Storage & Networking

Cloud Storage bucket/object operations, and VPC network/subnet/firewall setup.

Cloud Storage — buckets#

Copy
gcloud storage buckets create gs://my-bucket --location=us-central1 --default-storage-class=STANDARD
gcloud storage buckets list
gcloud storage buckets describe gs://my-bucket
gcloud storage rm --recursive gs://my-bucket             # delete a bucket and everything in it

gcloud storage is the current, unified CLI surface for Cloud Storage — it replaces the older standalone gsutil for day-to-day object operations and is the one to reach for in new scripts; gsutil still exists for a handful of things gcloud storage hasn't covered yet.

Cloud Storage — objects#

Copy
gcloud storage cp ./file.txt gs://my-bucket/path/file.txt
gcloud storage cp gs://my-bucket/path/file.txt ./file.txt
gcloud storage cp -r ./local-dir gs://my-bucket/path/     # recursive upload
gcloud storage ls gs://my-bucket/path/ --recursive
gcloud storage rm gs://my-bucket/path/file.txt

VPC networks and subnets#

Copy
gcloud compute networks create my-network --subnet-mode=custom
gcloud compute networks subnets create my-subnet \
  --network=my-network --range=10.0.1.0/24 --region=us-central1
gcloud compute networks list
gcloud compute networks subnets list --filter="region:us-central1"

--subnet-mode=custom is the deliberate choice for anything beyond a quick test — auto mode creates one subnet per region automatically with fixed ranges, which is convenient but takes IP planning out of your hands; custom mode is standard for production VPC design.

Firewall rules#

Copy
gcloud compute firewall-rules create allow-https \
  --network=my-network --direction=INGRESS \
  --allow=tcp:443 --source-ranges=0.0.0.0/0

gcloud compute firewall-rules create allow-internal-ssh \
  --network=my-network --direction=INGRESS \
  --allow=tcp:22 --source-ranges=10.0.0.0/16 --target-tags=ssh-allowed

gcloud compute firewall-rules list

GCP firewall rules are stateful and apply at the VPC network level (not per-subnet) — --target-tags scopes a rule to instances carrying that network tag, the equivalent of AWS's per-security-group model but implemented as network-wide rules filtered by tag instead of a security group object attached to the instance.