Google Associate Cloud Engineer (ACE) — Questions 451–525

The `roles/secretmanager.secretAccessor` role contains the exact `secretmanager.versions.access` permission required to retrieve the value of a secret version. By binding this role to the specific secret resource rather than the project or the version, the principal is limited to reading only that secret's payload and cannot enumerate or access other secrets. This scoped binding is the standard least-privilege pattern for granting a compute instance or service account access to a single secret.

This global Layer 7 load balancer is purpose-built for HTTP and HTTPS traffic, supporting URL path and host-based routing, SSL termination, and integration with Cloud CDN. It provides a single external anycast IP address to all clients and intelligently distributes requests to backend web servers. This meets the company's requirement to expose an external web application with a single IP.

Database Migration Service is the correct answer because it is a fully managed service that migrates MySQL (and other databases) from an on-premises source to Cloud SQL with minimal downtime. It works by taking an initial consistent snapshot of your source database, then continuously applying ongoing changes via the source's binary logging (binlog) until you're ready for a one-time cutover. This eliminates the need to manually coordinate export and import jobs, and it keeps your application online for the vast majority of the migration window.

When you create a Cloud NAT on a Cloud Router, the default address allocation is exactly one external IP address for the entire NAT gateway, unless you manually add more. This sole IP is used as the source address for all outbound connections from every instance in the subnets using that gateway. Therefore, the observed single source IP is the correct, expected result of the default NAT configuration.

Dataflow's streaming engine provides exactly-once processing guarantees by checkpointing pipeline state and input cursors into durable cloud storage and by committing each input element exactly once to that state. Because Dataflow is built on the Apache Beam model, it handles deduplication automatically even when the source, such as Pub/Sub, has at-least-once delivery semantics; no additional pipeline settings are required.

Removing the compute.instanceAdmin role from the team member is the correct remediation because that role contains the instances.delete permission, which directly conflicts with the custom role's intent to allow only stop/start actions. Auditing all user assignments afterward is essential to catch similar role conflicts where a broader predefined role may override a more restrictive custom role, ensuring least privilege across the project.

Compute Engine requires an instance to be in the TERMINATED state before its service account can be changed, so you must stop the instance first. The gcloud compute instances set-service-account command updates the attached service account (and optionally the access scopes), and then you start the instance to apply the change. This approach preserves the existing VM, avoids resource recreation or workload migration, and is the documented way to attach a service account to an existing instance.

SSD persistent disks are the correct choice for MongoDB on Compute Engine because they deliver a strong balance of high IOPS and low latency for database workloads while remaining cost-effective. Snapshots provide point-in-time backup and disaster recovery, protecting the data against VM failure and enabling fast restore. Unlike local SSDs, persistent disks are durable and survive VM lifecycle events, making pd-ssd the recommended block storage for production databases.

Configuring a BGP session on the Cloud Router with the on-premises router's ASN and IP address is the correct step because Cloud Router is a BGP speaker that must peer with the on-premises router over the VPN tunnel. Without explicitly configuring the peer ASN and IP address, the Cloud Router has no way to establish the BGP adjacency, which is essential for dynamically exchanging network routes. This configuration enables automatic route learning and failover, aligning with the requirement to extend the network using BGP.

The metrics-server aggregates CPU and memory usage from kubelets via the Summary API and exposes them through the metrics.k8s.io API. The HorizontalPodAutoscaler (HPA) controller repeatedly queries that API to obtain current resource utilization; if no metrics-server is installed, the metrics API is unavailable and the HPA reports 'unable to retrieve metrics' and does not scale. It is the lightweight, cluster-local component that provides the raw numbers the HPA needs, whereas GCP's monitoring service is not directly consulted by the HPA.

Create two node pools, e.g. a regular pool for critical services and a spot/preemptible pool for non-critical work, then taint the spot pool with a key such as spot=true:NoSchedule. Critical pods are deployed without the matching toleration, so the Kubernetes scheduler will never place them on spot nodes; non-critical pods include the toleration and can use the cheaper spot capacity. This precisely controls placement while keeping a single cluster and simplifying operations.

