Appendix G
Terminology and Acronyms
Scope. The terms and acronyms this book uses, grouped by domain, each with the section that defines it. A reminder of what a word means, not a place to learn the concept behind it. Prerequisites. None. Verified against. Google Cloud console and API surface as of 2026-09, Cloud SDK 583.0.0; every section reference re-resolved against its owning chapter; see sources at end.
The chapters define each term where it is first needed, which is the right place to learn it and the wrong place to look it up six months later. This appendix is the lookup: one line each, sorted by domain rather than by the order the book happens to introduce them.
The § is the authority. Where a one-line definition and a chapter disagree, the chapter is right and the line here is too short. Acronyms are given with the expansion first, since that is what a reader who does not recognize one actually needs.
G.1 GCP Terminology §
Platform vocabulary: the hierarchy, the resource containers, and the words Google uses for its own building blocks.
| Term | Definition | § |
|---|---|---|
| CEL | Common Expression Language, the expression syntax used by IAM conditions, custom organization policy constraints, and federation attribute mappings. | §2.30 |
| Control plane | The API surface that creates, modifies, or describes configuration; audited in Admin Activity logs. | §1.8 |
| Data plane | Traffic that reads or writes the content a resource holds; audited only if Data Access logs are enabled. | §1.8 |
| Folder | An optional hierarchy node between organization and project that carries IAM, organization policy, tags, and hierarchical firewall policies. Nests ≤10 deep, ≤300 children per parent. | §1.7, §2.8 |
| Label | Non-inherited key/value metadata used for cost attribution, inventory, and filtering; unusable in IAM conditions or organization policy. Max 64 per resource, ≤63 chars. | §2.12 |
| Launch stage (GA / Preview / Beta / Alpha) | The support label on an API surface or role; Preview and earlier must never be a production dependency. | §3.12 |
| Managed instance group (MIG) | A set of instances created from one instance template and kept conformant to it; regional by default, stateless unless explicitly configured otherwise. | §8.11 |
| Organization | The hierarchy root, one per Cloud Identity or Workspace account, provisioned automatically on domain association. | §1.7, §2.7 |
| Organization policy | A constraint evaluated by the Google Cloud API itself, so it holds regardless of how a change is submitted. | §2.30 |
| Project | The container owning billing, quota, API enablement, and the default IAM boundary; the blast-radius unit. | §1.5, §2.9 |
| Project ID | 6–30 char immutable globally unique identifier; never reusable after deletion. | §2.9 |
| Project number | Google-assigned numeric identifier used by service agents and tag bindings. | §1.5 |
| Resource Manager | The API owning organizations, folders, projects, tag keys, tag values, and tag bindings. | §2.6 |
| Tag | Inheritable key/value metadata implemented as discrete TagKey, TagValue, and TagBinding resources; usable in IAM conditions and organization policy. | §2.13 |
G.2 IAM Terminology §
Identity, roles, and the federation machinery. The distinctions that cause the most trouble in practice are between a role and a permission, and between impersonating an account and being attached to one.
