# gcloud CLI Cheat Sheet — Storage & Networking

> **Tool:** Google Cloud CLI (gcloud)
> **Category:** Cloud CLIs
> **Verified against:** Google Cloud SDK 553.0.0, flags verified via `gcloud <cmd> --help`, 2026-08-21
> **Official docs:** https://cloud.google.com/sdk/gcloud/reference

Cloud Storage bucket/object operations, and VPC network/subnet/firewall setup.

## Cloud Storage — buckets

```bash
gcloud storage buckets create gs://my-bucket --location=us-central1 --default-storage-class=STANDARD
gcloud storage buckets list
gcloud storage buckets describe gs://my-bucket
gcloud storage rm --recursive gs://my-bucket             # delete a bucket and everything in it
```

`gcloud storage` is the current, unified CLI surface for Cloud Storage — it replaces the older standalone `gsutil` for day-to-day object operations and is the one to reach for in new scripts; `gsutil` still exists for a handful of things `gcloud storage` hasn't covered yet.

## Cloud Storage — objects

```bash
gcloud storage cp ./file.txt gs://my-bucket/path/file.txt
gcloud storage cp gs://my-bucket/path/file.txt ./file.txt
gcloud storage cp -r ./local-dir gs://my-bucket/path/     # recursive upload
gcloud storage ls gs://my-bucket/path/ --recursive
gcloud storage rm gs://my-bucket/path/file.txt
```

## Bucket lifecycle rules

```bash
cat > lifecycle.json <<'EOF'
{
  "rule": [
    {"action": {"type": "Delete"}, "condition": {"age": 365}},
    {"action": {"type": "SetStorageClass", "storageClass": "NEARLINE"}, "condition": {"age": 30}}
  ]
}
EOF
gcloud storage buckets update gs://my-bucket --lifecycle-file=lifecycle.json
gcloud storage buckets update gs://my-bucket --clear-lifecycle   # remove all lifecycle rules
```

Lifecycle rules apply in order and are evaluated daily by GCS, not instantly on upload — expect up to 24 hours before a newly-eligible object is actually acted on. Combining an age-based class transition (Standard → Nearline) with an eventual deletion rule is the standard cost-tiering pattern, mirroring S3 lifecycle transitions.

## Bucket-level IAM

```bash
gcloud storage buckets add-iam-policy-binding gs://my-bucket \
  --member="serviceAccount:my-service@my-project-id.iam.gserviceaccount.com" \
  --role="roles/storage.objectViewer"

gcloud storage buckets get-iam-policy gs://my-bucket
gcloud storage buckets remove-iam-policy-binding gs://my-bucket \
  --member="user:jane@example.com" --role="roles/storage.objectViewer"
```

Cloud Storage IAM bindings can be set at the bucket level (shown here) or per-object with legacy ACLs (`gcloud storage objects update --add-acl-grant`) — bucket-level IAM is the recommended approach for anything beyond a one-off exception, since per-object ACLs don't show up in `get-iam-policy` and are easy to lose track of.

## Cloud Build — building from source

```bash
gcloud builds submit --tag=gcr.io/my-project-id/my-image:latest .        # build a Dockerfile in cwd, push to GCR
gcloud builds submit --config=cloudbuild.yaml --substitutions=_ENV=staging .
gcloud builds list --limit=5
gcloud builds log <build-id>
```

`--config` points at a `cloudbuild.yaml` defining a multi-step build pipeline (build, test, push, deploy) instead of the single implicit "docker build" `--tag` does; `--substitutions` passes `_UNDERSCORE_PREFIXED` variables into that config. `gcloud builds submit` uploads the current directory as the build context, so run it from the repo root the same way you would `docker build .`.

## VPC networks and subnets

```bash
gcloud compute networks create my-network --subnet-mode=custom
gcloud compute networks subnets create my-subnet \
  --network=my-network --range=10.0.1.0/24 --region=us-central1
gcloud compute networks list
gcloud compute networks subnets list --filter="region:us-central1"
```

`--subnet-mode=custom` is the deliberate choice for anything beyond a quick test — `auto` mode creates one subnet per region automatically with fixed ranges, which is convenient but takes IP planning out of your hands; custom mode is standard for production VPC design.

## Firewall rules

```bash
gcloud compute firewall-rules create allow-https \
  --network=my-network --direction=INGRESS \
  --allow=tcp:443 --source-ranges=0.0.0.0/0

gcloud compute firewall-rules create allow-internal-ssh \
  --network=my-network --direction=INGRESS \
  --allow=tcp:22 --source-ranges=10.0.0.0/16 --target-tags=ssh-allowed

gcloud compute firewall-rules list
```

GCP firewall rules are stateful and apply at the VPC network level (not per-subnet) — `--target-tags` scopes a rule to instances carrying that network tag, the equivalent of AWS's per-security-group model but implemented as network-wide rules filtered by tag instead of a security group object attached to the instance.