Front matter
About This Book
Megalith's Big GCP Book is a practical guide to building, securing, automating, and operating Google Cloud environments.
It is organized around the way infrastructure is actually used rather than around the order in which Google happens to list products.
The book answers one question in order: how do you secure and automate a Google Cloud estate?
The early parts establish the platform and its controls — resource hierarchy and organization policy, identity and federation, networking, and the compute and storage services you will actually run.
The middle of the book covers the controls that protect data and reveal what happened to it: secrets and key management, sensitive-data protection, security operations, logging and audit, and the perimeter — Cloud Armor, VPC Service Controls, and API security.
The later parts make all of it repeatable and durable: software delivery and supply-chain security, infrastructure as code with Terraform, OpenTofu, and Ansible, compliance and hardening, and incident response.
Every chapter is written to the same question: what is on by default, what is the blast radius when it is wrong, how do I express it as code, and how do I prove afterward that it was correct.
What the book assumes §
You do not need to be a Google Cloud expert before starting.
You should, however, already be comfortable with the general mechanics of modern systems administration and software delivery.
The examples assume basic familiarity with:
- Linux or another Unix-like operating system;
- a command-line shell;
- TCP/IP networking;
- DNS;
- Git;
- YAML and JSON;
- public-key authentication;
- containers at a conceptual level;
- basic relational database concepts;
- common application deployment ideas.
You do not need previous Terraform, OpenTofu, Ansible, Kubernetes, or GCP experience to understand the foundational chapters, although some later material will move quickly.
What the book covers §
The book focuses on the GCP services and patterns that appear repeatedly in modern SaaS and enterprise environments.
That includes:
- Google Cloud organizations, folders, projects, and policies;
- IAM, service accounts, federation, and machine identity;
- VPC networks, Shared VPC, routing, DNS, NAT, load balancing, private access, and hybrid connectivity;
- Compute Engine;
- Google Kubernetes Engine;
- Cloud Run and serverless workloads;
- Cloud Storage;
- Cloud SQL, AlloyDB, Spanner, and selected data services;
- Pub/Sub and event-driven architecture;
- Secret Manager and Cloud KMS;
- Cloud Logging and Cloud Monitoring;
- Security Command Center;
- Cloud Armor and VPC Service Controls;
- Artifact Registry, Cloud Build, Cloud Deploy, and software-supply-chain security;
- Terraform;
- OpenTofu;
- Ansible;
- policy as code and organization-wide guardrails;
- hardening;
- compliance and auditability;
- incident response;
- confidential computing and zero-trust architecture.
What the book deliberately does not do §
Google Cloud is too large for every service to receive equal treatment.
This book is not an encyclopedia of every GCP product.
A highly specialized service may be mentioned briefly or omitted if it is not central to securing and automating a Google Cloud estate.
It is also not an architecture catalog. Designing a complete multi-tenant SaaS platform or an enterprise landing zone, the worked case studies, repository and pipeline design, and migration from an existing estate are all subjects in their own right, and they are the material of a companion volume rather than this one. What you will find here is everything those designs are built out of, and the controls that decide whether they hold.
The book also does not try to replace:
- Google's official API reference;
- product-specific release notes;
- pricing calculators;
- legal or compliance advice;
- vendor support;
- Kubernetes documentation;
- Terraform or OpenTofu language references;
- Ansible documentation.
Where a product's official documentation is the correct source for an exhaustive field-by-field reference, this book concentrates instead on architecture, implementation, security, and operational consequences.
How deep the examples go §
Examples are intended to be complete enough to teach a real pattern.
A short example may demonstrate one concept in isolation. Larger examples bring multiple services together and show the supporting IAM, networking, logging, secrets, and deployment decisions that are often missing from small tutorials.
The goal is not to produce a fictional "production-ready" label by adding more YAML.
The goal is to show what must be considered before a design deserves to be called production-ready.