This is correct because Cloud Build's service account needs two distinct permissions to deploy to Cloud Run: `roles/run.admin` to create, update, and manage the Cloud Run service and its revisions, and `roles/iam.serviceAccountUser` granted on the runtime service account itself. The `iam.serviceAccountUser` role includes the `iam.serviceAccounts.actAs` permission, which allows the Cloud Build SA to specify that runtime SA when creating or updating a Cloud Run service. This pairing follows least privilege by giving exactly the permissions needed, no more.

Running `gcloud config list` displays all the active property settings in your current gcloud configuration, such as account, project, and compute region/zone, in a clean key=value format. You can use `gcloud config list --all` to view every settable property, including those with unset defaults. This is the standard, most direct way to inspect your working configuration.

Viewing Cloud Logging for firewall rule logs is the direct way to see whether VPC firewall rules are dropping or allowing traffic. Firewall rule logging records each connection attempt with details like source IP, destination IP, port, protocol, and the action (allow or deny). If the Compute Engine instance is unreachable due to a firewall rule, these logs will show the denied packets, making this a reliable troubleshooting step.

Committed use discounts (CUDs) are a cost-optimization tool that offer up to 70% lower vCPU, memory, and GPU prices for predictable workloads when you commit to 1- or 3-year usage. This aligns with cost optimization because steady-state baseline resources are paid at a large discount, and the commitment safeguards you against future price increases. However, CUDs are only effective if usage is consistent; they should be matched to historical baseline usage, not spikes.

Each Cloud Run service is an independently managed, container-based microservice that autoscales from zero based on its own traffic, so building multiple services naturally satisfies the independent scaling and deployment requirement. Cloud Run provides internal HTTPS endpoints (such as the automatically generated per-service URL or requests routed through a VPC connector) that allow services to communicate without exposing traffic to the public internet. You can also use Cloud Run's service-to-service authentication to restrict calls between trusted services, ensuring secure and low-latency internal communication.

kubectl set image updates the Deployment's pod template to gcr.io/myproject/myapp:v2, which triggers the Deployment controller to create a new ReplicaSet and incrementally replace old pods while respecting maxSurge/maxUnavailable. kubectl rollout status then blocks until the new ReplicaSet becomes ready and the old ReplicaSet is scaled down, confirming the rolling update completed successfully. This is the standard declarative workflow for updating an app version.

res.send({ 'status': 'ok' }) is the correct, recommended way to complete an HTTP-triggered Cloud Function. When passed an object, res.send automatically serializes it to JSON and sets the Content-Type response header to application/json, and it terminates the request. This works because Cloud Functions' HTTP handlers receive an Express-style response object, making this pattern highly reliable and idiomatic.

Artifact Registry Writer (roles/artifactregistry.writer) is the correct predefined role for a CI/CD pipeline that needs to push container images or packages. It grants exactly the permissions required to upload artifacts—e.g., artifactregistry.versions.create, artifactregistry.files.create, and artifactregistry.tags.create—without allowing destructive actions like deleting repositories or altering IAM policies. This aligns with least privilege because the pipeline only needs write access on an existing repository, not administrative control.

The bucket must be named exactly www.example.com to serve content from that custom domain. When you create a bucket with this name, verify the domain in Cloud Console, and add a CNAME record from www.example.com to c.storage.googleapis.com, Cloud Storage automatically maps the bucket to the hostname. This exact match is required for HTTPS and proper static site hosting.

Customer-Managed Encryption Keys (CMEK) is correct because it lets you control and automate key rotation through Cloud KMS. You define a rotation period (e.g., 30 days) on a key, and Cloud KMS automatically generates a new key version on that schedule while continuing to decrypt data with older versions. This provides both automated rotation and full auditability of when each version is used, which aligns with a company's requirement to rotate encryption keys without manual intervention.

