Front matter
How to Use This Book
You do not have to read this book in exactly one way.
It is designed to work both as a sequential course through GCP and as a reference you can return to when you are solving a specific problem.
Read it from the beginning §
If you are new to GCP, this is the best path.
Start with the resource hierarchy, identity, and networking material before jumping directly into GKE, Cloud Run, databases, or CI/CD.
GCP becomes considerably easier to reason about once you understand:
- where a resource lives;
- which identity is acting;
- which policy applies;
- which network path is being used;
- where logs and audit records go.
Those concepts keep reappearing.
Use it as a reference §
If you already operate GCP, jump directly to the chapter you need.
Most chapters are designed to stand on their own, with prerequisite sections pointing back to material that matters.
The appendices are built for exactly this: Appendix B indexes every IAM role the book grants, Appendix C the organization policy baseline, Appendix D every security control merged and sorted by resource, and Appendix G the terminology. Use those in the print edition, or full-text search in the digital editions.
Follow the SaaS path §
If you are building a modern SaaS platform, pay particular attention to:
- IAM and workload identity;
- VPC design;
- Cloud Run and GKE;
- Cloud SQL and AlloyDB;
- Cloud Storage;
- Pub/Sub;
- Secret Manager;
- Cloud KMS;
- Artifact Registry;
- CI/CD;
- tenant isolation;
- observability;
- multi-region design;
- supply-chain controls on what you ship.
Those chapters give you the pieces and the controls that govern them. Assembling them into a complete multi-tenant platform design is the subject of the companion volume.
Follow the enterprise path §
If you are building or modernizing an enterprise GCP environment, focus on:
- organization and folder design;
- project factories;
- Shared VPC;
- hybrid connectivity;
- identity federation;
- privileged access;
- organization policies;
- centralized logging;
- centralized security;
- VPC Service Controls;
- governance;
- compliance and hardening.
The book develops each of these as a control you can enforce and verify. The full landing-zone and operating-model treatment is the subject of the companion volume.
Follow the security path §
Security engineers can treat the book as a progression from identity and network trust to application, data, pipeline, and operational controls.
A useful security path is:
- resource hierarchy;
- IAM;
- federation;
- networking;
- Secret Manager and KMS;
- audit logging;
- Security Command Center;
- Cloud Armor;
- VPC Service Controls;
- API security;
- software-supply-chain controls;
- policy as code;
- hardening;
- incident response.
Follow the infrastructure-as-code path §
Terraform and OpenTofu examples are deliberately placed beside the architecture they implement instead of being isolated into one enormous syntax tutorial.
If infrastructure as code is your primary interest, read the IaC foundation chapters first, then move through the implementation examples for:
- organizations;
- projects;
- IAM;
- networking;
- compute;
- GKE;
- Cloud Run;
- databases;
- logging;
- security controls.
Ansible is used for configuration and day-two operations where it fits the problem better than cloud resource provisioning.
Do the examples §
Reading infrastructure code is useful.
Running it in an isolated project is better.
Create a sandbox. Set a budget alert. Know what the resources cost. Destroy the environment when you are finished.
You will learn more from one failed deployment that you understand than from fifty screenshots you click through without knowing what changed.