Hands-on Lab — CDL Google Cloud Digital Leader

Overview

Prerequisites

Steps

1. 1.Provider, project services, naming

   GCP requires explicit project services (APIs) to be enabled before resources can be provisioned. We enable storage.googleapis.com (for Step 2) and billingbudgets.googleapis.com (for Step 4). Compare to AWS where API surfaces are always on — GCP makes you opt in per project.

   Replace your-project-id with your actual project ID.

   Copy

   terraform {
     required_version = ">= 1.5"
   
     required_providers {
       google = { source = "hashicorp/google", version = "~> 6.0" }
     }
   }
   
   provider "google" {
     project = "your-project-id" # REPLACE with your GCP project ID
     region  = "us-central1"
   }
   
   locals {
     labels = {
       project    = "certlabpro-cdl"
       managed_by = "terraform"
     }
   }
   
   resource "google_project_service" "storage" {
     service            = "storage.googleapis.com"
     disable_on_destroy = false
   }
   
   resource "google_project_service" "budgets" {
     service            = "billingbudgets.googleapis.com"
     disable_on_destroy = false
   }

2. 2.Provision a Cloud Storage bucket with uniform access + lifecycle

   Provisions:

   • Cloud Storage

   Cloud Storage is GCP's S3 equivalent — object store with regional, multi-regional, and dual-region replication options. The CDL exam tests the which-storage-class question repeatedly: Standard (hot), Nearline (>30 day), Coldline (>90 day), Archive (>365 day).

   We enable uniform bucket-level access (the CDL-recommended security default — disables fine-grained per-object ACLs in favor of IAM-only) and a 30-day → Nearline lifecycle transition. Names must be globally unique across all GCP — we suffix with a random hex.

   Copy

   resource "random_id" "suffix" {
     byte_length = 4
   }
   
   resource "google_storage_bucket" "main" {
     name                        = "certlabpro-cdl-${random_id.suffix.hex}"
     location                    = "US"
     uniform_bucket_level_access = true
     force_destroy               = true # lab-only — never in production
   
     lifecycle_rule {
       condition {
         age = 30
       }
       action {
         type          = "SetStorageClass"
         storage_class = "NEARLINE"
       }
     }
   
     labels = local.labels
   
     depends_on = [google_project_service.storage]
   }

3. 3.Enable Cloud Logging as the universal audit fabric

   Provisions:

   • Cloud Logging

   GCP's Cloud Logging is on by default for most services — but the CDL exam tests the Required vs Default vs Data Access audit-log distinction. Required audit logs (admin activity) are always on, free, can't be disabled. Default logs (data writes for some services) are on but can be disabled. Data Access logs (data reads) are off by default — must be explicitly enabled and bill normally.

   We enable Data Access logging for Cloud Storage so every read of every object in the bucket from Step 2 lands in Cloud Logging. The lab is a demonstration of the iam-audit-config primitive; production deployments use this pattern at org level via [[gcp-pcse]] patterns.

   Copy

   resource "google_project_iam_audit_config" "storage_data_access" {
     service = "storage.googleapis.com"
   
     audit_log_config {
       log_type = "DATA_READ"
     }
   
     audit_log_config {
       log_type = "DATA_WRITE"
     }
   }

4. 4.Wire a Cloud Billing budget that emails on threshold breach

   Provisions:

   • Cloud Billing

   The CDL exam loves this pattern — Cloud Billing budgets + alerts is the recurring CDL exam-question shape for cost control. We set a $10/month budget and configure alerts at 50% / 90% / 100% of forecasted spend. The alert lands via email to billing-account admins (no extra config needed for email; for Slack / PagerDuty you'd add a Pub/Sub topic + Cloud Function fanout).

   Replace your-billing-account-id with your actual ID. The budget is scoped to the current project only via projects filter — the CDL exam tests this per-project-budget vs org-wide-budget distinction.

   Copy

   data "google_project" "current" {}
   
   resource "google_billing_budget" "monthly_10" {
     billing_account = "your-billing-account-id" # REPLACE — find via `gcloud beta billing accounts list`
     display_name    = "certlabpro-cdl-$10-monthly"
   
     budget_filter {
       projects = ["projects/${data.google_project.current.number}"]
     }
   
     amount {
       specified_amount {
         currency_code = "USD"
         units         = "10"
       }
     }
   
     threshold_rules {
       threshold_percent = 0.5
       spend_basis       = "FORECASTED_SPEND"
     }
   
     threshold_rules {
       threshold_percent = 0.9
       spend_basis       = "FORECASTED_SPEND"
     }
   
     threshold_rules {
       threshold_percent = 1.0
       spend_basis       = "CURRENT_SPEND"
     }
   
     depends_on = [google_project_service.budgets]
   }

Cleanup