Google Cloud For Intermediate
A complete, category-by-category catalog of Google Cloud Platform services, with technical descriptions written for readers who already understand cloud, networking, and software fundamentals.
This is a working reference to Google Cloud’s full service catalog, written for engineers who already understand core cloud concepts — VMs, containers, IAM, load balancing, pub/sub messaging — and want a fast, technically accurate overview of what each GCP product actually does, how it’s typically positioned, and where it fits relative to adjacent services. It assumes familiarity with general distributed-systems and networking terminology rather than re-explaining it from scratch.
1Compute Services
The execution layer — where workloads run, ranging from raw VMs to fully abstracted serverless runtimes.
Compute Engine
IaaS virtual machines with configurable machine types, custom images, live migration between hosts during maintenance, and support for preemptible/Spot VMs for cost-sensitive batch workloads.
App Engine
PaaS offering with Standard (sandboxed runtimes, fast autoscaling, scale-to-zero) and Flexible (Docker-based, Compute Engine-backed) environments for stateless HTTP services.
Google Kubernetes Engine (GKE)
Managed Kubernetes control plane with Autopilot (fully managed node provisioning) and Standard (manual node pool control) modes; integrates with Workload Identity and Config Sync.
Cloud Run
Fully managed Knative-based container runtime for stateless request/response or event-driven workloads, with per-request billing and concurrency controls.
Cloud Functions
Event-driven FaaS supporting HTTP triggers and GCP event sources (Pub/Sub, Storage, Firestore); 1st and 2nd gen differ in concurrency model and underlying infrastructure (2nd gen runs on Cloud Run).
Cloud Batch
Managed batch scheduling service that provisions and tears down Compute Engine VM fleets for parallel job execution, replacing manual instance-group orchestration for batch pipelines.
Bare Metal Solution
Dedicated, non-virtualized hardware colocated adjacent to GCP regions, used for license-sensitive workloads (e.g., Oracle databases) requiring direct hardware access and low-latency GCP connectivity.
Google Cloud VMware Engine
Runs a native VMware SDDC stack (vSphere, vSAN, NSX-T) on dedicated GCP infrastructure for lift-and-shift VMware migrations without hypervisor conversion.
Sole-Tenant Nodes
Compute Engine physical hosts dedicated to a single customer, used to satisfy per-core licensing terms or hard isolation/compliance requirements.
2Storage Services
Persistence layers differentiated by access pattern, durability class, and attachment model.
Cloud Storage
Object storage with Standard, Nearline, Coldline, and Archive classes for cost/latency tradeoffs, offering strong global consistency, versioning, and lifecycle management policies.
Persistent Disk
Network-attached block storage (zonal or regional) for Compute Engine and GKE, supporting SSD/HDD tiers and synchronous replication for regional disks.
Filestore
Managed NFS file shares for workloads requiring POSIX-compliant shared file access across multiple compute instances, such as CI build farms or shared model training data.
Local SSD
Physically attached NVMe/SCSI storage offering the highest IOPS on Compute Engine, but ephemeral — data is lost on instance termination or host maintenance events.
Storage Transfer Service
Managed, policy-driven data movement into Cloud Storage from S3, Azure Blob, on-premises HTTP/HDFS sources, or between buckets, with scheduling and checksum verification.
Cloud Storage for Firebase
A Cloud Storage layer fronted by Firebase Security Rules and SDKs, simplifying authenticated client-side uploads/downloads for mobile and web clients.
3Database Services
Managed persistence engines chosen by consistency model, scale ceiling, and query pattern.
Cloud SQL
Managed MySQL, PostgreSQL, and SQL Server with automated backups, read replicas, and high-availability configurations using regional persistent disks and synchronous replication.
Cloud Spanner
Horizontally scalable relational database using TrueTime for external consistency across regions, supporting SQL with strong consistency at global scale — trades higher write latency for that guarantee.
AlloyDB for PostgreSQL
PostgreSQL-compatible engine with a disaggregated storage layer and columnar engine for analytical queries, targeting higher throughput than stock Cloud SQL for PostgreSQL.