Configuring a health check on the load balancer enables scheduled probes to be sent to each backend instance on a designated port and path. If an instance fails to respond with the expected status code or TCP handshake after multiple attempts, it is automatically removed from the load balancer's backend pool. This stops new traffic from being routed to a failed or overloaded instance, which is exactly the detection required in this scenario.

Resource Manager Tags are the intended mechanism for centrally governed, hierarchical cost attribution. Creating tag keys and enumerated values at the organization level allows an administrator to control both the schema (via the tagAdmin role) and which VMs receive the tags (via the tagUser role), ensuring out-of-band creation cannot introduce ad-hoc values. These tags are visible in the Cloud Billing cost breakdown report, satisfying the requirement to track spend by VM team. Unlike labels or network tags, resource tags have IAM and hierarchy support built in.

The correct condition uses a metric threshold on the time series compute.googleapis.com/instance/cpu/utilization. This metric is emitted automatically from GCE instances and can be queried with a threshold (e.g., > 80%) aligned over a defined period such as 5 minutes. When the condition's duration (e.g., 'for 5 minutes') is met, the alerting policy enters the firing state and notifies any attached channels. This is the native, fully integrated way to alert on CPU load.

Creating a dedicated service account, granting it only the IAM roles the application needs, and passing it via the --service-account flag at instance creation time is the Google-recommended pattern. This attaches the identity to the instance without ever downloading a key, so the instance authenticates through the metadata server's short-lived OAuth tokens. It ensures least privilege and avoids the security risk of storing long-lived credentials on the VM.

Spot VMs are Compute Engine instances that run on excess, unused capacity at a steep discount, often up to 91% compared to standard VM pricing. They are ideal for batch jobs that can tolerate interruption because Compute Engine can preempt a Spot VM with only 30 seconds' notice, so the workload must implement checkpointing or divide work into small restartable tasks. For a data processing batch job that is non-urgent and fault-tolerant, Spot VMs provide the greatest cost reduction while maintaining acceptable reliability.

Setting the bucket's default encryption to point at the KMS key is the step that activates customer-managed encryption for Cloud Storage. All objects uploaded after this change are automatically encrypted with the selected Cloud KMS key instead of Google-owned keys. Without this configuration, the key ring and key remain unused and the bucket continues using default encryption.

The --domains flag is the correct mechanism to request a Google-managed certificate: gcloud will create an SslCertificate resource in MANAGED state, and Google's Certificate Authority will issue a certificate for the specified domain, handling the entire lifecycle including automatic renewal. No additional flags are required, because the presence of --domains unambiguously selects the managed provisioning mode. This command is the exact answer for creating a managed certificate via the gcloud CLI.

Google Cloud Transfer Appliance is a physical storage server that you rack locally, copy the MongoDB data (for example, via mongodump or file-level copies) onto, and ship back to Google so the data is ingested into Cloud Storage. For a one-time 5 TB dataset, this avoids the time and potential cost of a long online upload over constrained network links, and it is a fully supported Google Cloud migration path.

Cloud Shell provides a temporary, ephemeral VM, but your home directory is backed by a persistent 5 GB disk in Google-managed storage. That 5 GB is the permanent part of the environment — it survives session restarts, VM recycling, and timeouts. This means any files you save under $HOME, including SSH keys, configuration files, and scripts, remain available across all future Cloud Shell sessions, while the compute instance itself is recreated as needed.

The Organization Policy constraint `storage.requireCustomerManagedEncryption` is a boolean, preventive constraint that is evaluated by Cloud Resource Manager during bucket creation and update requests. Setting this constraint at the organization level forces every bucket in the hierarchy to specify a CMEK (Customer-Managed Encryption Key) from Cloud KMS or the request is rejected. This gives a centralized, automated guarantee of compliance without per-bucket manual configuration.

