gcloud functions deploy processFile \
    --gen2 \
    --runtime=nodejs20 \
    --region=us-central1 \
    --trigger-event-filters="type=google.cloud.storage.object.v1.finalized" \
    --trigger-event-filters="bucket=my-upload-bucket" \
    --memory=512MiB \
    --timeout=300s \
    --min-instances=1 \
    --max-instances=100

{
  "rule": [
    {"action": {"type": "SetStorageClass", "storageClass": "NEARLINE"}, "condition": {"age": 30}},
    {"action": {"type": "SetStorageClass", "storageClass": "COLDLINE"}, "condition": {"age": 90}},
    {"action": {"type": "Delete"}, "condition": {"age": 365}}
  ]
}

-- Find most expensive queries in the last 7 days
SELECT user_email, query, total_bytes_processed, total_slot_ms,
       ROUND(total_bytes_processed / POW(10,12) * 5, 2) as estimated_cost_usd
FROM `region-us`.INFORMATION_SCHEMA.JOBS_BY_PROJECT
WHERE creation_time > TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 7 DAY)
ORDER BY total_bytes_processed DESC LIMIT 20;

Policy -> Rules (evaluated by priority, lowest number first)
Rule = Match Condition + Action (allow/deny/rate_limit/redirect/throttle)

PR created -> Trigger CI:
  1. Run linter (golangci-lint, eslint)
  2. Run unit tests
  3. Build container image
  4. Run integration tests (against test environment)
  5. Push image to Artifact Registry (tagged with commit SHA)

Merge to main -> Trigger CD:
  1. Pull tested image from Artifact Registry
  2. Binary Authorization attestation (sign the image)
  3. Deploy to staging (Cloud Run or GKE)
  4. Run smoke tests against staging
  5. Manual approval gate
  6. Deploy to production (canary -> full rollout)

# Create peering from network-a to network-b (must be done on BOTH sides)
gcloud compute networks peerings create peer-ab \
    --network=network-a \
    --peer-network=network-b

gcloud compute networks peerings create peer-ba \
    --network=network-b \
    --peer-network=network-a

# Step 1: Create a Cloud Router
gcloud compute routers create my-router \
    --network=my-network \
    --region=us-central1

# Step 2: Create NAT configuration
gcloud compute routers nats create my-nat \
    --router=my-router \
    --region=us-central1 \
    --nat-all-subnet-ip-ranges \
    --auto-allocate-nat-external-ips

# For specific subnets only + static IPs
gcloud compute routers nats create my-nat \
    --router=my-router \
    --region=us-central1 \
    --nat-custom-subnet-ip-ranges=my-subnet \
    --nat-external-ip-pool=my-static-ip

# Create policy
gcloud compute security-policies create my-policy

# Allow only US traffic
gcloud compute security-policies rules create 1000 \
    --security-policy=my-policy \
    --expression="origin.region_code == 'US'" \
    --action=allow

# Block known bad IPs
gcloud compute security-policies rules create 900 \
    --security-policy=my-policy \
    --src-ip-ranges="203.0.113.0/24,198.51.100.0/24" \
    --action=deny-403

# Enable OWASP SQLi protection
gcloud compute security-policies rules create 2000 \
    --security-policy=my-policy \
    --expression="evaluatePreconfiguredExpr('sqli-v33-stable')" \
    --action=deny-403

# Rate limiting: max 100 requests per minute per IP
gcloud compute security-policies rules create 3000 \
    --security-policy=my-policy \
    --expression="true" \
    --action=rate-based-ban \
    --rate-limit-threshold-count=100 \
    --rate-limit-threshold-interval-sec=60 \
    --ban-duration-sec=300

# Attach to backend service
gcloud compute backend-services update my-backend \
    --security-policy=my-policy

# role.yaml
title: "Custom Storage Admin"
description: "Can manage buckets and objects but not IAM"
stage: "GA"
includedPermissions:
- storage.buckets.create
- storage.buckets.delete
- storage.buckets.get
- storage.buckets.list
- storage.objects.create
- storage.objects.delete
- storage.objects.get
- storage.objects.list

# Create at project level
gcloud iam roles create customStorageAdmin \
    --project=PROJECT_ID \
    --file=role.yaml

# Create at organization level (usable across projects)
gcloud iam roles create customStorageAdmin \
    --organization=ORG_ID \
    --file=role.yaml

# List permissions for a predefined role (to identify what to include)
gcloud iam roles describe roles/storage.admin

# Create a dedicated service account
gcloud iam service-accounts create my-sa \
    --display-name="My Application Service Account"

# Grant a specific role (NEVER grant roles/editor)
gcloud projects add-iam-policy-binding PROJECT_ID \
    --member="serviceAccount:my-sa@PROJECT_ID.iam.gserviceaccount.com" \
    --role="roles/storage.objectViewer"

# Attach to a VM at creation (preferred over key files)
gcloud compute instances create my-vm \
    --service-account=my-sa@PROJECT_ID.iam.gserviceaccount.com \
    --scopes=cloud-platform

# AVOID: Creating downloadable keys (use only when no alternative)
gcloud iam service-accounts keys create key.json \
    --iam-account=my-sa@PROJECT_ID.iam.gserviceaccount.com

gcloud sql instances create my-instance \
    --database-version=POSTGRES_14 \
    --tier=db-n1-standard-2 \
    --region=us-central1 \
    --availability-type=REGIONAL \
    --enable-bin-log \
    --backup-start-time=02:00

# Add a cross-region read replica for DR
gcloud sql instances create my-replica \
    --master-instance-name=my-instance \
    --region=europe-west1

-- WRONG: Sequential primary key causes hotspotting
CREATE TABLE Users (
    UserId INT64 NOT NULL,
    Name STRING(100),
) PRIMARY KEY (UserId);

-- RIGHT: UUID or bit-reversed key distributes writes
CREATE TABLE Users (
    UserId STRING(36) NOT NULL,  -- UUID
    Name STRING(100),
) PRIMARY KEY (UserId);

-- Interleaved tables (replaces JOINs with co-located data)
CREATE TABLE Orders (
    UserId STRING(36) NOT NULL,
    OrderId STRING(36) NOT NULL,
    Total FLOAT64,
) PRIMARY KEY (UserId, OrderId),
  INTERLEAVE IN PARENT Users ON DELETE CASCADE;

-- Time-unit partitioning (most common)
CREATE TABLE dataset.events
PARTITION BY DATE(event_timestamp)
AS SELECT * FROM source_table;

-- Integer range partitioning
CREATE TABLE dataset.users
PARTITION BY RANGE_BUCKET(user_age, GENERATE_ARRAY(0, 100, 10))
AS SELECT * FROM source_table;

-- Query with partition pruning (scans only 1 partition)
SELECT * FROM dataset.events
WHERE DATE(event_timestamp) = '2024-01-15';

-- Check partition information
SELECT table_name, partition_id, total_rows, total_logical_bytes
FROM `dataset.INFORMATION_SCHEMA.PARTITIONS`
WHERE table_name = 'events';

-- Combined partitioning + clustering
CREATE TABLE dataset.events
PARTITION BY DATE(event_timestamp)
CLUSTER BY user_id, country, event_type
AS SELECT * FROM source_table;

-- This query benefits from both partition pruning AND clustering
SELECT user_id, COUNT(*) as event_count
FROM dataset.events
WHERE DATE(event_timestamp) = '2024-01-15'
  AND country = 'US'
GROUP BY user_id;