Firestore
Serverless NoSQL document store with real-time listeners, offline sync for client SDKs, and strong consistency within a database instance; distinct indexing model from Datastore mode.
Bigtable
Wide-column NoSQL store modeled after HBase, optimized for single-digit millisecond latency at high QPS; row-key design is critical to avoid hotspotting.
Memorystore
Managed Redis and Memcached with automatic failover for Redis (via replica promotion), used as a caching or session-store layer in front of primary databases.
Database Migration Service
Uses native replication (binlog/logical replication) for near-zero-downtime migrations into Cloud SQL or AlloyDB, supporting continuous data capture during cutover.
4Networking Services
The transport, routing, and edge layer connecting workloads to each other and to external clients.
Virtual Private Cloud (VPC)
Global (not regional) software-defined network with per-region subnets, custom routes, and Shared VPC for centralized network administration across projects.
Cloud Load Balancing
Global (Anycast, L7) and regional (L4/L7) load balancers backed by a single global forwarding architecture, integrating with Cloud Armor and autoscaling backend services.
Cloud CDN
Edge caching layered on top of HTTP(S) load balancers, using cache-control headers and cache keys to reduce origin load and latency.
Cloud DNS
Anycast-based authoritative DNS with public and private zones, supporting DNSSEC and policy-based forwarding for hybrid environments.
Cloud VPN
Site-to-site IPsec tunnels (Classic or HA VPN) terminating on Google’s edge, with HA VPN offering 99.99% SLA via redundant tunnel pairs.
Cloud Interconnect
Dedicated (direct physical circuit) or Partner (via a supported provider) Layer 2/3 connectivity into Google’s network, bypassing the public internet for predictable latency and bandwidth.
Cloud NAT
Regional, distributed NAT gateway providing outbound-only internet access for instances without external IPs, avoiding the single-point-of-failure of a NAT VM.
Network Connectivity Center
Hub-and-spoke abstraction for centrally managing VPN, Interconnect, and router appliance spokes across a multi-site or multicloud topology.
Traffic Director
Google-managed control plane implementing the xDS API for Envoy-based service mesh data planes, enabling traffic splitting, retries, and mTLS between services.
Cloud Armor
Edge WAF/DDoS mitigation with pre-configured OWASP rule sets, custom L7 rules, and adaptive protection using ML-based anomaly detection.
5Big Data & Analytics Services
GCP’s most mature stack — separable storage and compute for analytical workloads at scale.
BigQuery
Serverless columnar OLAP warehouse using Dremel-derived execution and separate storage/compute billing; supports federated queries, BI Engine acceleration, and streaming inserts.
Dataflow
Managed execution service for Apache Beam pipelines, unifying batch and streaming semantics via windowing and watermarks, with autoscaling workers.
Dataproc
Managed Hadoop/Spark clusters with fast (sub-90-second) startup, ephemeral cluster patterns, and Dataproc Serverless for Spark without cluster management.
Pub/Sub
Globally distributed, at-least-once delivery messaging with push/pull subscriptions, ordering keys, and exactly-once processing when paired with Dataflow.
Cloud Data Fusion
Managed CDAP-based visual ETL tool generating Dataproc/Dataflow pipelines under the hood, aimed at reducing custom pipeline code for common integration patterns.
Cloud Composer
Managed Apache Airflow on GKE, used for DAG-based orchestration of dependent data workflows spanning multiple GCP and external services.
Looker and Looker Studio
Looker uses LookML as a semantic modeling layer over live database connections; Looker Studio is a lighter-weight, report-focused BI tool with broader free-tier connectors.
Dataplex
Unified metadata and governance layer spanning BigQuery, Cloud Storage, and external sources, providing data lineage, quality checks, and centralized access policies.
6AI & Machine Learning Services
From pre-trained inference APIs to full MLOps tooling for custom model lifecycles.
Vertex AI
Unified MLOps platform covering managed notebooks, custom training (with distributed training support), Feature Store, model registry, and online/batch prediction endpoints.
Vision AI
Pre-trained computer vision API for object/label detection, OCR, face detection (without identification), and explicit content moderation via REST/gRPC.
