Google Cloud Platform (GCP) for .NET and Full Stack Developers
In short: Organisation (your domain) → folders (departments/environments) → projects → resources.
- Projects are the core unit: they hold resources, enabled APIs, quotas and are linked to a billing account.
- IAM policies and organisation policies set at higher levels are inherited by everything below.
In short: A fully managed platform that runs any stateless HTTP container: you deploy an image (or source), get an HTTPS endpoint, automatic scaling from zero to many instances, per-request billing, revisions with traffic splitting, and integration with Secret Manager, Cloud SQL and Pub/Sub.
- ASP.NET Core containers run unchanged — just listen on the
PORTenvironment variable.
In short: Identities for workloads rather than people.
- A Cloud Run service, VM or GKE workload runs as a service account, and IAM roles granted to that account decide what Google APIs it can call (e.g.
roles/cloudsql.client,roles/secretmanager.secretAccessor). - Client libraries pick up its credentials automatically; avoid downloading service account keys — use Workload Identity (Federation) instead.
In short: Compute Engine: VMs with full control (legacy/IIS apps).
- Cloud Run: serverless containers — simplest for HTTP services and jobs.
- GKE: managed Kubernetes for complex microservice platforms (Autopilot reduces node management).
- App Engine: the original PaaS, now mostly replaced by Cloud Run for new work.
In short: Use a private IP Cloud SQL instance and connect from Cloud Run through VPC egress (Direct VPC egress or a Serverless VPC Access connector), or use the Cloud SQL Auth Proxy/connector which authorises with IAM and encrypts the connection.
- Run Cloud Run as a dedicated service account with
roles/cloudsql.client, keep the password/connection string in Secret Manager mounted as an environment variable, and enable HA and backups on the instance.
In short: Pub/Sub is many-to-many event messaging: publishers send to topics and every subscription receives each message (fan-out, decoupling, streaming).
- Cloud Tasks is a queue of individual HTTP tasks targeted at one handler with explicit rate limits, scheduling and retries — like a background job queue.
- Use Pub/Sub for events, Cloud Tasks for controlled work dispatch.
In short: A serverless, columnar data warehouse that runs SQL over terabytes–petabytes without managing servers, billed by storage and bytes scanned (or reserved slots).
- Use it for analytics, reporting, log analysis and ML (BigQuery ML) — not for OLTP.
- Partition and cluster tables and avoid
SELECT *to control cost.
In short: Cloud SQL: managed SQL Server/PostgreSQL/MySQL for typical regional relational apps.
- Spanner: horizontally scalable, globally consistent relational database for very large or global systems.
- Firestore: serverless document database with real-time sync for web/mobile.
- Bigtable: wide-column NoSQL for massive throughput time-series/analytical workloads.
In short: GCP VPC networks are global resources — one VPC spans all regions with regional subnets, and instances in different regions communicate over Google's private network without peering.
- AWS VPCs and Azure VNets are regional and need peering or transit gateways to connect regions.
- Firewall rules in GCP apply at the VPC level and can target network tags or service accounts.
Use Workload Identity Federation: configure a workload identity pool and provider trusting GitHub Actions' (or Azure DevOps') OIDC tokens, allow it to impersonate a deploy service account with minimal roles, and authenticate in the pipeline with google-github-actions/auth — short-lived tokens, nothing secret stored in the CI system.
In short: Containerise the API (Dockerfile listening on PORT), push to Artifact Registry with Cloud Build, deploy to Cloud Run with a dedicated service account, min instances 1 for low latency, secrets from Secret Manager;
- Cloud SQL for SQL Server (HA, backups, PITR, private IP) reached via VPC egress;
- Cloud Logging/Monitoring alerts on errors and latency;
- a global HTTPS load balancer with Cloud Armor if a custom domain and WAF are needed;
- budgets for cost control.
Write structured JSON logs to stdout with a severity field (and message, trace fields) — e.g. use a JSON console formatter or Google.Cloud.Diagnostics.AspNetCore3 — so Cloud Logging parses levels and fields, and include the logging.googleapis.com/trace field to correlate logs with Cloud Trace requests.
Partition tables by date and cluster by common filters, require partition filters, avoid SELECT *, use materialised views and BI Engine for dashboards, set per-user/per-project custom quotas and maximum_bytes_billed, consider slot reservations (editions) for predictable spend, and review the most expensive queries in INFORMATION_SCHEMA jobs views.
In short: A region is a geographic location (asia-south1 Mumbai) with three or more zones — isolated deployment areas within the region.
- Zonal resources (VMs, disks) live in one zone;
- regional resources replicate across zones (regional Cloud SQL HA, Cloud Run);
- multi-regional resources (Cloud Storage multi-region, BigQuery US/EU) replicate across regions for availability and proximity.
In short: Public services allow allUsers the roles/run.invoker role;
- private services require callers with run.invoker (service accounts for service-to-service with ID tokens), Identity-Aware Proxy for employees, or ingress settings restricting traffic to internal/load balancer only.
- Combine with application-level auth (JWT from Identity Platform/Entra) for end users.