Google PCA Design and plan a cloud solution architecture — All Questions With Answers

Refer to the exhibit.

gcloud compute instances create my-instance \
    --zone=us-central1-a \
    --machine-type=n1-standard-4 \
    --image-family=ubuntu-2004-lts \
    --image-project=ubuntu-os-cloud \
    --boot-disk-size=50GB \
    --boot-disk-type=pd-ssd \
    --scopes=cloud-platform \
    --service-account=my-sa@project.iam.gserviceaccount.com \
    --tags=http-server,https-server

Refer to the exhibit.

{
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": [
        "user:admin@example.com"
      ]
    },
    {
      "role": "roles/storage.objectAdmin",
      "members": [
        "serviceAccount:my-sa@project.iam.gserviceaccount.com"
      ]
    }
  ]
}

Refer to the exhibit.

gcloud compute instances create my-instance \
  --zone=us-central1-a \
  --machine-type=e2-micro \
  --image-family=debian-11 \
  --image-project=debian-cloud \
  --boot-disk-size=20GB \
  --boot-disk-type=pd-standard \
  --network-interface=subnet=default,no-address \
  --metadata=startup-script='#! /bin/bash
    sudo apt-get update
    sudo apt-get install -y nginx
    sudo systemctl enable nginx
    sudo systemctl start nginx'

```
gcloud compute instances create my-instance \
    --zone=us-central1-a \
    --machine-type=e2-medium \
    --image-family=debian-10 \
    --image-project=debian-cloud \
    --preemptible
```

```json
{
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": [
        "allUsers"
      ]
    }
  ]
}
```

```
gcloud compute networks subnets create private-subnet \
    --network=my-vpc \
    --region=us-west1 \
    --range=10.0.1.0/24 \
    --enable-private-ip-google-access
```

Refer to the exhibit.

```json
{
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": ["user:alice@example.com"],
      "condition": {
        "title": "only_bucket_a",
        "expression": "resource.name.startsWith('projects/_/buckets/bucket-a/')"
      }
    }
  ]
}
```

{
  "bindings": [
    {
      "role": "roles/compute.networkAdmin",
      "members": [
        "user:admin@example.com"
      ]
    },
    {
      "role": "roles/compute.instanceAdmin.v1",
      "members": [
        "user:developer@example.com"
      ]
    },
    {
      "role": "roles/iam.serviceAccountUser",
      "members": [
        "serviceAccount:sa-compute@project.iam.gserviceaccount.com"
      ]
    }
  ],
  "etag": "BwVJQ2RfPHQ="
}

resource "google_compute_firewall" "allow_ssh" {
  name    = "allow-ssh"
  network = "default"
  priority = 1000
  allow {
    protocol = "tcp"
    ports    = ["22"]
  }
  source_ranges = ["0.0.0.0/0"]
  target_tags   = ["ssh-allowed"]
}

resource "google_compute_instance" "my_instance" {
  name         = "my-instance"
  machine_type = "e2-micro"
  zone         = "us-central1-a"
  tags         = ["web", "ssh-allowed"]
  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-11"
    }
  }
  network_interface {
    network = "default"
    access_config {
      // Ephemeral public IP
    }
  }
}

resource "google_compute_instance" "vm" {
  name         = "example-vm"
  machine_type = "e2-medium"
  zone         = "us-central1-a"

  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-11"
      size  = 50
    }
  }

  network_interface {
    network    = "default"
    subnetwork = "default"

    access_config {
      // Ephemeral public IP
    }
  }

  metadata = {
    enable-oslogin = "TRUE"
  }
}

# Output after 'terraform apply'
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.
Outputs:
instance_ip = "34.123.45.67"

gcloud compute forwarding-rules list
NAME          REGION       IP_ADDRESS    IP_PROTOCOL  TARGET
my-rule       us-central1  10.128.0.1    TCP          my-target-pool

Health check configuration for 'my-target-pool':
- checkIntervalSec: 5
- timeoutSec: 5
- healthyThreshold: 2
- unhealthyThreshold: 2

Health check logs:
2024-01-15 10:00:01 Health check for instance web-01: healthy (response time 3ms)
2024-01-15 10:00:06 Health check for instance web-01: healthy (response time 2ms)
2024-01-15 10:00:11 Health check for instance web-01: healthy (response time 4ms)
2024-01-15 10:00:16 Health check for instance web-01: unhealthy (timeout)
2024-01-15 10:00:21 Health check for instance web-01: unhealthy (timeout)
2024-01-15 10:00:26 Health check for instance web-01: healthy (response time 2ms)

gcloud compute instances get-serial-port-output instance-1 --zone=us-central1-a
[   0.000000] Linux version 5.10.0-26-cloud-amd64 (debian-kernel@lists.debian.org) ...
[   0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-5.10.0-26-cloud-amd64 root=PARTUUID=xxx ro console=ttyS0,115200n8 net.ifnames=0
...
[   1.234567] systemd[1]: Starting Google Compute Engine Guest Agent...
[   1.345678] systemd[1]: Starting Google Compute Engine Startup Scripts...
[   2.345678] startup-script: INFO Found startup script in metadata: key=startup-script, content=...
[   2.456789] startup-script: INFO Executing startup script...
[   2.567890] startup-script: ERROR: Could not find resource 'gs://my-bucket/startup.sh'
[   2.678901] startup-script: ERROR: script returned exit code 1
[   2.789012] systemd[1]: google-startup-scripts.service: Main process exited, code=exited, status=1/FAILURE