Skip to main content

Google Cloud Concepts

Understanding the foundational concepts of Google Cloud is the essential first step toward building expertise on the platform. These concepts describe how Google Cloud organizes its global infrastructure, structures resources, manages identity, and enforces governance. They are the platform-specific expressions of the universal cloud principles covered in Cloud Foundations.

This section of CloudComputingDevPro presents these core ideas as a structured set of documentation. Each page explains a single concept—such as the resource hierarchy, IAM model, or VPC network design—in a vendor-aware but focused manner. Use this hub to build a solid mental model of Google Cloud before you begin exploring its individual services.

Learning Path​

Google Cloud concepts bridge the universal cloud fundamentals and the platform’s specific services. The recommended sequence is:

Cloud Foundations

↓

Google Cloud Concepts (this section)

↓

Google Cloud Services

↓

Google Cloud Architecture

↓

Google Cloud Best Practices

Investing time in these concepts prevents shallow memorization. An engineer who understands the resource hierarchy can immediately reason about project isolation and billing; someone who grasps the VPC network model can design secure, globally distributed networks without first learning every networking service.

Global Infrastructure​

Google Cloud’s infrastructure is built on one of the world’s largest and most advanced networks. These pages describe the physical and logical building blocks that determine where and how your workloads run.

  • Google Cloud Global Infrastructure – An overview of how Google organizes its worldwide presence to deliver reliable, low-latency services.
  • Regions – Independent geographic areas that contain multiple zones; the primary boundary for data residency and service location.
  • Zones – Isolated deployment locations within a region, each with independent power, cooling, and networking.
  • Multi-Regions – A set of geographically distributed regions whose storage and compute resources span multiple locations for higher availability.
  • Google Global Network – The private, software-defined network that connects all Google Cloud regions and points of presence worldwide.
  • Edge Locations – Points of presence and caching sites placed close to users for content delivery and connection termination.
  • Points of Presence (PoPs) – Locations where Google peers with other networks to exchange traffic, reducing latency and improving throughput.

Google’s global infrastructure enables you to build applications that are fast, resilient, and compliant with regional requirements.

Resource Hierarchy​

Google Cloud organizes resources into a hierarchical structure that provides clear boundaries for access control, billing, and policy enforcement.

  • Organization – The root node of the hierarchy, representing a company or entity, and the anchor for organization-wide policies.
  • Folder – A grouping mechanism within an organization for applying policies and delegating administration at scale.
  • Project – The fundamental container for Google Cloud resources; resources within a project share trust, billing, and APIs.
  • Resource – An individual cloud asset (such as a virtual machine, storage bucket, or database) that belongs to a single project.
  • Resource Manager – The service that manages the resource hierarchy and enables programmatic creation and management of organizations, folders, and projects.
  • Billing Account – Defines how a project pays for resources; a single billing account can be linked to multiple projects.

This hierarchy is the backbone of governance on Google Cloud. Policies set at higher nodes automatically apply to lower nodes, simplifying security and compliance at scale.

Identity & Access Management​

Google Cloud’s identity and access management model defines who can do what on which resources. It is designed for fine-grained, least-privilege access control.

  • Cloud Identity – The identity platform that manages users and groups, optionally synchronized with existing directories.
  • IAM – The service that defines principals, roles, and policies to control access to Google Cloud resources.
  • Principals – Entities that can be granted permissions: user accounts, service accounts, Google groups, and Google Workspace domains.
  • Roles – A collection of permissions; roles are granted to principals and define what operations they can perform.
  • Permissions – The atomic units of access control; each permission authorizes a specific action on a specific resource.
  • Service Accounts – Special accounts for applications and services, rather than individual human users, used to run workloads and call APIs.
  • Workload Identity – A mechanism that allows workloads running outside Google Cloud (e.g., on AWS or Azure) to authenticate using Google Cloud service accounts without managing static keys.
  • IAM Policies – Declarative statements that bind roles to principals, defining access at the organization, folder, project, or resource level.

Networking Concepts​

Google Cloud’s networking model is built around a global Virtual Private Cloud (VPC) that can span regions without complex peering. These pages explain its key components.

  • Virtual Private Cloud (VPC) – A global, logically isolated network that you define and control, with subnets in multiple regions.
  • VPC Network – The container for all VPC resources; it defines the network’s routing and isolation properties.
  • Subnet – An IP address range within a VPC, tied to a specific region, where you place resources.
  • Firewall Rules – Stateful, granular rules that control inbound and outbound traffic to instances based on IPs, ports, and tags.
  • Routes – Entries that direct traffic; Google Cloud automatically creates system routes, and you can add custom routes for advanced topologies.
  • Cloud Load Balancing – A family of global, regional, and internal load balancers that distribute traffic across healthy instances.
  • Cloud DNS – A scalable, managed DNS service for resolving domain names and managing zones.
  • Cloud VPN – Securely connects on-premises networks to your VPC over an encrypted IPsec tunnel.
  • Cloud Interconnect – Dedicated, high-bandwidth private connections that bypass the public internet for hybrid and multi-cloud setups.
  • Shared VPC – Allows multiple projects to share a common VPC network, centralizing network administration while maintaining project autonomy.

Governance & Operations​

Governance concepts help you maintain security, compliance, and operational consistency across your Google Cloud environment.

  • Organization Policies – Constraints and rules that apply across your resource hierarchy to enforce security, cost, or configuration requirements.
  • IAM Governance – The practice of designing IAM roles and policies for least privilege, auditability, and scalable access management.
  • Resource Labels – Key-value metadata attached to resources for cost allocation, organization, and automation.
  • Tags – Similar to labels but managed at the organization level with policy-based enforcement.
  • Cloud Asset Inventory – A service that catalogs your Google Cloud and Anthos assets, providing a snapshot for analysis and compliance.
  • Audit Logs – Automated logs that record who did what, where, and when across your Google Cloud environment.
  • Security Command Center – A centralized security and risk management platform that identifies threats, misconfigurations, and vulnerabilities.
  • Landing Zone – A multi-project foundation that codifies best practices for identity, networking, security, and governance from the start.
  1. Learn Cloud Foundations.
  2. Understand Google Cloud Global Infrastructure.
  3. Learn Resource Hierarchy.
  4. Learn IAM and Security Concepts.
  5. Learn Networking Concepts.
  6. Continue to Google Cloud Services.
  7. Study Google Cloud Architecture.
  8. Apply Google Cloud Best Practices.

Continue Learning​