and Static Sites (Cloud Storage)	Uniform bucket-level access and public access prevention play the part of Block Public Access.
CloudFront and CDN Delivery (CloudFront)	Cloud CDN and Media CDN (Cloud CDN) with Load Balancing and Cloud Armor (global external Application Load Balancer)	Cloud CDN is enabled on a load balancer backend.
Managed Databases on AWS	Managed Databases on Google Cloud	Engine-by-engine map on both sides.
Amazon RDS and Amazon Aurora (RDS, Aurora)	Cloud SQL and AlloyDB for PostgreSQL	Cloud SQL for managed engines, AlloyDB as the Aurora-style PostgreSQL option.
Amazon DynamoDB and DocumentDB and MongoDB on AWS (DynamoDB, DocumentDB)	Spanner, Firestore and Bigtable and MongoDB on Google Cloud	Firestore and Bigtable for key-value and document workloads; Firestore with MongoDB compatibility for the MongoDB API.
OpenSearch and Search on AWS (OpenSearch Service)	Memorystore and Partner Databases (Elastic Cloud on Marketplace)	There is no first-party search engine service; use Marketplace or self-hosted options.
Caching, Graph and Partner Databases (ElastiCache, MemoryDB)	Memorystore and Partner Databases (Memorystore)	Valkey is the default open-source engine on both.
Secrets Manager, Parameter Store and KMS (Secrets Manager, Parameter Store, KMS)	Secret Manager and Cloud KMS (Secret Manager, Cloud KMS)	Secret Manager covers secrets and Parameter Manager covers plain configuration.
Runtime Configuration (AppConfig)	Runtime Configuration (Parameter Manager)	Parameter Manager versions parameters and can reference secrets.
VPC Networking (VPC, security groups)	VPC Networking on Google Cloud (VPC, firewall rules)	Subnets are regional, not zonal, and firewall rules apply by tag or service account.
Route 53, DNS and ACM Certificates (Route 53, ACM)	Cloud DNS and Certificate Manager (Cloud DNS, Certificate Manager)	Google-managed certificates attach to load balancers through Certificate Manager.
Load Balancers and Gateways (ALB, NLB)	Load Balancing and Cloud Armor (Cloud Load Balancing, Cloud Armor)	Cloud Armor takes the role of WAF.
API Gateway (API Gateway)	API Gateway, Apigee and Cloud Endpoints (API Gateway, Apigee)	API Gateway for OpenAPI-driven gateways, Apigee for full API management.
VPN and Hybrid Connectivity (Client VPN, Site-to-Site VPN)	VPN and Hybrid Connectivity (HA VPN, IAP)	There is no managed client VPN; IAP TCP forwarding covers administrator access.
Sending Email with Amazon SES (SES)	Sending Email from Google Cloud (third-party providers)	No first-party transactional email service exists.
Messaging and Integration (SQS, SNS, EventBridge)	Messaging and Integration (Pub/Sub, Eventarc)	Pub/Sub is both the queue and the topic.
Monitoring and Observability (CloudWatch, CloudTrail)	Monitoring and Observability (Cloud Logging, Cloud Monitoring, Cloud Audit Logs)	Logs, metrics and audit trails are separate but integrated.
Governance, Security and Compliance (Config, Security Hub)	Governance, Security and Compliance (Cloud Asset Inventory, Security Command Center)	Organization Policy is the preventive control.
Cost Management and Support	Cost Management and Billing	Budgets and billing reports; committed use discounts replace Savings Plans.
Architecture, Migration, Hybrid and Disaster Recovery	Architecture, Migration and Multicloud	Well-Architected Framework on both sides.
AI, Data and Analytics Services Overview	AI, Data and Analytics Overview	BigQuery is the central analytics service.
Developer Tools and DevOps	Developer Tools and DevOps	Cloud Build and Cloud Deploy replace CodeBuild and CodePipeline; GitHub Actions works with both.

AWS

Google Cloud

Notes

Accounts and Organizations (Organizations, accounts, SCPs)

Resource Hierarchy and Projects

Projects inside folders replace accounts inside OUs; Organization Policy and deny policies take the place of service control policies.

Identity and Access (IAM roles)

Identity and Access

Service accounts with impersonation replace assumed roles; Workload Identity Federation replaces OIDC role assumption.

Infrastructure as Code (CloudFormation, CDK, SAM)

Infrastructure as Code

Terraform and Infrastructure Manager; there is no native CDK.

AWS Global Infrastructure

Google Cloud Global Infrastructure

Zones are not tied to fixed per-account names, and VPCs span regions.

Choosing a Compute Service

Same decision, different catalog.

Amazon EC2 and Auto Scaling (EC2, Auto Scaling)

Compute Engine (Compute Engine, managed instance groups)

Machine families and Hyperdisk; instance templates feed managed instance groups.

