Prepare and test your skills
Prepare and test your skills
Gemini Cloud Assist is an AI-powered collaborator for designing, deploying, troubleshooting, and optimizing workloads on Google Cloud. Gemini Cloud Assist (opens in a new tab) works as a multi-agent system that reasons across steps, calls operational tools, and remembers context across long, multi-turn tasks. It combines knowledge of infrastructure, application code, organizational policy, and live operational state to shift work from reactive fixes toward proactive management.
Conversational assistance in the console is help that understands which project and page the operator is viewing. The Cloud Assist panel (opens in a new tab) is available from any Google Cloud console page and from the Cloud Mobile App, and it builds answers from the project ID, organization ID, current page URL and visible text, and session history. This context flow means a question asked on a cluster, service, or instance page is grounded in that resource, which connects an error message to the correct resource instead of giving a generic answer. Because the system can produce plausible but incorrect output, every response must be validated before use.
Access follows the same pattern across services: open the resource page first so page context is correct, then open the Cloud Assist panel from the console toolbar and enter a prompt. For Cloud Run, the project must also have Gemini Cloud Assist set up for the user and project with the right development and deployment permissions. The same chat can start a formal investigation, which carries the chat context into a deeper diagnostic workflow.
Gemini Cloud Assist Investigations is the structured tool for root-cause analysis of complex outages and application failures. An investigation acts like a guided site reliability engineer that ingests logs, metrics, and configurations, tests multiple hypotheses in parallel, and traces causes across multi-tier topologies. Data flows from the triggering error, resource, or natural-language prompt into the investigation engine, and the engine returns ranked observations, hypotheses about likely root causes, and recommended next steps.
Creating an investigation from chat follows an ordered workflow:
An investigation can also start manually from More actions > New investigation in chat, or directly from Logs Explorer and resource-specific pages. Using investigations requires the Investigation Creator IAM role, and moving results into a Google Cloud support case requires enrollment in a support package.
The three diagnostic modes differ by trigger and depth of analysis. Conversational chat answers questions and explains errors, on-demand investigations perform deep multi-signal analysis, and proactive alert investigations start automatically when monitoring detects a problem. The choice depends on whether the operator needs quick guidance, structured diagnosis of an active outage, or background triage of an alert.
| Mode | Trigger | Analysis and output |
|---|---|---|
| Cloud Assist panel chat | Manual prompt from the current console page | Explains errors, suggests metrics and kubectl commands, and gives best practices using project and page context |
| Gemini Cloud Assist Investigations | Manual creation from chat, Logs Explorer, or a resource page | Analyzes logs, configurations, and metrics to produce ranked observations, hypotheses, and next steps |
| Proactive alert investigations | Cloud Alerting policy automatically triggers Gemini Cloud Assist | Analyzes the issue in the background, clusters related alerts, and generates preliminary root-cause analysis with next steps |
Chat fits single errors such as CrashLoopBackOff, NotReady nodes, HTTP 429 no-available-instance, HTTP 404, or 5XX messages where the operator needs to know what to check next. Investigations fit problems where the cause spans code and infrastructure or needs many signals correlated, such as high latency on an api-gateway service from resource constraints or network congestion. Proactive investigations fit high alert noise where the team wants clustered alerts and an initial diagnosis before human triage.
Performance troubleshooting with Gemini Cloud Assist connects infrastructure signals to application behavior and, where supported, to application code. Google Kubernetes Engine (GKE) (opens in a new tab) assistance can explain Pod errors such as nil-pointer panics, recommend which latency-related metrics to check first, and outline node troubleshooting steps including node auto-repair concepts. Cloud Run (opens in a new tab) chat analyzes container logs to pinpoint scaling, startup-time, traffic-spike, ingress, or project-state problems, while investigations add ranked hypotheses and, for services deployed from source, code-fix suggestions in the Source tab.
Database and analytics troubleshooting applies the same pattern to data-plane bottlenecks across managed services:
Gemini Cloud Assist helps find slow SQL queries, manage slot reservations and capacity, troubleshoot performance bottlenecks, and configure data environments. Typical prompts ask for current CPU use, highest-latency queries, error-log counts, or fleet-wide health for an instance. For Bigtable, an investigation compares baseline data against client latencies, server latencies, CPU use, disk use, and request count for the selected cluster and time range, then lists client misconfigurations and other findings with actionable hypotheses.
Exam tip: Cost totals reported by Gemini Cloud Assist use contract prices before committed-use discounts or other credits are applied.
Incident awareness with Gemini Cloud Assist separates a Google Cloud platform incident from a problem inside the user's own project. When the Service Health API is enabled and the user has the Service Health Viewer IAM role, prompts about a Compute Engine, Cloud Storage, or BigQuery incident return incident status, project impact, and workarounds. This boundary matters because a 5XX in logs, regional latency spike, or quota-like failure can originate on either side, and checking service health first avoids wasted work on application code. Code troubleshooting extends the boundary the other way by tracing from infrastructure signals down to code for services such as Cloud Run.
