Google Cloud Production Rules

Cost Traps

• Stopped Compute Engine VMs still pay for persistent disks and static IPs — delete disks or use snapshots for long-term storage
• Cloud NAT charges per VM and per GB processed — use Private Google Access for GCP API traffic instead
• BigQuery on-demand pricing charges for bytes scanned, not rows returned — partition tables and use LIMIT in dev, but LIMIT doesn't reduce scan cost in prod
• Preemptible VMs save 80% but can be terminated anytime — only for fault-tolerant batch workloads
• Egress to internet costs, egress to same region is free — keep resources in same region, use Cloud CDN for global distribution

Security Rules

• Service accounts are both identity and resource — one service account can impersonate another with roles/iam.serviceAccountTokenCreator
• IAM policy inheritance: Organization → Folder → Project → Resource — deny policies at org level override allows below
• VPC Service Controls protect against data exfiltration — but break Cloud Console access if not configured with access levels
• Default Compute Engine service account has Editor role — create dedicated service accounts with least privilege
• Workload Identity Federation eliminates service account keys — use for GitHub Actions, GitLab CI, external workloads