Container Registry (ECR)

Container Registry and Builds (Artifact Registry)

Repositories are regional or multi-regional and hold several package formats.

ECS and Fargate and ECS Deployments, Scaling and Networking (ECS on Fargate, Express Mode)

Cloud Run and Cloud Run Scaling, Traffic and Jobs (Cloud Run)

Cloud Run is the closest match to ECS Express Mode, with revisions and traffic splitting built in.

AWS Lambda and Lambda: Event-Driven and Serverless Apps (Lambda)

Cloud Run Functions and Events (Cloud Run functions)

Event sources arrive through Eventarc triggers or Pub/Sub push subscriptions.

EKS Clusters and Deploying Microservices on EKS (EKS)

GKE Clusters and Deploying Microservices on GKE (GKE)

GKE Autopilot compares to EKS Auto Mode; Workload Identity Federation for GKE compares to Pod Identity.

Block and File Storage on AWS (EBS, EFS, FSx)

Block and File Storage on Google Cloud (Hyperdisk, Persistent Disk, Filestore)

Disks are zonal or regional resources.

S3 Object Storage and S3 Security and Static Hosting (S3)

Cloud Storage and Cloud Storage Security and Static Sites (Cloud Storage)

Uniform bucket-level access and public access prevention play the part of Block Public Access.

CloudFront and CDN Delivery (CloudFront)

Cloud CDN and Media CDN (Cloud CDN) with Load Balancing and Cloud Armor (global external Application Load Balancer)

Cloud CDN is enabled on a load balancer backend.

Managed Databases on AWS

Managed Databases on Google Cloud

Engine-by-engine map on both sides.

Amazon RDS and Amazon Aurora (RDS, Aurora)

Cloud SQL and AlloyDB for PostgreSQL

Cloud SQL for managed engines, AlloyDB as the Aurora-style PostgreSQL option.

Amazon DynamoDB and DocumentDB and MongoDB on AWS (DynamoDB, DocumentDB)

Spanner, Firestore and Bigtable and MongoDB on Google Cloud

Firestore and Bigtable for key-value and document workloads; Firestore with MongoDB compatibility for the MongoDB API.

OpenSearch and Search on AWS (OpenSearch Service)

Memorystore and Partner Databases (Elastic Cloud on Marketplace)

There is no first-party search engine service; use Marketplace or self-hosted options.

Caching, Graph and Partner Databases (ElastiCache, MemoryDB)

Memorystore and Partner Databases (Memorystore)

Valkey is the default open-source engine on both.

Secrets Manager, Parameter Store and KMS (Secrets Manager, Parameter Store, KMS)

Secret Manager and Cloud KMS (Secret Manager, Cloud KMS)

Secret Manager covers secrets and Parameter Manager covers plain configuration.

Runtime Configuration (AppConfig)

Runtime Configuration (Parameter Manager)

Parameter Manager versions parameters and can reference secrets.

VPC Networking (VPC, security groups)

VPC Networking on Google Cloud (VPC, firewall rules)

Subnets are regional, not zonal, and firewall rules apply by tag or service account.

Route 53, DNS and ACM Certificates (Route 53, ACM)

Cloud DNS and Certificate Manager (Cloud DNS, Certificate Manager)

Google-managed certificates attach to load balancers through Certificate Manager.

Load Balancers and Gateways (ALB, NLB)

Load Balancing and Cloud Armor (Cloud Load Balancing, Cloud Armor)

Cloud Armor takes the role of WAF.

API Gateway (API Gateway)

API Gateway, Apigee and Cloud Endpoints (API Gateway, Apigee)

API Gateway for OpenAPI-driven gateways, Apigee for full API management.

VPN and Hybrid Connectivity (Client VPN, Site-to-Site VPN)

VPN and Hybrid Connectivity (HA VPN, IAP)

There is no managed client VPN; IAP TCP forwarding covers administrator access.

Sending Email with Amazon SES (SES)

Sending Email from Google Cloud (third-party providers)

No first-party transactional email service exists.

Messaging and Integration (SQS, SNS, EventBridge)

Messaging and Integration (Pub/Sub, Eventarc)

Pub/Sub is both the queue and the topic.

Monitoring and Observability (CloudWatch, CloudTrail)

Monitoring and Observability (Cloud Logging, Cloud Monitoring, Cloud Audit Logs)

Logs, metrics and audit trails are separate but integrated.

Governance, Security and Compliance (Config, Security Hub)

Governance, Security and Compliance (Cloud Asset Inventory, Security Command Center)

Organization Policy is the preventive control.

Cost Management and Support

Cost Management and Billing

Budgets and billing reports; committed use discounts replace Savings Plans.

Architecture, Migration, Hybrid and Disaster Recovery

Architecture, Migration and Multicloud

Well-Architected Framework on both sides.

AI, Data and Analytics Services Overview

AI, Data and Analytics Overview

BigQuery is the central analytics service.