| Term | Definition | § |
|---|---|---|
| ADC | Application Default Credentials — the client-library search order that finds an attached identity or a federation credential file without a key. | §1.10 |
| Attached service account | A service account bound to a running resource so its code obtains short-lived tokens from the metadata server instead of using a downloaded key. | §1.10 |
| Attribute condition | CEL on a federation provider that must be true for an assertion to be accepted; where the security decision belongs. | §4.1 |
| Attribute mapping | CEL turning IdP claims into google.subject, google.groups, and attribute.NAME. | §4.1 |
| Basic roles | Six coarse project-wide roles: legacy Owner, Editor, Viewer, plus Admin, Writer, Reader, which are Preview. Never granted in this book. | §3.10 |
| Custom role | A role you define; creatable at organization or project only, capped at 300 per org, and does not gain permissions as services add methods. | §3.12 |
| Identity-Aware Proxy (IAP) | Central authorization layer in front of web resources and administrative TCP tunnels. Application-delivery use is §7.17. | §4.16 |
| Impersonation | Obtaining a short-lived credential for a service account; logs both the human and the account. | §3.24 |
| OIDC | OpenID Connect — the token format behind most workload federation providers. | §4.5 |
| OS Login | Governing Linux host access through IAM roles (roles/compute.osLogin, roles/compute.osAdminLogin) rather than metadata SSH keys; §8.19 owns the mechanics. | §4.18, §8.19 |
| Principal | Any identity IAM can name in a policy; the identifier prefix determines the identity type and its governance. | §3.2 |
| Privileged Access Manager (PAM) | Google Cloud's just-in-time privilege service; GA for core grants, refusing the legacy Owner/Editor/Viewer roles. | §3.27 |
| SAML | Security Assertion Markup Language — the assertion format used by Workforce Identity Federation and legacy SSO. | §4.6 |
| Security Token Service (STS) | The sts.googleapis.com endpoint that exchanges a verified external assertion for a short-lived Google credential, per RFC 8693. | §4.1 |
| Service account key | A downloadable, non-expiring bearer credential; an anti-pattern throughout this book. | §3.25 |
| Service agent | A Google-created, Google-managed service account that lets a service act on your behalf. | §1.10 |
| WIF | The book abbreviation for Workload Identity Federation. | §4.3 |
| Workload Identity Federation | Exchange of an external workload's native token for a Google credential; the mechanism that removes service account keys. | §4.3 |
G.3 Networking Terminology §
Addressing, routing, and the data path. Terms whose subject is an authorization boundary rather than a path — service perimeters above all — are in G.7 instead, because grouping them with subnets teaches the wrong model.
| Term | Definition | § |
|---|---|---|
| Alias IP / secondary range | An additional subnet range used by GKE pods and services so their addresses are routable and visible to firewall policy. | §5.4 |
| ASN | Autonomous system number, chosen per Cloud Router and per on-premises peer. | §5.21 |
| Backend service | The load balancer object holding Cloud Armor policy, IAP, CDN, logging, timeouts, and the backend list; where most delivery security configuration lives. | §7.6 |
| BGP | Border Gateway Protocol, the dynamic routing protocol Cloud Router speaks over VPN and Interconnect. | §6.3 |
| Cloud NAT | Distributed managed outbound NAT configured on a Cloud Router; not an egress control. | §5.20 |
| Host project | The Shared VPC project owning the network, subnets, routes, firewall policy, Cloud Router, NAT, and DNS. | §5.28 |
| Implied rules | Every VPC's undeletable defaults: deny ingress to VM instances, allow all egress. | §5.13 |
| NEG | Network endpoint group — the backend type addressing endpoints directly rather than instance groups. | §7.6 |
| NGFW | Cloud Next Generation Firewall — the current name for firewall policies and their L7 inspection surface. | §5.31 |
| Private Google Access | Per-subnet setting letting VMs without external IPs reach Google APIs over internal paths. | §5.17 |
| Private Service Access | VPC peering to a Google service producer network from a range you allocate; not transitive, IPv4 only. | §5.18 |
| Private Service Connect | Consumer-side endpoints or backends reaching a producer service or Google API bundle, with independent address spaces on both sides. | §5.19 |
| Proxy-only subnet | A REGIONAL_MANAGED_PROXY or GLOBAL_MANAGED_PROXY subnet supplying addresses to Envoy proxies; one active and one backup per region per network, minimum /26. | §5.4, §7.4 |
restricted.googleapis.com | Private VIP range 199.36.153.4/30 reaching only VPC Service Controls–supported APIs; the correct choice inside a perimeter. | §1.9 |
| Service project | A project attached to a Shared VPC host, using its subnets while keeping its own IAM, billing, and quota. | §5.29 |
| Shared VPC | The arrangement separating network ownership (host project) from workload ownership (service projects). | §5.27 |
G.4 Kubernetes Terminology §
Kubernetes and GKE vocabulary, limited to what this book uses. Kubernetes' own general concepts are assumed.