VPC peering in GCP is a one-to-one relationship that does not support transitive routing, so Project A's VPC can only reach the directly peered VPC in Project B, not any VPC that B happens to be peered with (like C). Even if B's VPC has a peering connection to C, routes learned from C are not propagated through B to A because GCP exchanges only the routes of the two directly peered networks. To allow A and C to communicate, you must create a direct VPC peering between Project A and Project C, or alternatively use a shared VPC, a Cloud VPN, or a proxy/load balancer to bridge the two networks.

Cloud Run is the correct choice because it directly runs stateless HTTP container images in a fully managed, serverless environment, scaling from zero to handle traffic and back to zero when idle. You are billed only for compute resources used during request processing, not for paused instances, and it handles TLS, revisions, and autoscaling natively.

Switching the node pool to a memory-optimized series like m2-ultramem gives each node a much higher RAM-to-vCPU ratio, directly resolving the memory pressure that causes OOMKills. Simultaneously aligning pod memory requests with actual usage lets the scheduler pack pods according to real footprint, and enables cluster autoscaler to add the right capacity. These changes together correct the capacity deficit.

The `--default-encryption-key` flag, when used with `gsutil mb`, sets the bucket's default customer-managed encryption key at creation time. The value must be the full resource ID in the format `projects/PROJECT_ID/locations/REGION/keyRings/KEY_RING/cryptoKeys/KEY`. This ensures every object uploaded to the bucket is automatically encrypted with that KMS key, enforcing encryption at rest for all data without requiring per-object flags.

Enabling billing export to BigQuery in the Cloud Billing console is the native, fully managed integration for this use case. It automatically creates a set of BigQuery tables (e.g., gcp_billing_export_resource_v1) that contain detailed line items including cost, usage, labels, and resource hierarchy, updated on an ongoing basis. This export requires no custom code and provides the historical, labelled data needed to track and forecast GCP spending across departments using standard SQL and BI tools.

The permission `resourcemanager.projects.list` is evaluated against the parent resource (organization or folder) where the developer is attempting to list projects, not against each project individually. The Project Viewer role (roles/viewer) only grants permissions within a specific project, so while the developer can view a project they're already in, `gcloud projects list` needs an IAM role at the folder or organization level to enumerate all projects in that hierarchy. Without that permission at the parent, the API returns PERMISSION_DENIED even if the developer has viewer access to many projects.

Coldline storage is designed for data that is expected to be accessed at most once per 90 days, making it a perfect match for a 90-day retention period. The lower per-GiB storage price compared to Standard and Nearline, combined with lifecycle deletion at 90 days, minimizes cost without incurring early deletion fees (Coldline has a 90-day minimum storage duration). This directly satisfies the requirement to store event logs for 90 days and then delete them.

This is the correct command: `gcloud iam roles create` creates a custom role scoped to the specified project, and the `--permissions` flag explicitly lists the two required read-only permissions. Using specific permission names without wildcards enforces least privilege and aligns with IAM's requirement for fully qualified permission identifiers. The resulting role can then be bound to users or groups with `gcloud projects add-iam-policy-binding`.

Correct. Cloud Shell provisions a 5 GB persistent home directory, mounted at $HOME, that survives between sessions. This is the documented, fixed quota for free Cloud Shell usage, regardless of session time or usage patterns.

Raising the maximum number of container instances directly increases the scaling ceiling for the Cloud Run service, so the platform can allocate more instances when the current set is saturated. When all running instances are at full concurrency and the max instance count has been reached, excess requests are rejected with HTTP 503. By increasing this limit, the service can spawn additional containers to absorb the load, addressing the capacity shortfall at its root.

This is the correct configuration because a livenessProbe is the Kubernetes mechanism that determines whether a container is still healthy after it has started. The httpGet hits /healthz on port 8080 after a 30-second initial delay, then every 10 seconds; when the probe fails three consecutive times, the kubelet kills the container and restarts it according to the pod's restartPolicy. That exactly matches the requirement to restart a container that is running but has become unhealthy.