Developer Tools and DevOps

Cloud Build and Cloud Deploy replace CodeBuild and CodePipeline; GitHub Actions works with both.

Where related material lives elsewhere on this site

Several pages in this section link back to material that already has its own home elsewhere on this site, rather than duplicating it here:

Existing page	Link from
Deploying Redis on Google Cloud (+ its Azure/AWS siblings)	Memorystore and Partner Databases
File Storage & Object Stores	Cloud Storage, Block and File Storage on Google Cloud
Configuration and Profiles (Kubernetes ConfigMaps and Secrets)	Secret Manager and Cloud KMS, Runtime Configuration
Orchestration: Swarm Mode and Kubernetes, Registries and Docker Hub, Docker CI/CD with GitHub Actions	Container Registry and Builds, GKE Clusters, Deploying Microservices on GKE, Developer Tools and DevOps
Kubernetes (generic Kubernetes concepts)	GKE Clusters, Deploying Microservices on GKE
Comparing Vector Databases, PostgreSQL & pgvector, The Vector Database Landscape	Managed Databases on Google Cloud, Cloud SQL, AlloyDB for PostgreSQL
Choosing the Right Database, Authentication, authorization & encryption	Managed Databases on Google Cloud, MongoDB on Google Cloud
Serverless and Cloud Functions, Kubernetes and OpenShift	Cloud Run Functions and Events, Deploying Microservices on GKE
Social Login and Federation, Authorization Server & Social Login, JWT, OIDC and Keycloak	Identity and Access, API Gateway, Apigee and Cloud Endpoints
Messaging Protocols, Messaging with SmallRye Reactive Messaging	Messaging and Integration
API Gateway and Backends for Frontends	Load Balancing and Cloud Armor, API Gateway, Apigee and Cloud Endpoints
Scheduling and Mail	Sending Email from Google Cloud
Logging: Logback Defaults, Structured Output, and Container-Friendly Routing, Metrics and Observability: Micrometer, Actuator, and Distributed Tracing, Prometheus & Monitoring	Monitoring and Observability
Build and Deployment, Performance and Deployment, Production and Deployment	Cloud Storage Security and Static Sites, Cloud CDN and Media CDN, Choosing a Compute Service
Publishing on Google Play	Developer Tools and DevOps
Starting a New Project: Which Path and Which Technologies	Architecture, Migration and Multicloud

Existing page

Link from

Deploying Redis on Google Cloud (+ its Azure/AWS siblings)

Memorystore and Partner Databases

File Storage & Object Stores

Cloud Storage, Block and File Storage on Google Cloud

Configuration and Profiles (Kubernetes ConfigMaps and Secrets)

Secret Manager and Cloud KMS, Runtime Configuration

Orchestration: Swarm Mode and Kubernetes, Registries and Docker Hub, Docker CI/CD with GitHub Actions

Container Registry and Builds, GKE Clusters, Deploying Microservices on GKE, Developer Tools and DevOps

Kubernetes (generic Kubernetes concepts)

GKE Clusters, Deploying Microservices on GKE

Comparing Vector Databases, PostgreSQL & pgvector, The Vector Database Landscape

Managed Databases on Google Cloud, Cloud SQL, AlloyDB for PostgreSQL

Choosing the Right Database, Authentication, authorization & encryption

Managed Databases on Google Cloud, MongoDB on Google Cloud

Serverless and Cloud Functions, Kubernetes and OpenShift

Cloud Run Functions and Events, Deploying Microservices on GKE

Social Login and Federation, Authorization Server & Social Login, JWT, OIDC and Keycloak

Identity and Access, API Gateway, Apigee and Cloud Endpoints

Messaging Protocols, Messaging with SmallRye Reactive Messaging

Messaging and Integration

API Gateway and Backends for Frontends

Load Balancing and Cloud Armor, API Gateway, Apigee and Cloud Endpoints

Scheduling and Mail

Sending Email from Google Cloud

Logging: Logback Defaults, Structured Output, and Container-Friendly Routing, Metrics and Observability: Micrometer, Actuator, and Distributed Tracing, Prometheus & Monitoring

Monitoring and Observability

Build and Deployment, Performance and Deployment, Production and Deployment

Cloud Storage Security and Static Sites, Cloud CDN and Media CDN, Choosing a Compute Service

Publishing on Google Play

Developer Tools and DevOps

Starting a New Project: Which Path and Which Technologies

Architecture, Migration and Multicloud

Related open issues cover adjacent ground this section doesn’t (yet): #171 tracks Terraform as a first-class infrastructure-as-code topic and #184 tracks a closer look at API managers, secret managers, and gateways and scaling in the cloud more broadly.

Bibliography

Requester-provided book, consulted for the practitioner’s angle and for concept coverage only — never the primary source for any command or code example on this section’s pages, and where it predates a change (for example the gsutil tool, Container Registry or Cloud Functions naming) the pages follow the current official documentation: