7. Glossary

Every technical term used across this guide, defined in one place and cross-referenced to where it's covered in depth.

Agent Runtime — Managed hosting environment for AI agents on the Gemini Enterprise Agent Platform (formerly Vertex AI Agent Engine). See 3.1.1, 4.1.4.

AlloyDB — PostgreSQL-compatible database for hybrid transactional/analytical workloads. See 3.2.1.

Application Design Center — Visual, AI-assisted tool for designing application architecture and generating deployable configuration. See 3.4.2.

Autopilot (GKE) — GKE mode where Google manages node provisioning; you manage workloads and Pod resource requests. See 3.1.1, 3.1.3, 4.1.2.

Bigtable — Wide-column NoSQL database for massive-scale, low-latency workloads. See 3.2.1.

BigQuery — Serverless data warehouse for large-scale analytical (OLAP) queries. See 1.1.1, 3.2.1.

Billing Account — Top-level entity tied to a payment method; projects link to it to enable paid services. See 2.2.1.

Cloud Asset Inventory — Searchable, historical inventory of resources and their configuration/IAM history. See 2.1.4.

Cloud Identity — Google's identity management layer for provisioning and managing users and groups. See 2.1.2.

Cloud Interconnect — Dedicated physical or partner connection bypassing the public internet. See 3.3.3.

Cloud Logging — Google Cloud's centralized logging service, including audit logs, log buckets, and log routers. See 4.4.2.

Cloud Monitoring — Google Cloud's metrics and alerting service. See 4.4.1.

Cloud NAT — Provides outbound-only internet access for instances without external IPs. See 3.3.3, 4.3.2.

Cloud NGFW (Next Generation Firewall) — Centrally-managed firewall policy system spanning multiple VPCs. See 3.3.2.

Cloud Profiler — Diagnostic tool for CPU/memory usage inside running application code. See 4.4.3.

Cloud Run — Serverless platform for deploying arbitrary containers with autoscaling, including to zero. See 1.1.1, 3.1.1, 3.1.4, 4.1.3.

Cloud Run functions — Source-based, event-driven serverless compute (formerly Cloud Functions). See 3.1.1, 3.1.4.

Cloud Shell — Temporary, pre-authenticated, browser-based terminal with the Cloud SDK pre-installed. See 1.3.1.

Cloud SQL — Managed relational database for transactional (OLTP) workloads. See 1.1.1, 3.2.1.

Cloud Trace — Diagnostic tool for end-to-end request latency across services. See 4.4.3.

Cloud VPN — Encrypted connectivity over the public internet between networks. See 3.3.3.

Cloud Workstations — Fully managed, browser-accessible development environments for general software engineering. See 4.1.4.

CMEK (Customer-Managed Encryption Keys) — Customer-controlled encryption keys for data at rest, governing key lifecycle rather than removing Google's operational role. See 4.2.3.

Config Connector — Google-native tool managing Google Cloud resources as Kubernetes custom resources. See 3.4.1.

Custom Role (IAM) — A role assembled from an exact, hand-picked set of permissions. See 5.1.2.

Database Center — Centralized, fleet-wide view across all managed database instances. See 4.2.3.

Eventarc — Unified event routing from Google Cloud sources to Cloud Run and Cloud Run functions. See 3.1.4.

Fabric FAST — Google's opinionated Terraform framework for bootstrapping a full organization landing zone. See 3.4.1.

Firestore — Document-model NoSQL database for mobile/web app backends. See 3.2.1.

Folder — Optional resource hierarchy container between Organization and Project, typically mirroring org structure. See 1.2.1, 2.1.1.

Gemini Cloud Assist — AI-powered resource analysis, planning assistance, and monitoring interpretation. See 2.1.4, 3.4.2, 4.4.4.

GKE (Google Kubernetes Engine) — Managed Kubernetes for container orchestration at scale. See 1.1.1, 3.1.1, 3.1.3, 4.1.2.

Helm — Package manager templating and installing Kubernetes manifests as a versioned unit. See 3.4.1.

Hyperdisk — Google Cloud's higher-performance block storage option with independently configurable IOPS/throughput. See 3.1.2.

IAM (Identity and Access Management) — System governing who (or what) can perform which actions on which resources. See 1.2, 2.1.2, 5.1.

Instance Template — Reusable VM configuration blueprint used to create Managed Instance Groups. See 3.1.3.

Managed Instance Group (MIG) — A fleet of VM instances managed and autoscaled together from a common template. See 3.1.3.

Memorystore — Managed in-memory cache (Redis/Memcached-compatible). See 3.2.1.

Node Pool (GKE) — A group of nodes within a cluster sharing a common configuration (machine type, GPU/TPU attachment). See 4.1.2.

Ops Agent — Google's unified agent collecting VM metrics and logs into Cloud Monitoring and Cloud Logging. See 4.4.4.

Organization — The top-level resource hierarchy node, tied to a Cloud Identity or Workspace domain. See 1.2.1, 2.1.1.

Organization Policy — Constraint system restricting what configurations are allowed, independent of IAM permissions. See 1.2.1, 2.1.1.

Persistent Disk — Compute Engine's standard block storage, available as zonal or regional. See 3.1.2.

Predefined Role (IAM) — A curated, service-specific role bundle designed around common job functions. See 5.1.2.

Primitive Role (IAM) — Broad, project-wide roles (Owner, Editor, Viewer) predating granular IAM. See 5.1.2.

Project — The resource hierarchy's working unit; every resource belongs to exactly one project. See 1.2.1, 2.1.1.

Query Insights — Diagnostic tool for query-level performance detail on managed databases. See 4.4.3.

Region — A specific geographic area containing multiple zones. See 1.2.2.

Service Account — A workload/application identity, distinct from human user identities. See 5.2.

Shared VPC — Architecture where a host project's VPC is shared with attached service projects. See 3.3.1.

Snapshot — Incremental, point-in-time backup of a Persistent Disk. See 4.1.1.

Spanner — Globally distributed, strongly consistent relational database. See 3.2.1.

Spot VM — Discounted Compute Engine instance reclaimable by Google with short notice. See 3.1.2.

Storage Class (Cloud Storage) — Standard, Nearline, Coldline, or Archive — a per-object or bucket-default cost/access tradeoff. See 3.2.2.

Storage Transfer Service — Managed tool for large-scale, recurring, or external data transfers into Cloud Storage. See 3.2.3.

TPU (Tensor Processing Unit) — Google's custom chip optimized for large-scale ML matrix/tensor operations. See 3.1.5.

VPC Network — Google Cloud's global virtual network resource; contains regional subnets. See 3.3.1.

VPC Network Peering — Private connectivity between two separate VPC networks. See 3.3.1, 3.3.3.

Workforce Identity Federation — Lets external identity providers authenticate human users to Google Cloud without duplicate Cloud Identity accounts. See 2.1.4.

Workload Identity Federation — Lets external workloads/applications authenticate to Google Cloud without a downloaded service account key. See 2.1.4, 5.2.2.

Zone — The smallest geographic unit of resource isolation within a region. See 1.2.2.