Google Cloud best practices: organization, security, reliability and costs

1. Organization and identities #

The foundations.

Rules #

• Separate projects per environment and application.
• IAM bindings on groups; no basic roles in production.
• Keyless service accounts; Workload Identity Federation for CI.
• Organization policies: regions, public IPs, service account keys.

2. Security and reliability #

Protecting and holding up.

Rules #

• VMs without public IPs, Cloud NAT and IAP for administration.
• Secret Manager, CMEK if required, VPC Service Controls for sensitive data.
• Regional services (MIG, GKE, Cloud SQL HA) across several zones.
• Audit logs exported to a dedicated project.

3. Operations and costs #

Lasting without drifting.

Rules #

• Infrastructure in Terraform, deployed by pipeline.
• Dashboards and SLOs in Cloud Monitoring.
• Labels to allocate costs; budgets per project; billing export to BigQuery.
• Committed use discounts for the baseline, Spot VMs for interruptible processing.

gcloud projects list --format="table(projectId,parent.id)"
gcloud resource-manager org-policies list --project=mon-projet
gcloud compute instances list --filter="networkInterfaces[].accessConfigs[0].natIP:*" --format="table(name,zone)"   # VM avec IP publique
gcloud iam service-accounts keys list --iam-account=api@mon-projet.iam.gserviceaccount.com --managed-by=user