This is the exact command because it applies the required traffic split at the `default` service level without performing any new deployment. The `--splits` flag defines a percentage map: `v1=0.9` sends 90% of requests to v1, and `v2=0.1` sends the remaining 10% to v2. Both versions must already exist in the service, and this command is typically executed after deploying v2 with `--no-promote`. This achieves the canary pattern where the new version serves a small, controlled fraction of user traffic while the stable version handles the majority.

This is the correct setup sequence for local development. First, `gcloud auth login` authenticates your user account and stores credentials for gcloud CLI commands in the user's config directory. Then, `gcloud auth application-default login` creates the `application_default_credentials.json` file, which allows Google Cloud client libraries to discover credentials via Application Default Credentials. Having both ensures gcloud and code-based SDKs use the same identity.

Cloud SQL for PostgreSQL is a fully managed, PostgreSQL-compatible database service that supports the same SQL dialect, extensions, and client protocols as standard PostgreSQL. It enables a straightforward migration path for on-premises PostgreSQL databases using tools like Database Migration Service or pg_dump/pg_restore. Cloud SQL also provides automated backups, high availability, and scaling, making it the optimal choice for a direct PostgreSQL migration without application code changes.

This flag allows the eviction of pods that use emptyDir volumes. During a node drain, kubectl will not evict such pods by default because their data is ephemeral and would be lost. To proceed with draining and terminate these pods gracefully, you must explicitly permit the deletion of their emptyDir data. This is safe when you don't need the temporary data or when apps handle empty volumes on startup.

The subnet-level flag --enable-private-ip-google-access is the required element because it configures the VPC subnet to route traffic from instances without external IPs directly to Google's public API endpoints over the Google network. Without this flag, VMs that lack an external IP address cannot reach Google APIs and services, even if the subnet has a default route with an internet gateway. This flag is set per subnet, and enabling it on the relevant subnet is the fundamental prerequisite for Private Google Access.

This is the correct command. `--region=us-central1` creates a regional GKE cluster that spans multiple zones within the region for high availability, while `--num-nodes=3` sets the initial node count. The `--enable-autoscaling` flag activates the node autoscaler, and `--min-nodes=3` / `--max-nodes=10` define the scaling boundaries, allowing the cluster to grow up to 10 nodes and shrink back to 3 based on workload demand.

gcloud functions deploy with --trigger-topic creates an event-driven Cloud Function subscribed to a Pub/Sub topic. The --runtime python39 specifies the Python 3.9 execution environment, --entry-point my_entry identifies the function name inside main.py to invoke, and --region sets the deployment location. This is the only valid command that directly deploys the function and wires it to the specified Pub/Sub topic.

A Cloud Storage bucket can be configured for static website hosting, making it a serverless origin that serves HTML, CSS, and JS directly with no compute resources. Enabling Google Cloud CDN on that bucket—typically via an external HTTP(S) load balancer with a backend bucket—caches files at global edge locations for low-latency repeat access. This setup is highly available, requires zero infrastructure maintenance, and costs only for storage and network egress.

The correct method is to first run gcloud config configurations create prod, which generates a new empty named configuration and automatically activates it. With the prod configuration active, gcloud config set project prod-project then sets the project property for that configuration, providing a clean, isolated environment for managing the prod project.

kubectl set image deployment/my-app my-app=my-app:v2 imperatively updates the container image of the specified container in the Deployment, which immediately triggers a new ReplicaSet and rolling update. kubectl rollout status deployment/my-app then blocks and reports the status of that rollout until it completes, satisfying the requirement to update and monitor progress in one straightforward command sequence.

Cloud Scheduler is a fully managed cron service that can invoke an HTTP-triggered Cloud Function on a defined schedule (e.g., nightly or weekly). The Cloud Function can call Cloud Asset Inventory's searchAllResources or searchAllIamPolicies to list service accounts and inspect the `lastAuthenticatedTime` property exposed for service accounts. Using the IAM API, the function can then disable stale accounts via `disableServiceAccount()`. This approach is entirely serverless, event-driven, and requires no persistent compute or manual intervention, making it the most efficient and aligned with Google Cloud best practices.