Natural Language AI
Pre-trained NLP API providing entity extraction, sentiment scoring, syntax analysis, and content classification without requiring custom model training.
Speech-to-Text and Text-to-Speech
Streaming and batch ASR with speaker diarization and custom vocabulary support; TTS offers WaveNet and neural2 voices with SSML control.
Translation AI
Offers both a pre-trained NMT model (AutoML-free) and AutoML Translation for domain-specific glossaries and terminology.
Document AI
Combines OCR with layout-aware parsing (form fields, tables) via specialized and custom processors for structured extraction from unstructured documents.
Recommendations AI
Managed recommendation models trained on catalog and user-event data, exposing prediction endpoints tuned for retail-style “customers also viewed” use cases.
AutoML
Neural architecture search and hyperparameter tuning abstracted behind a managed training workflow, trading fine-grained control for reduced ML engineering overhead.
Generative AI on Vertex AI
Model Garden access to foundation models with grounding, function calling, and fine-tuning support, integrated with Vertex AI’s existing deployment and monitoring tooling.
7Developer Tools & CI/CD Services
The build, artifact, and deployment pipeline layer.
Cloud Build
Serverless CI/CD executing containerized build steps defined in YAML, with private pools for VPC-internal builds and native triggers on repo events.
Cloud Deploy
Managed continuous delivery implementing progressive delivery patterns (canary, blue-green) with promotion pipelines targeting GKE, Cloud Run, and Anthos.
Artifact Registry
Multi-format artifact storage (Docker, Maven, npm, Python, Go modules) with regional replication and vulnerability scanning integration.
Cloud Source Repositories
Git-compatible private repo hosting with Cloud Build trigger integration; largely superseded in workflow by direct GitHub/GitLab connections in newer setups.
Cloud SDK and gcloud CLI
The primary programmatic interface for GCP resource management, underlying most infrastructure-as-code tooling and CI/CD automation scripts.
Cloud Code
IDE extensions providing Kubernetes manifest validation, local debugging against GKE/Cloud Run, and Skaffold-based inner-loop development.
8Operations, Monitoring & Management Services
The observability and resource-governance stack (formerly branded “Stackdriver”).
Cloud Monitoring
Metrics ingestion (custom and GCP-native), SLO tracking, and alerting policies with multi-condition thresholds and notification channel integrations.
Cloud Logging
Structured log ingestion with configurable retention buckets, log-based metrics, and export sinks to BigQuery, Pub/Sub, or Cloud Storage.
Error Reporting
Automatic stack-trace grouping and deduplication of application exceptions surfaced from Logging, with regression detection across deploys.
Cloud Trace
Distributed tracing with latency breakdowns per span, supporting OpenTelemetry ingestion for cross-service request tracking.
Cloud Profiler
Low-overhead, statistical CPU/heap profiling continuously sampled from production workloads, correlated across service versions.
Cloud Resource Manager
Manages the org/folder/project hierarchy and resource-level IAM policy inheritance, exposed via API for programmatic governance at scale.
9Security & Identity Services
Access control, encryption, and threat-detection primitives applied across the platform.
Identity and Access Management (IAM)
Resource-hierarchy-scoped RBAC with predefined, basic, and custom roles; supports conditional bindings (IAM Conditions) based on attributes like time or resource tags.
Cloud Identity
Provides the underlying identity provider (SSO, SCIM provisioning, device management) independent of Workspace, often federated with external IdPs via SAML/OIDC.
Cloud Key Management Service (KMS)
Manages symmetric/asymmetric keys with configurable rotation, HSM-backed protection levels, and envelope encryption integration across GCP storage/database services.
Secret Manager
Versioned secret storage with IAM-scoped access, automatic replication policies, and audit logging on every secret access.
Security Command Center
Aggregates findings from Security Health Analytics, Event Threat Detection, and Web Security Scanner into a single posture-management dashboard with severity scoring.
VPC Service Controls
Defines service perimeters restricting data exfiltration paths for APIs like BigQuery and Cloud Storage, even across projects with valid IAM permissions.
reCAPTCHA Enterprise
Risk-scoring API for distinguishing bot traffic using behavioral signals, with adaptive risk analysis tunable per action type.
