Verified7 commandsAI-assisted

Storage & Networking

Verified against Google Cloud SDK 553.0.0, flags verified via `gcloud <cmd> --help`, 2026-08-21 · official docs

Cloud Storage bucket/object operations, and VPC network/subnet/firewall setup.

Cloud Storage — buckets#

gcloud storage buckets create gs://my-bucket --location=us-central1 --default-storage-class=STANDARD
gcloud storage buckets list
gcloud storage buckets describe gs://my-bucket
gcloud storage rm --recursive gs://my-bucket             # delete a bucket and everything in it

gcloud storage is the current, unified CLI surface for Cloud Storage — it replaces the older standalone gsutil for day-to-day object operations and is the one to reach for in new scripts; gsutil still exists for a handful of things gcloud storage hasn't covered yet.

Cloud Storage — objects#

gcloud storage cp ./file.txt gs://my-bucket/path/file.txt
gcloud storage cp gs://my-bucket/path/file.txt ./file.txt
gcloud storage cp -r ./local-dir gs://my-bucket/path/     # recursive upload
gcloud storage ls gs://my-bucket/path/ --recursive
gcloud storage rm gs://my-bucket/path/file.txt

Bucket lifecycle rules#

cat > lifecycle.json <<'EOF'
{
  "rule": [
    {"action": {"type": "Delete"}, "condition": {"age": 365}},
    {"action": {"type": "SetStorageClass", "storageClass": "NEARLINE"}, "condition": {"age": 30}}
  ]
}
EOF
gcloud storage buckets update gs://my-bucket --lifecycle-file=lifecycle.json
gcloud storage buckets update gs://my-bucket --clear-lifecycle   # remove all lifecycle rules

Lifecycle rules apply in order and are evaluated daily by GCS, not instantly on upload — expect up to 24 hours before a newly-eligible object is actually acted on. Combining an age-based class transition (Standard → Nearline) with an eventual deletion rule is the standard cost-tiering pattern, mirroring S3 lifecycle transitions.

Bucket-level IAM#

gcloud storage buckets add-iam-policy-binding gs://my-bucket \
  --member="serviceAccount:my-service@my-project-id.iam.gserviceaccount.com" \
  --role="roles/storage.objectViewer"

gcloud storage buckets get-iam-policy gs://my-bucket
gcloud storage buckets remove-iam-policy-binding gs://my-bucket \
  --member="user:jane@example.com" --role="roles/storage.objectViewer"

Cloud Storage IAM bindings can be set at the bucket level (shown here) or per-object with legacy ACLs (gcloud storage objects update --add-acl-grant) — bucket-level IAM is the recommended approach for anything beyond a one-off exception, since per-object ACLs don't show up in get-iam-policy and are easy to lose track of.

Cloud Build — building from source#

gcloud builds submit --tag=gcr.io/my-project-id/my-image:latest .        # build a Dockerfile in cwd, push to GCR
gcloud builds submit --config=cloudbuild.yaml --substitutions=_ENV=staging .
gcloud builds list --limit=5
gcloud builds log <build-id>

--config points at a cloudbuild.yaml defining a multi-step build pipeline (build, test, push, deploy) instead of the single implicit "docker build" --tag does; --substitutions passes _UNDERSCORE_PREFIXED variables into that config. gcloud builds submit uploads the current directory as the build context, so run it from the repo root the same way you would docker build ..

VPC networks and subnets#

gcloud compute networks create my-network --subnet-mode=custom
gcloud compute networks subnets create my-subnet \
  --network=my-network --range=10.0.1.0/24 --region=us-central1
gcloud compute networks list
gcloud compute networks subnets list --filter="region:us-central1"

--subnet-mode=custom is the deliberate choice for anything beyond a quick test — auto mode creates one subnet per region automatically with fixed ranges, which is convenient but takes IP planning out of your hands; custom mode is standard for production VPC design.

Firewall rules#

gcloud compute firewall-rules create allow-https \
  --network=my-network --direction=INGRESS \
  --allow=tcp:443 --source-ranges=0.0.0.0/0

gcloud compute firewall-rules create allow-internal-ssh \
  --network=my-network --direction=INGRESS \
  --allow=tcp:22 --source-ranges=10.0.0.0/16 --target-tags=ssh-allowed

gcloud compute firewall-rules list

GCP firewall rules are stateful and apply at the VPC network level (not per-subnet) — --target-tags scopes a rule to instances carrying that network tag, the equivalent of AWS's per-security-group model but implemented as network-wide rules filtered by tag instead of a security group object attached to the instance.

← PreviousCompute: GCE & GKE