Creating a Cloud Function with a Cloud Storage trigger is the native event-driven integration: after you specify the bucket and the `google.storage.object.finalize` event type, Cloud Storage automatically invokes the function whenever a new object is written. No custom infrastructure, no polling, and no intermediate services are needed. This is the simplest, lowest-latency approach because the execution is driven directly by the storage event and automatically scales to zero when idle.

In Cloud Monitoring, you create an alerting policy with a condition that uses a threshold for a metric such as 'compute.googleapis.com/instance/cpu/utilization'. The policy samples the metric stream over an alignment period and triggers when the value (e.g., average CPU utilization) crosses the threshold for a specified duration. This is exactly the native mechanism for CPU utilization alerts.

Cloud Functions (2nd gen) is built on Cloud Run infrastructure and, unlike the 1st gen, supports deploying custom container images directly. It provides a fully managed, event-driven serverless execution environment that scales to zero and brings the same container runtime benefits as Cloud Run, while adding event-triggering capabilities like Pub/Sub, Cloud Storage, and HTTP invocations.

The web server service (such as Apache, Nginx, or another HTTP daemon) must be running and listening on the expected port for the VM to respond to HTTP requests. If the service is not installed, stopped, or crashed, the VM's network stack will still be reachable at the IP layer, but the TCP connection to port 80 or 443 will be refused or time out. Checking the service status with systemctl status nginx (or equivalent) is a standard first troubleshooting step. Without an active web server process, no HTTP response can be produced, which directly explains the failure.

This filter uses a comparison operator on the numeric field httpRequest.status. In Cloud Logging, filters support comparison operators like >= for numeric values, so this will match any log entry where the HTTP response status is 500 or higher, capturing all server error statuses (5xx). This is the recommended approach because it is concise and semantically correct.

OS Login is enabled by setting `enable-oslogin=TRUE` in instance or project metadata. Without this metadata key, OS Login is not active on the VM even if the IAM role is granted.

roles/pubsub.publisher is the correct least-privilege choice because it contains only the pubsub.topics.publish permission, which is exactly what a producer needs to send messages to a Pub/Sub topic. It does not grant permission to create, delete, or modify topics, subscribe, or manage IAM, so a compromised token from this service account could not reconfigure messaging infrastructure.

Secret Manager is a purpose-built service for storing sensitive configuration, such as API keys, database credentials, and feature flags, with automatic encryption, IAM policies per secret, and versioning. Applications retrieve the latest secret version at runtime through a gRPC/REST API call or client library, which means updates are applied without rebuilding or redeploying the workload. Secret Manager also provides audit logging of secret access and supports key rotation by creating new versions and disabling old ones, making it the safest and most operationally flexible choice.

In Google Cloud, the Billing > Reports page is the primary cost analysis tool, presenting detailed spend data by service, SKU, project, location, and time period. You can filter the report by service to isolate, for example, Compute Engine versus Cloud Storage costs and view a grouped table or chart of the totals. This page reflects actual invoice data from the billing account, making it the definitive source for answering 'which service incurred the most cost.'

Cloud SQL for PostgreSQL is the managed relational database service natively compatible with PostgreSQL, so your existing schema, queries, and tools carry over. It automates daily backups with transaction log-based PITR by default, offers high availability via a regional failover replica, and carries a 99.95% SLA for the Standard and Enterprise editions. This directly satisfies the stated requirements without requiring you to operate the database infrastructure.

gcloud auth application-default login is the correct command because it explicitly generates Application Default Credentials, storing them in the standard location (typically ~/.config/gcloud/application_default_credentials.json). These credentials are then picked up automatically by Google Cloud client libraries when no explicit service account key is supplied, enabling local development to use your user account's permissions as ADC.