Security and artifact findings are handled by specialized workers that turn technical signals into remediation steps. The security worker triages Security Command Center findings for non-security operators by explaining external exposure, service-account risks, and compliance gaps as clear actions. Artifact Analysis and Artifact Registry assistance answers questions about container-image vulnerabilities and lists repositories and Docker-format images, so a deployment failure or outage can be linked to a known image risk.
Resource optimization with Gemini Cloud Assist combines Recommender-based rightsizing with Cloud Hub cost and utilization analysis. The Cloud Assist panel surfaces recommendations for estimated savings, cluster reliability, idle virtual machines, nearly exhausted quotas, and BigQuery datasets that should be partitioned or clustered. This workflow depends on the Recommender API and the Recommender Viewer IAM role, so both API enablement and identity permission must be in place before recommendations can be read.
Cost investigation depends on a separate control plane centered on Cloud Hub and the App Optimize API. With the App Optimize API enabled and the Cloud Hub Operator IAM role granted, Gemini Cloud Assist reports recent cost and utilization changes, per-application or per-project spend, and explanations for cost changes on supported resources. For an application, the total includes resources fully used by that application and excludes costs for resources shared across applications. Typical prompts ask for the five most expensive resources last month, last week's cost for a named GKE cluster, the most expensive resources in us-central1, or the least cost-efficient resources for an application such as a web store.
Support handoff with Gemini Cloud Assist preserves investigation context when human help is needed. AI-powered support summarizes environment state and error logs, uses investigation tools to attempt resolution before escalation, and fills support-case fields automatically from the chat conversation. When automated limits or quotas are reached, the agent passes the issue to human support engineers with investigation results attached for faster resolution. Escalation requires enrollment in a support package, while integrations with Slack, WhatsApp, and ServiceNow let the same diagnostic context flow into existing operational workflows.
Command-line productivity and secure AI governance with Gemini CLI is the practice of generating operational commands with AI while bounding what the model can see and do. Gemini Cloud Assist (opens in a new tab) generates and refines Google Cloud CLI commands, kubectl manifests, and Terraform code through interactive chat, and its investigations feature is available in the command-line interface, IDEs, Logs Explorer, and Google Cloud console. Productivity therefore depends on governance, because the same project that enables assistance APIs must also carry the Identity and Access Management (IAM) policies, network protections, and data controls around proprietary data.
Synthesizing commands with Gemini in the CLI means describing intent in natural language and refining the generated commands and policy code through conversation. Data flows from the operator prompt in chat to Gemini Cloud Assist, which returns candidate Google Cloud CLI commands, kubectl manifests, Terraform code, and organizational policies that can be simulated in chat before running against real infrastructure. Investigations extend this loop by ingesting logs, metrics, configurations, and error messages to explore multiple hypotheses in parallel and trace root causes across multi-tier topologies. Because Gemini for Google Cloud products can generate plausible but incorrect output, every synthesized command, script, and summary must be validated before use.
IAM policies for Gemini assistance control which principals can invoke the models and which product data they can reason over. Access to Gemini Cloud Assist requires the project-level roles roles/geminicloudassist.user and roles/cloudasset.viewer, while access to Gemini Code Assist and console Gemini features requires roles/cloudaicompanion.user and roles/serviceusage.serviceUsageConsumer. The assistance service depends on the project binding, because permissions only work when the enabling API is active in the same project where the roles are granted.
The two scopes differ by required roles and project dependency:
| Assistance scope | Required roles | Project dependency |
|---|---|---|
| Gemini Cloud Assist | roles/geminicloudassist.user, roles/cloudasset.viewer | Gemini Cloud Assist API enabled in the project where roles are granted |
| Gemini Code Assist / Gemini for Google Cloud | roles/cloudaicompanion.user, roles/serviceusage.serviceUsageConsumer | Gemini for Google Cloud API enabled in the project where roles are granted |
To manage roles at scale, create a group for developers and grant the required roles to that group rather than to individuals, then apply least privilege and add product-specific roles only when a principal needs help with products they cannot already access. Granting proceeds first with base assistance roles, then with additional viewer or product roles, and only after the enabling APIs are active. Authentication flows from Cloud Identity, Google Workspace, or a federated identity provider, with single sign-on, 2-step verification, and password requirements as account-level controls before any IAM role takes effect.
