Book TOC · Previous · Chapter 8 of 8

Chapter 8: Master Look-Alike Tool Comparison & Decision Playbook

Chapter Focus: Side-by-side comparison of look-alike PCA services, a 5-Step Architecture Decision Framework, cross-domain production patterns, and the Top 25 Golden Rules.

1. The PCA Look-Alike Service Disambiguation Matrix

In complex Google Cloud Certified Professional Cloud Architect architectures, multiple Google Cloud services often appear to solve similar problems. Use the matrix below to distinguish between closely related services based on latency, scale, security boundaries, and operational overhead.

2. The 5-Step Architecture Decision Framework

When evaluating a multi-service Google Cloud design, apply this structured 5-step architectural review:

1. Step 1 — Pinpoint Core Workload & Non-Functional Requirements: Identify the primary workload driver (e.g., sub-10ms OLTP vs. petabyte OLAP, synchronous REST vs. asynchronous event streaming, strict regional data residency vs. global active-active availability).
2. Step 2 — Prefer Managed, Cloud-Native Services First: Default to fully managed, serverless, or Google-curated services before introducing self-managed VMs, custom glue scripts, or unscalable manual operations.
3. Step 3 — Enforce Zero-Trust Identity & Keyless Authentication: Replace static credentials, long-lived service account JSON keys, and broad basic roles (Owner/Editor) with Workload Identity Federation, attached service accounts, and predefined IAM roles.
4. Step 4 — Verify Network Isolation & Data Perimeter Guardrails: Combine private connectivity (Private Service Connect, Private Google Access, IAP TCP forwarding) with VPC Service Controls and Organization Policy constraints.
5. Step 5 — Optimize for Cost, Observability, and Day-2 Reliability: Validate autoscaling boundaries, SLO burn-rate alerting, sink-level log filtering, and automated rollback pipelines before production rollout.

