Google Cloud Platform (GCP) Cheat Sheet

gcloud auth login                         # Browser-based logingcloud config set project my-project-id   # Set default projectgcloud config list                        # Show current configgcloud projects list                      # List accessible projectsgcloud config set compute/zone us-central1-a

gcloud compute instances create my-vm \  --machine-type=e2-medium --zone=us-central1-a \  --image-family=debian-12 --image-project=debian-cloudgcloud compute instances listgcloud compute instances stop my-vm --zone=us-central1-agcloud compute instances delete my-vm --zone=us-central1-agcloud compute ssh my-vm --zone=us-central1-a

gcloud storage buckets create gs://my-bucket --location=usgcloud storage cp ./file.txt gs://my-bucket/gcloud storage cp gs://my-bucket/file.txt ./gcloud storage ls gs://my-bucket/gcloud storage rm gs://my-bucket/file.txt

gcloud services enable compute.googleapis.comgcloud services list --enabledgcloud projects add-iam-policy-binding my-project-id \  --member="user:[email protected]" \  --role="roles/viewer"gcloud iam service-accounts create my-sa \  --display-name="My Service Account"

gcloud iam roles create customStorageViewer \  --project=my-project-id \  --title="Custom Storage Viewer" \  --permissions=storage.objects.get,storage.objects.list \  --stage=GA# Bind with a condition (expires access, or scopes to a resource prefix)gcloud projects add-iam-policy-binding my-project-id \  --member="user:[email protected]" \  --role="projects/my-project-id/roles/customStorageViewer" \  --condition='expression=resource.name.startsWith("projects/_/buckets/reports-"),title=reports-only,expression-format=CEL'# Audit effective policy for a principalgcloud projects get-iam-policy my-project-id \  --flatten="bindings[].members" \  --filter="bindings.members:[email protected]" \  --format="table(bindings.role)"

gcloud iam workload-identity-pools create github-pool \  --location=global --display-name="GitHub Actions Pool"gcloud iam workload-identity-pools providers create-oidc github-provider \  --location=global --workload-identity-pool=github-pool \  --issuer-uri="https://token.actions.githubusercontent.com" \  --attribute-mapping="google.subject=assertion.sub,attribute.repository=assertion.repository" \  --attribute-condition="assertion.repository=='my-org/my-repo'"gcloud iam service-accounts add-iam-policy-binding \  [email protected] \  --role="roles/iam.workloadIdentityUser" \  --member="principalSet://iam.googleapis.com/projects/123456/locations/global/workloadIdentityPools/github-pool/attribute.repository/my-org/my-repo"

gcloud run deploy my-service \  --image=us-central1-docker.pkg.dev/my-project-id/repo/my-service:v2 \  --region=us-central1 --no-traffic --tag=canary# Send 10% of live traffic to the new revision, keep 90% on stablegcloud run services update-traffic my-service \  --region=us-central1 \  --to-tags=canary=10 \  --to-latest=false# Promote once verifiedgcloud run services update-traffic my-service \  --region=us-central1 --to-latest

provider "google" {  project = "my-project-id"  region  = "us-central1"}resource "google_storage_bucket" "data" {  name          = "my-tf-bucket"  location      = "US"  force_destroy = false  uniform_bucket_level_access = true  lifecycle_rule {    condition { age = 30 }    action { type = "SetStorageClass", storage_class = "NEARLINE" }  }}resource "google_project_iam_member" "viewer" {  project = "my-project-id"  role    = "roles/storage.objectViewer"  member  = "serviceAccount:${google_service_account.reader.email}"}