Certificate Authority Service
Managed private CA hierarchy (root/subordinate) for issuing short-lived TLS certificates, commonly used for internal service-to-service mTLS.
10Migration Services
Tooling for moving compute, storage, and data workloads with minimal cutover risk.
Migrate to Virtual Machines
Performs continuous block-level replication of source VMs, enabling test-clone validation before final cutover to Compute Engine with minimal downtime.
Transfer Appliance
Offline data transfer appliance (100TB or 480TB models) for bandwidth-constrained bulk migrations, avoiding weeks of network-bound transfer time.
BigQuery Data Transfer Service
Managed, scheduled connectors (SaaS apps, Amazon S3, Teradata, Redshift) that automate recurring loads into BigQuery without custom ETL code.
Storage Transfer Service
Supports agent-based on-premises transfers in addition to cloud-to-cloud transfers, with configurable bandwidth throttling and transfer verification.
11Serverless & Application Integration Services
Event routing and orchestration primitives that decouple services without shared infrastructure.
Eventarc
Standardizes event delivery from Cloud Audit Logs and direct GCP event sources into CloudEvents-formatted triggers for Cloud Run and GKE.
Workflows
Serverless orchestration engine executing YAML/JSON-defined state machines with native connectors for chaining GCP API calls and HTTP endpoints.
Cloud Tasks
Managed queue for asynchronous task dispatch with configurable retry backoff, rate limiting, and deduplication windows.
Cloud Scheduler
Fully managed cron with at-least-once delivery guarantees, targeting HTTP endpoints, Pub/Sub topics, or App Engine handlers.
12API Management Services
Gateway and lifecycle tooling sitting in front of backend services.
Apigee
Full API lifecycle platform with policy-based traffic management, monetization, developer portals, and analytics — positioned for enterprise-scale external API programs.
Cloud Endpoints
Lightweight API management using an Extensible Service Proxy (ESP) sidecar, generating OpenAPI-driven validation and quota enforcement with lower overhead than Apigee.
API Gateway
Fully managed, serverless-native gateway for exposing Cloud Functions/Cloud Run backends with API-key or JWT-based auth and per-key quota enforcement.
13Media & Hybrid/Multicloud Services
Specialized transcoding pipelines and cross-environment consistency tooling.
Transcoder API
Job-based video transcoding supporting adaptive bitrate output (HLS/DASH), overlays, and spritesheet generation without managing FFmpeg infrastructure directly.
Live Stream API
Converts live RTMP/SRT input into ABR-packaged HLS/DASH output in near real time for downstream CDN distribution.
Anthos
GKE-based multi-cluster management layer providing consistent policy (via Config Sync/Policy Controller) and service mesh across on-prem, GCP, and other clouds.
Google Distributed Cloud
Extends GCP’s control plane and select managed services into customer-owned data centers or edge sites for data-residency or air-gapped requirements.
BigQuery Omni
Runs the BigQuery query engine against data stored in AWS S3 or Azure Blob Storage in place, avoiding cross-cloud data egress for analytical queries.
Key Takeaways
- Service selection within a category is usually a consistency vs. scale vs. operational-overhead trade-off — e.g., Cloud SQL vs. Spanner, or GKE Standard vs. Autopilot.
- BigQuery’s separated storage/compute architecture and Spanner’s TrueTime-based consistency are two of GCP’s most architecturally distinctive design choices.
- Networking primitives (VPC, Cloud Load Balancing, Cloud Armor) are global by design, not regional — a meaningful architectural difference from some other cloud providers.
- Security controls compose in layers: IAM for access, KMS/Secret Manager for key and credential handling, and VPC Service Controls for perimeter-level data exfiltration prevention.
- Migration tooling (Migrate to VMs, Database Migration Service) is built around continuous replication rather than one-shot copy jobs, minimizing cutover windows.
- This catalog changes frequently — validate current service tiers, SLAs, and regional availability against official GCP documentation before finalizing an architecture.