Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!
Service Catalog gives cloud administrators a central place to make approved software solutions available to internal users. To set this up, an administrator creates a Private Catalog using the Google Cloud console and must have the Catalog Admin role to manage the list. Multiple catalogs can be created for different departments, such as a "Dev Tools" catalog for engineering teams, and each catalog acts as a controlled container for approved resources. This setup helps maintain strict governance over which resources are available and ensures they follow internal security policies.
A private catalog allows organizations to standardize cloud resources across projects and folders by including several types of content. Administrators can add Deployment Manager templates for automated infrastructure setups, pre-configured VM images with security patches, and reference links to internal documentation or approved third-party tools. This centralized management ensures every team uses the latest and most secure versions of a tool, reducing the risk of human error during provisioning. It also prevents the use of unauthorized or unpatched software that could lead to security vulnerabilities.
Implementing a private catalog improves operational efficiency by moving toward a self-service model for developers. Instead of submitting support tickets, users browse the catalog for trustworthy solutions that are ready for deployment, which allows scalable resource deployment while keeping cloud spending under control. The service catalog works with Organizational Policies to provide a robust governance framework: it respects existing identity permissions and resource constraints, and admins can share catalogs at the folder or project level for granular access control. This integration automates compliance and aligns all technical provisioning processes with the organization's broader business goals.
Self-service provisioning lets teams get the resources they need quickly while following company rules. A service catalog provides a list of approved cloud services that users can launch on their own, using service templates that define how resources like databases or virtual machines should be set up. These templates enforce security policies such as data encryption or specific network settings, preventing users from making mistakes that could lead to security risks or unexpected costs. This approach maintains standardized workflows, making the cloud environment easier to manage and more secure.
Infrastructure as Code (IaC) tools, such as Terraform, automate the setup and recovery of cloud resources, reducing human error and ensuring every environment is built exactly the same way every time. Automation is a key part of platform engineering, where the goal is fast, reliable, and consistent deployment across the company. Using IaC also helps with the shared responsibility model, where the customer is responsible for securing their own data.
Organizations should use Identity and Access Management (IAM) to grant permissions to groups rather than individual users, following the principle of least privilege to give people only the specific access they need. The resource lifecycle includes everything from the initial request to the final decommissioning of a service. When creating new projects, administrators must decide on attributes such as resource quotas to limit usage and prevent overspending, billing alerts to monitor costs in real time, and IAM roles for initial service accounts and developers. Managing the full lifecycle ensures resources are retired properly when no longer needed, keeping the environment clean.
Infrastructure as Code (IaC) uses configuration files to manage and provision cloud resources instead of doing it manually. Tools like Terraform allow teams to define their entire environment in a declarative way, describing what the final setup should look like. Using IaC ensures development and production environments stay consistent, preventing errors caused by manual configuration differences. Automated Provisioning streamlines resource deployment by reducing human intervention, which minimizes errors and allows faster recovery when something goes wrong. Automation tools can also trigger remedial actions in response to issues found in audit logs.
A Service Catalog acts as a standardized menu of cloud resources that have been pre-approved for use by the organization. Organizations often use a Project Factory within their automation pipeline to automatically set up new projects with the correct APIs and billing settings. This approach ensures all deployments follow governance rules and maintain operational efficiency across the entire cloud environment.
Deployment Pipelines are automated workflows that move code or artifacts from development to production. These pipelines can use a Push Model, where a central system sends updates, or a Pull Model, where an agent on the resource pulls the latest changes. Securing these pipelines is vital to prevent Supply Chain Attacks, where a bad actor tries to change the code before it is deployed to the cloud.
To improve reliability, experts recommend you Bake Virtual Machine Images by pre-configuring an operating system with all necessary software before deployment. Using Managed Services like Cloud SQL or GKE also helps because they have built-in features for high availability and scaling. Choosing the right deployment archetype, such as a multi-region setup, ensures applications stay online even during major outages.
Prepare and test your skills
Prepare and test your skills
Administrators can add Deployment Manager templates for automated infrastructure setups, pre-configured virtual machine images with security patches, and reference links to internal documentation or approved third-party tools. This centralized catalog ensures that teams use approved, up-to-date resources and reduces the risk of human error or security vulnerabilities during provisioning.
A Project Factory automates the creation of new projects by configuring them with the correct APIs and billing settings within an automation pipeline. This approach ensures that all deployments consistently follow governance rules and maintain operational efficiency across the cloud environment.
Organizations should use Identity and Access Management (IAM) to assign permissions to groups rather than individual users, following the principle of least privilege. When creating new projects, administrators should also establish resource quotas to limit usage, set up real-time billing alerts, and assign IAM roles for initial service accounts and developers.
In a push model, a central system sends updates, whereas in a pull model, an agent on the resource pulls the latest changes. Securing these pipelines is critical to prevent supply chain attacks, where an attacker attempts to alter code before it is deployed to the cloud.
Configure a single Cloud Build trigger on the main branch that executes terraform plan and terraform apply -auto-approve simultaneously against both development and production projects whenever a commit is pushed.
Store Terraform state files locally on individual developer workstations, and configure Cloud Build triggers to pull state files over SSH during pipeline execution before deploying to production.
Migrate all Terraform configurations to Cloud Deployment Manager templates, and configure developers to run gcloud deployment-manager deployments create manually using deployment previews.
Configure remote Terraform state in a Cloud Storage bucket, create Cloud Build pull request triggers to run terraform plan for automated validation, and configure branch triggers so merging into dev applies changes to the development environment, followed by merging dev into prod to apply changes to production.
An enterprise organization wants to streamline infrastructure provisioning on Google Cloud while eliminating manual interventions. Currently, engineers execute terraform apply directly from their local workstations, leading to configuration drift and inconsistent environments between staging and production.
The cloud architecture team establishes the following governance and operational requirements:
StudyCerts
StudyCertsdev environment prior to promotion to prod.How should you design this automated provisioning workflow?