Anthos Service Mesh (ASM), built on Istio, injects an Envoy sidecar proxy into each pod. The sidecars intercept all service-to-service traffic and automatically negotiate mutual TLS (mTLS) using SPIFFE identities derived from Kubernetes service accounts. In STRICT mode, the mesh rejects any plaintext connection, ensuring every communication path is both encrypted and mutually authenticated — all without modifying application code or managing certificates manually.

This is the correct flag. According to the gcloud compute networks subnets update documentation, "--enable-private-ip-google-access" modifies the subnet's privateIpGoogleAccess field, allowing VM instances without external IP addresses to reach Google APIs using the subnet's default route. This is the only flag listed that maps directly to the REST API parameter.

Cloud Armor WAF with the preconfigured OWASP Core Rule Set is the correct choice because it performs deep, content-aware inspection of each HTTP request at the Google Cloud load balancer edge. Its rules are based on the OWASP ModSecurity Core Rule Set, which includes signatures and heuristics specifically designed to detect SQL injection, cross-site scripting, and other Top-10 web application attacks. When a request matches a malicious pattern, Cloud Armor can deny it before it ever reaches your backend instances, giving you runtime protection rather than just a report or a network-level filter.

roles/secretmanager.secretManager grants permissions to create, get, list, update, and delete secret resources, plus view metadata, but deliberately omits secretmanager.versions.access. This lets developers fully manage the secret lifecycle without ever being able to view the sensitive payload, making it the correct least-privilege choice for the stated requirement to create and manage secrets while preventing access to values.

Extreme persistent disk (pd-extreme) is the correct choice because it is engineered for high-performance, low-latency workloads. It supports provisioning up to 100,000 IOPS per instance and allows live resizing of both capacity and performance while the VM remains attached and running. This combination of extreme throughput and zero-downtime scaling makes it ideal for a stateful application with demanding random I/O and strict availability requirements.

Cloud Asset Inventory is the correct service because its search-all-resources API allows an organization-scoped query like `gcloud asset search-all-resources --scope=organizations/ORG_ID --asset-types=compute.googleapis.com/Instance`, which returns every Compute Engine instance across all projects in that organization. It returns metadata including instance names, zones, projects, and additional properties, and it can be filtered by conditions. This provides a single, authoritative, and queryable inventory endpoint for all VM assets.

Granting the roles/iap.tunnelResourceAccessor IAM role on the instance is the core authorization required for IAP TCP tunneling. This role ties a Google-authenticated user identity to a specific instance, letting them establish an encrypted tunnel through Cloud IAP to reach SSH or RDP even when the VM has only an internal IP. Without this IAM binding, the user cannot invoke `gcloud compute start-iap-tunnel` or the IAP API, making it the fundamental step for identity-aware access.

The --allow-unauthenticated flag is the correct option because it explicitly grants the role roles/run.invoker to allUsers, enabling public access to the Cloud Run service. This flag is a required parameter when deploying a service that must respond to HTTP requests without any authentication, such as a public API or webhook. It overrides the default behavior, which denies access to unauthenticated users.

An uptime check is a Cloud Monitoring feature that actively sends synthetic HTTP(S) requests to the endpoint from multiple global vantage points on a fixed interval. By configuring a condition that requires an HTTP status code within the 2xx/3xx range, the check immediately flags any non-2xx/3xx response or timeout as an availability violation. Because the probe generates its own traffic regardless of organic user load, it can detect full outages during zero-traffic periods, precisely matching the need to catch service blackouts.

Enabling Uniform Bucket-Level Access (UBLA) on the bucket disables object-level ACLs and makes all access decisions rely exclusively on bucket-level IAM policies. Existing object ACLs are no longer evaluated, and newly uploaded objects do not get individual ACLs; instead, every object inherits the bucket's IAM permissions. This eliminates the dual permission model and lets you manage access centrally via IAM roles, such as roles/storage.objectViewer, giving you a single, consistent authorization mechanism for all objects in the bucket.