Custom roles for Gemini Code Assist Standard and Enterprise must contain specific permissions to invoke assistance, enable services, and read effective settings. Any custom role for basic use needs the following permissions:
cloudaicompanion.instances.completeCodecloudaicompanion.instances.completeTaskcloudaicompanion.instances.generateCodecloudaicompanion.instances.generateTextcloudaicompanion.instances.exportMetricscloudaicompanion.instances.queryEffectiveSettingcloudaicompanion.instances.queryEffectiveSettingBindingsserviceusage.services.enableLicense administration uses a separate permission set under consumerprocurement.orders, including get, update, assign, unassign, and enumerateLicensedUsers on license pools.
Data privacy controls for Gemini assistance start from the definition of Customer Data and the stateless design of the models. Gemini Code Assist (opens in a new tab) handles prompt data, response data, conversation history, snippets of files open in the IDE, snippets of adjacent files, and cursor location as Customer Data under the Cloud Data Processing Addendum. The large language model (LLM) instances behind the Gemini for Google Cloud API are stateless and shared by all customers that enable the API, so prompts and responses are not stored in Google Cloud by default. Context used for a response is limited to operational signals such as project ID and organization ID, page context from the visible console page and URL, and session memory across turns.
An organization keeps control by choosing whether to persist that flow for audit. Only when an administrator configures logging does input and output flow from the assistance interaction to a Cloud Logging bucket, where usage can be monitored alongside administrative activity. Gemini Cloud Assist can store data in any Google Cloud data center globally, so projects with data residency or customer-managed encryption key requirements should not enable the Gemini Cloud Assist API. This creates a direct tradeoff where broader context improves relevance but residency-sensitive workloads must stay outside enabled projects.
Governance boundaries for Gemini assistance separate untrusted access paths from trusted Google-managed services. Traffic flows from developer workstations or on-premises environments over an encrypted Transport Layer Security (TLS) connection to Google Front End (GFE), which routes the prompt to the Gemini for Google Cloud API for processing. That API is built for Google-provided clients only and has no access to other APIs or resources in the customer project, so compromise of a prompt path does not by itself grant access to project resources. For stronger isolation, the corporate network can connect to Google Cloud over Cloud VPN or Cloud Interconnect, and internal topology can use Shared VPC for centralized network management with environment separation.
VPC Service Controls provides the perimeter boundary by defining policies that prevent access to Google-managed services outside a trusted perimeter, block access from untrusted locations, and mitigate data exfiltration. When a perimeter is used, the Gemini for Google Cloud API and Gemini CLI (opens in a new tab) API must be added to the perimeter, and principals outside the perimeter need an ingress policy that explicitly allows access. Enabling assistance follows an ordered dependency:
geminicloudassist.googleapis.com, which also enables cloudaicompanion.googleapis.com required for processing conversations.cloudasset.googleapis.com, designcenter.googleapis.com, appoptimize.googleapis.com, and apphub.googleapis.com, plus optional recommended APIs for better performance.roles/geminicloudassist.user and roles/cloudasset.viewer in the same project, then add product-specific roles and verify custom organization-policy constraints do not block chat.Exam tip: If the project is inside a VPC Service Controls perimeter, do not use the console setup and exclude appoptimize.googleapis.com, because the App Optimize API is not supported by VPC Service Controls.
Gemini Code Assist Standard and Enterprise is an AI coding assistant that runs inside the developer's integrated development environment (IDE) to generate, explain, refactor, and debug code. Gemini Code Assist (opens in a new tab) works after setup for a Google Cloud project and installation of the extension for Visual Studio Code or a supported JetBrains IDE, giving inline completions in the editor and conversational help through the Gemini panel. The models are trained on publicly available code, Google Cloud-specific material, and other technical information in addition to the Gemini foundation models. Secure development still requires a secure software development lifecycle (SDLC), with AI output validated before use because early-stage models can produce plausible but incorrect results.
Code assistance in Gemini Code Assist means the extension proposes completions as the developer types and generates new code from natural-language prompts in the editor. The developer can select existing code, open the conversational assistant, and ask for targeted changes that improve quality and security posture. This chat workflow supports three core secure-development tasks:
Write unit tests for my code to create automated test coverage for selected functions.Help me debug my code to explain failures and propose fixes.Make my code more readable to refactor structure without changing behavior.The same pattern extends to analyzing existing code, identifying potential issues, and suggesting improvements, which is critical for understanding legacy codebases. Because the assistant sees conversation history, snippets of open files, snippets of adjacent files, and cursor location, its suggestions stay grounded in local project context.
Automated test creation in Gemini Code Assist turns selected application code into draft unit tests that the developer reviews, runs, and hardens. Test generation flows from the developer's selection in the IDE to the Gemini for Google Cloud API (cloudaicompanion.googleapis.com), which processes the prompt with stateless large language models (LLMs) shared across customers and returns response text to the IDE. Legacy analysis follows the same flow, where old functions or unfamiliar modules are summarized, explained, and refactored into clearer, more maintainable forms. The developer remains responsible for validating every generated test and refactor, confirming that edge cases, error handling, and security checks behave as intended before merging.
