What's changed: Created Associate Cloud Engineer Chapter 3 (Domain 3 "Deploying and implementing": Compute Engine and GKE = instances/MIG-autoscaling/instance templates/OS Login/GKE (Autopilot/Standard/regional/private)/kubectl; serverless and data = Cloud Run/Cloud Functions/Eventarc/data products/AlloyDB/loading; networking and IaC = VPC/subnets/firewall/Cloud VPN/VPC Peering/Terraform/Config Connector).
3.3Networking and Infrastructure as Code
Understand creating VPCs with subnets (custom mode, Shared VPC), ingress/egress firewall rules based on IP, network tags, and service accounts, connecting external networks via Cloud VPN and VPC Network Peering, and Infrastructure as Code with Terraform and Config Connector.
Build the network that securely connects resources, and deploy infrastructure reproducibly (as code).
3.3.1VPC and firewall
A VPC (Virtual Private Cloud) is the private network where resources live; you create subnets per region with IP ranges. Modes include custom-mode VPC (you design subnets) and Shared VPC (one VPC shared across projects). Traffic is controlled by firewall rules for ingress and egress, allowing/denying by IP range, network tags, or service accounts. A common pattern: "allow only specific VMs = target them via network tags or service accounts."
3.3.2External connectivity and IaC
To connect on-premises or other networks, use Cloud VPN (encrypted tunnel) or VPC Network Peering (directly connect two VPCs). Deploy infrastructure not by hand but as Infrastructure as Code (IaC) for reproducibility, review, and automation. On Google Cloud, use Terraform (industry-standard multicloud IaC), Config Connector (manage Google Cloud resources the Kubernetes way), and the Cloud Foundation Toolkit (template library). Map "reproducible infrastructure as code = IaC (Terraform)."
Common: requirement → config. E.g., "private network for resources" = VPC/subnets; "one VPC across projects" = Shared VPC; "allow only specific VMs" = firewall (network tags/service accounts); "encrypted on-prem connection" = Cloud VPN; "directly connect two VPCs" = VPC Peering; "reproduce infra as code" = Terraform/IaC.
Watch the mix-ups: (1) think of firewalls as ingress vs egress. (2) Target by IP / network tags / service accounts. (3) Cloud VPN (encrypted tunnel) vs VPC Peering (VPC-to-VPC directly) differ. (4) IaC replaces manual work—reproducibility, review, automation.
Know the deployment tooling too. The fully managed PaaS App Engine runs apps in standard/flexible environments with traffic splitting for staged releases. Use the authenticated Cloud Shell to operate without a local setup, Cloud Build for container builds/CI, and Terraform (plus Config Connector) as the standard Google-native IaC; the older Deployment Manager is deprecated (use Terraform for new work).
3.3.3Section summary
- VPC + subnets (custom/Shared); firewalls control ingress/egress by IP/tags/service accounts
- External connectivity = Cloud VPN (encrypted) / VPC Peering (VPC-to-VPC)
- Deploy infrastructure reproducibly with IaC (Terraform/Config Connector)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To allow ingress only to VMs with a specific network tag, what do you use?
Q2. To share one VPC across multiple projects with centralized networking, which configuration fits?
Q3. To connect on-premises to Google Cloud over an encrypted tunnel, which is best?
Q4. To deploy and manage infrastructure as reproducible code rather than by hand, which fits best?
Q5. To directly connect two VPC networks for mutual communication, which is best?
Q6. Which is a valid way to target a firewall rule?