| Term | Definition | § |
|---|---|---|
| Container-native load balancing | GKE load balancing that targets pod IPs directly through zonal Network Endpoint Groups instead of node IPs and a NodePort. | §9.23 |
| Container-Optimized OS | GKE's default minimal, auto-patching, read-only-root node image. | §9.31 |
| Dataplane V2 | GKE's eBPF-based dataplane built on Cilium, replacing iptables and making Kubernetes NetworkPolicy always-on. | §9.16 |
| Direct principal binding | Granting an IAM role straight to a federated identity (e.g. a Kubernetes ServiceAccount) with no Google service account in between. | §4.12 |
| DNS-based control plane endpoint | The current recommended GKE control-plane access model: a stable FQDN integrated with IAM and VPC Service Controls, enabled with --enable-dns-access. | §9.4 |
| GKE Enterprise | The paid GKE edition bundling fleet-wide Config Sync, Policy Controller, and related features beyond GKE Standard. | §9.38, §9.39 |
| GKE metadata server | Per-node component intercepting metadata.google.internal and exchanging Kubernetes ServiceAccount tokens for federated tokens; 500 concurrent connections per node. | §4.12 |
| GKE Sandbox | A gVisor-based per-node or per-pod isolation layer re-implementing the kernel syscall surface in userspace. | §9.2 |
| Pod Security Admission | The built-in admission controller enforcing the Pod Security Standards (privileged, baseline, restricted), replacing PodSecurityPolicy (removed in Kubernetes 1.25). | §9.14 |
| RBAC | Kubernetes role-based access control, evaluated inside the cluster and separate from IAM. | §9.12 |
| VPC-native cluster | A GKE cluster using alias IP secondary ranges for pods and Services; the only networking mode for new clusters. | §9.7 |
G.5 SecDevOps Terminology §
Practice vocabulary: reliability, delivery, and the measurements that make both arguable. These are the terms an engineer is expected to already know and most often knows only approximately.
| Term | Definition | § |
|---|---|---|
| Attestation | A signed statement that an image passed a check, created against a Binary Authorization attestor and bound to the image's digest; the attesting identity must not be the build identity. | §25.11 |
| Build config | The cloudbuild.yaml document defining steps, options, substitutions, artifacts, and the service account; it must live in the protected repository, not inline in a trigger. | §23.1 |
| Build step | A container image run in order against a shared /workspace; its image is an input to the build and must be pinned by digest. | §23.3 |
| CVE | Common Vulnerabilities and Exposures identifier, the unit of a vulnerability finding. | §24.6 |
| Delivery pipeline | The ordered list of Cloud Deploy stages, each naming a target and optionally a strategy and Skaffold profiles. | §25.1 |
| DSSE | The Dead Simple Signing Envelope wrapping a provenance payload — payloadType, payload, signatures. | §37.5 |
| Immutable tags | A Docker-format repository setting preventing tags from being deleted or moved to a different digest and preventing tagged images from being deleted. | §24.5 |
| Occurrence | A metadata record attached to an artifact — build, discovery, vulnerability, or SBOM reference — surfaced by --show-occurrences. | §24.2 |
| Private pool | A set of Cloud Build workers in a network peered to yours, optionally with --no-public-egress, which is the only constraint on exfiltration from a build. | §23.5 |
| Recovery time objective (RTO) | The maximum tolerable time to restore service after failure; a target you set and measure, not a figure Google publishes. | §E.9 |
| Remote repository | An Artifact Registry mode that fetches from a public upstream and caches it, turning public dependency risk into a store you control. | §24.1 |
| SBOM | Software bill of materials, surfaced as an Artifact Analysis occurrence on an image. | §24.2 |
| SLSA | The framework of levels describing a build pipeline's tamper resistance; Cloud Build provenance supports level 3 assurance for the build platform, not for your source practices. | §23.14 |
| SLSA track | A dimension of the v1.2 specification; the Build track has levels 1–3 and the published Source track has four, its top level requiring two-person review. | §37.10 |
G.6 Infrastructure-as-Code Terminology §
Terraform, OpenTofu, and Ansible vocabulary, including the few terms where the two Terraform implementations genuinely differ.