The enterprise architecture for Gemini Code Assist separates the developer environment, the network path, and the Google Cloud processing plane with explicit trust boundaries. Developer workstations or Cloud Workstations in the on-premises or corporate environment run the Visual Studio Code or JetBrains extension, and traffic flows from that extension over an encrypted Transport Layer Security (TLS) connection over the internet to Google Front End (GFE), the globally distributed entry point into Google's network. Within the Google Cloud environment, the enabled project hosts the Gemini for Google Cloud API, which has no access to other APIs or resources in that project and only provides access to stateless LLMs. An optional VPC Service Controls service perimeter can surround the Gemini for Google Cloud API and the Gemini Code Assist API to block access from untrusted locations and mitigate data exfiltration.
Authentication for Gemini Code Assist requires each developer to use a user account managed by Cloud Identity, Google Workspace, or an external identity provider federated with Cloud Identity or Google Workspace. Organizations harden that identity layer with three controls:
Access is governed by Identity and Access Management (IAM), where least privilege is enforced by granting roles to a developer group rather than to individuals. The predefined roles are roles/cloudaicompanion.user and roles/serviceusage.serviceUsageConsumer, and custom roles must include permissions such as cloudaicompanion.instances.generateCode and serviceusage.services.enable among others. Network protection starts with default encryption in transit to GFE, with optional Cloud VPN or Cloud Interconnect for a dedicated path between the corporate network and Google Cloud, plus Shared VPC for centralized management. Setup for Standard and Enterprise (opens in a new tab) ties these identity, role, and network choices together in the enabling project.
Data protection in Gemini Code Assist treats prompts, responses, and surrounding context as Customer Data under the Google Cloud Terms of Service and the Cloud Data Processing Addendum. Customer Data includes developer queries, model responses, conversation history, snippets of open and adjacent files, and cursor location sent to generate a completion. Because the service is stateless, it does not store prompts and responses in Google Cloud by default, and logging to a Cloud Logging bucket must be explicitly configured if retention is needed for auditing or monitoring. Shared responsibility applies throughout, where Google secures the infrastructure and provides access controls, VPC Service Controls configuration, and audit logging for administrative activity, while the customer manages identities, IAM bindings, and perimeter policies.
Exam tip: The Gemini for Google Cloud API processes prompts through stateless LLMs and cannot reach other APIs in your project, so prompts and responses are not stored unless you configure Cloud Logging retention.
roles/geminicloudassist.user and roles/cloudasset.viewer, while Gemini Code Assist requires roles/cloudaicompanion.user and roles/serviceusage.serviceUsageConsumer in the project where the enabling API is active.Use Cloud Assist panel chat for quick guidance on single errors such as CrashLoopBackOff, NotReady nodes, HTTP 404 or 5XX messages, where it explains errors and suggests metrics and best practices using project and page context. Use Gemini Cloud Assist Investigations for structured diagnosis of complex outages where logs, metrics and configurations are analyzed to produce ranked observations, hypotheses about likely root causes and recommended next steps. Use proactive alert investigations when a Cloud Alerting policy automatically triggers background triage that clusters related alerts and generates preliminary root-cause analysis before human triage.
Gemini Cloud Assist requires roles/geminicloudassist.user and roles/cloudasset.viewer in the project where the enabling API is active. Gemini Code Assist and console Gemini features require roles/cloudaicompanion.user and roles/serviceusage.serviceUsageConsumer in the project where the enabling API is active. To manage roles at scale, grant the required roles to a developer group rather than to individuals and apply least privilege with product-specific roles only when needed.
The Gemini for Google Cloud API processes prompts through stateless large language models shared by all customers that enable the API and it has no access to other APIs or resources in the customer project. Prompts, responses, conversation history, snippets of open and adjacent files and cursor location are treated as Customer Data and are not stored in Google Cloud by default. Input and output flow to a Cloud Logging bucket only when an administrator explicitly configures logging for audit or monitoring.
A DevOps team is troubleshooting intermittent performance bottlenecks and latency spikes on a production Cloud SQL for PostgreSQL database hosting a critical microservice. The lead engineer intends to use conversational AI in the Google Cloud console via Gemini Cloud Assist to diagnose query latency, detect query anomalies, and receive index and configuration recommendations.
However, upon opening the Cloud SQL monitoring dashboards and the Gemini Cloud Assist panel, the engineer observes that AI-assisted troubleshooting insights and query anomaly detection are unavailable for this database instance.
Which configuration state explains why AI-assisted troubleshooting and query anomaly detection cannot be utilized on this instance?
Last updated