3. Review: Architecture Decision List

1. Database Migration Service (DMS) is the preferred tool for migrating MySQL and PostgreSQL to Cloud SQL.
2. Use Continuous Migration jobs in DMS when you need minimal downtime and the source must remain online.
3. Use One-time Migration or dump files only when downtime is acceptable or the data is static.
4. Identity-Aware Proxy (IAP) enables secure access to private VMs without external IP addresses.
5. Network traffic from IAP to your VM originates from the specific CIDR range 35.235.240.0/20.
6. Firewall rules in Google Cloud function as stateful filters; you must explicitly allow ingress traffic if the default rule is 'deny'.
7. Always follow the principle of least privilege by restricting firewall source ranges to only what is necessary (e.g., IAP range vs. 0.0.0.0/0).
8. Spot VMs offer significant cost savings but can be preempted at any time.
9. Spot VMs provide a 30-second grace period upon preemption.
10. Use shutdown scripts to save state, close connections, or finish logs during this grace period.
11. Spot VMs cannot live migrate; they terminate upon reclamation.
12. Partitioning BigQuery tables reduces cost and improves performance by minimizing the bytes scanned.
13. Always partition by the column that is most frequently used in query filters (e.g., event timestamp).
14. Avoid table sharding (creating separate tables by date) in favor of native partitioning.
15. Use IAM Conditions for temporary access to avoid manual revocation tasks.
16. The CEL expression request.time < timestamp enforces an expiration date.
17. Avoid building custom automation (like Cloud Functions) when a native configuration feature exists.
18. Always calculate the estimated transfer time based on bandwidth and data volume.
19. Use Transfer Appliance for large-scale data migrations (terabytes to petabytes) when internet bandwidth is the bottleneck.
20. Online tools like gsutil and Storage Transfer Service are best for smaller datasets or high-bandwidth scenarios.
21. Infrastructure upgrades like Interconnect often have lead times that may exceed urgent project deadlines.
22. Cloud Data Fusion is the primary choice for visual, code-free ETL/ELT pipeline creation.
23. Dataflow is for developer-centric, code-heavy stream and batch processing using Apache Beam.
24. Dataproc is for migrating existing Hadoop/Spark workloads which rely on code/jobs.
25. Always match the tool to the user's technical skill level (Business Analyst vs. Data Engineer).
26. LLMs are restricted to their training data unless connected to external tools.
27. Function Calling (Tool Use) is the standard method for enabling models to take actions or query real-time data.
28. Fine-tuning is for adapting style or knowledge, not for real-time interaction.
29. Grounding is for retrieving information (RAG), whereas Function Calling is for executing logic.
30. Vertex AI Pipelines orchestrate end-to-end ML workflows.
31. Google Cloud Pipeline Components (GCPC) provide pre-built steps for standard Google Cloud services.
32. Using pre-built components accelerates development by removing the need to write custom container code for platform interactions.
33. Regulatory compliance often requires stronger guarantees than standard IAM permissions can provide.
34. Bucket Lock (Locked Retention Policy) enforces WORM (Write Once, Read Many) compliance.
35. Locking a policy is irreversible; ensure the configuration is correct before locking.
36. Versioning protects against accidents, while Retention Policies protect against compliance violations.
37. Object Versioning increases storage costs by keeping historical copies of data.
38. Lifecycle Management is the built-in tool for automating data cost optimization (e.g., deletion or tiering).
39. The Number of newer versions condition is specifically designed to prune old versions while retaining a fixed history depth.
40. Avoid using custom scripts for standard cloud maintenance tasks when native features exist.
41. Global External Application Load Balancers provide Layer 7 capabilities and global Anycast IP addresses.
42. Cloud CDN integrates with Application Load Balancers to cache content at the edge.
43. Offloading static content to Cloud CDN reduces load on origin servers.
44. Cloud HSM is required when regulations mandate FIPS 140-2 Level 3 validation.
45. Software keys (default Cloud KMS) are FIPS 140-2 Level 1 validated.
46. Always match the Protection Level of a key to the specific compliance requirements of the workload.
47. Cloud Profiler is a continuous profiling tool designed for production environments.
48. It uses statistical sampling to collect data, rather than tracing every call.
49. The overhead is extremely low, typically around 0.5% to 5% CPU impact.
50. It supports multiple languages (Go, Java, Node.js, Python, etc.) and runs on VMs, GKE, or standard environments.
51. Autoscaling is reactive; there is always a delay between load detection and capacity availability.
52. To validate scaling speed, use load tests with aggressive ramp-up rates.
53. Testing in production carries high risk; always validate in a separate environment or during maintenance windows using synthetic load.
54. Pre-provisioning is a valid mitigation strategy but does not validate dynamic scaling logic.
55. Always check if a Predefined role fits your needs first; they are easier to maintain.
56. If Predefined roles are too permissive, create a Custom Role.
57. Apply the principle of least privilege: grant only the permissions required for the task.
58. Avoid Basic roles (Owner, Editor, Viewer) in production environments as they are too broad.
59. Compute scaling (horizontal or vertical) addresses capacity and load, not network latency.
60. Cloud CDN is the primary solution for reducing latency for static assets (images, CSS, JS) in global applications.
61. Cloud CDN works by caching content at the edge, closer to the user.
62. Cloud Interconnect is for hybrid connectivity, not public content delivery.
63. Google Cloud encrypts all customer data at rest by default using Google-managed keys.
64. CMEK (Customer-managed encryption keys) gives customers control over key lifecycle but keeps keys within Google infrastructure.
65. Cloud EKM (External Key Manager) is the correct choice when regulations require keys to be stored and managed outside of the cloud provider entirely.
66. Data sovereignty and strict compliance often dictate the use of EKM or HSM solutions.
67. Compliance is strict: Data residency laws (like GDPR specific clauses) can limit your technical architectural choices.
68. Regions vs. Zones: Zones are failure domains within a single Region. Distributing across zones protects against data center failures without leaving the region.
69. Multi-Region Limitations: Standard Multi-Region storage or routing usually spans countries (e.g., across the EU), which may violate single-country data constraints.
70. DORA metrics are the industry standard for measuring DevOps performance.
71. Lead Time for Changes and Deployment Frequency measure velocity (speed).
72. Change Failure Rate and Time to Restore Service measure stability (quality).
73. Align the KPI directly with the business goal (e.g., speed vs. reliability).
74. Blameless post-mortems are critical for identifying root causes.
75. Focus on fixing the system or process, not the person.
76. Punishment leads to hiding information; psychological safety leads to transparency.
77. IAM Conditions: Use conditions to define when (time), where (IP/region), or on what (resource) a role binding applies.
78. Temporal Access: Prefer request.time conditions for temporary access over manual provisioning/deprovisioning.
79. Declarative vs Imperative: Use declarative policy configurations (like IAM Conditions) over imperative scripts (like Cloud Scheduler jobs) for reliability.
80. Gemini Cloud Assist can significantly accelerate troubleshooting by interpreting configurations and logs via natural language prompts.
81. Network connectivity issues in Google Cloud are commonly caused by Firewall Rules or Routes.
82. Automated tools (Gemini, Connectivity Tests) are preferred over manual rule inspection for accuracy and speed.
83. Dedicated Interconnect is the standard choice for high-bandwidth (>10 Gbps) private connectivity requiring an SLA.
84. Cloud VPN traverses the public internet and is better suited for lower bandwidth or backup scenarios.
85. Peering (Direct or Carrier) provides access to Google public services and does not offer an SLA.
86. Capacity planning for Dedicated Interconnect involves aggregating 10 Gbps or 100 Gbps circuits.
87. Democratize AI: Use tools that match your team's current skill set (e.g., SQL for analysts).
88. Minimize Data Movement: Train models where the data resides (data gravity) to reduce cost and latency.
89. BigQuery ML: The go-to solution for SQL-based machine learning on structured data in BigQuery.
90. Use Internal Application Load Balancers for Layer 7 traffic (HTTP/HTTPS) that requires path-based routing within a private network.
91. Network Load Balancers are Layer 4 (TCP/UDP) and cannot route based on URL paths or headers.
92. Always avoid assigning public IP addresses to internal components (like databases or middleware) to minimize the attack surface.
93. URL Maps are the configuration resource used by Application Load Balancers to define routing rules.
94. IAM manages identity and permissions but does not control data movement boundaries.
95. VPC Service Controls create a perimeter to prevent data exfiltration to resources outside the trusted boundary.
96. Firewall rules control traffic based on IP/Port, which is often insufficient for separating corporate vs. personal cloud resources sharing the same API endpoints.
97. Spot VMs are the most cost-effective choice for stateless, fault-tolerant, and flexible workloads.
98. Stateless applications do not store critical data locally, making them safe to interrupt.
99. Committed Use Discounts are best for predictable, steady-state usage, not necessarily for flexible batch jobs where maximum savings are prioritized over availability.
100. Zonal clusters have a single Control Plane; if the zone fails, the API server becomes unavailable.

Book TOC · Previous · Chapter 8 of 8