| Term | Definition | § |
|---|---|---|
auth_kind | The required google.cloud credential selector, taking application, machineaccount, serviceaccount, or accesstoken; only serviceaccount consumes a key file. | §28.4 |
| Backend block | The root-module declaration of where state lives; a child module may not have one, and under OpenTofu alone it may reference variables (§27.8). | §26.14 |
| Data source | A read-only reference to infrastructure another configuration owns; some return secrets into state, and provider 8 supplies ephemeral equivalents for the two worst. | §26.11 |
| Drift | The difference between refreshed state and what state records; detected with terraform plan -refresh-only -detailed-exitcode, where exit code 2 means a diff. | §26.22 |
| Ephemeral resource | A Terraform 1.10+ resource whose values are never written to state or to a plan file; provider 8 ships six, including google_secret_manager_secret_version. | §26.11, §26.17 |
Lock file (.terraform.lock.hcl) | The record of the exact provider versions and checksums resolved; a supply chain control, committed to version control, and rewritten by tofu init (§27.5). | §26.1 |
| Root module | The directory Terraform runs in; the only place a backend, a provider block, or variable values may appear. | §26.6 |
| State (Terraform) | The address-to-resource map, attribute cache, and plaintext record of every value the provider read or wrote; treated as a secret store by §2.21. | §26.13 |
| Write-only argument | A provider argument whose value never reaches state or a plan file; provider 8 carries them on sixteen resources, and OpenTofu 1.11+ supports them too. | §13.13, §26.17 |
G.7 Security Terminology §
The largest section, because security vocabulary spans every chapter: keys, secrets, audit evidence, perimeters, and compliance. A term here is defined once and owned by the section named beside it.
| Term | Definition | § |
|---|---|---|
| Access policy | The container for perimeters and access levels; one organization-level policy per organization, plus up to 50 folder- and project-scoped policies. | §20.2 |
| ACL | Access control list — the per-object Cloud Storage mechanism that uniform bucket-level access disables. | §11.8 |
| Crypto-shredding | Destroying a key version to render every ciphertext under it permanently unrecoverable; erases data only if every copy is under that version alone. | §14.17 |
| Customer-managed encryption keys (CMEK) | Google-performed encryption under a key you administer and can revoke or destroy independently of the resource it protects. | §14.8 |
| Customer-supplied encryption keys (CSEK) | Key material supplied per API request; Google never stores it, only a validation hash, so a lost key permanently loses the data. | §14.9 |
| Data encryption key (DEK) | A locally generated key used to encrypt a payload directly in envelope encryption; wrapped by a KEK for storage. | §14.16 |
| DLP | The former brand for Sensitive Data Protection; the API and several commands still carry the name. | §15.4 |
| External Key Manager (EKM) | Cloud KMS protection level where the key material lives in an external system (Fortanix, Futurex, Thales) reached over the internet or a VPC path; unreachability makes protected data unavailable. | §14.11 |
| HSM | Hardware security module — the Cloud KMS protection level with hardware-held key material. | §14.10 |
| Key Access Justifications (KAJ) | An Assured-Workloads-only control attaching a justification code to every Google-system cryptographic operation on an enrolled key; production use requires GA status per consuming service. | §14.14 |
| Key encryption key (KEK) | The Cloud KMS key that wraps a data encryption key in envelope encryption; it never leaves Cloud KMS. | §14.16 |
| Key ring | A named, regional, undeletable grouping of keys with no configuration of its own; location and name are permanent. | §14.2 |
| Key version | The Cloud KMS resource holding actual key material for one algorithm and protection level; ciphertext is bound to the version that produced it. | §14.4 |
| Protection level | Where a Cloud KMS key's cryptographic operations execute: software, hsm, external, or external-vpc. | §14.5 |
| Public access prevention (PAP) | A bucket setting, inherited or enforced, blocking any public binding regardless of mechanism. | §11.10 |
| Service perimeter | A boundary around a set of projects, enforced by the Google API front end, that denies cross-boundary access to restricted services even when IAM allows it. | §20.2 |
| Signed URL | A time-limited URL, up to 7 days, granting access to one object independent of IAM for its lifetime. | §11.11 |
| Uniform bucket-level access (UBLA) | Bucket setting making IAM the sole access-control mechanism, disabling ACLs; irreversible after 90 consecutive days active. | §11.9 |
| Version destroy TTL | A configured delay between a destroy call and irreversible payload deletion, giving an investigation window. | §13.2 |
| VPC accessible services | The complementary control restricting which Google APIs the networks inside a perimeter may call at all. | §20.3 |
Sources §
Every definition here is a compression of the section named beside it, and those chapters carry the sources behind them. This appendix asserts no Google Cloud fact independently of the chapter that owns it; the selection method, the terms held in reserve, and the stale definitions corrected while building it are recorded in .build/verify/appG.md.