Topic 2 of 11

D2 · Planning and implementing a cloud solution

Compute Engine: creating and configuring instances

Launching a VM looks trivial, but the exam guide asks for specific decisions: the availability policy, SSH keys, OS Login, VM Manager, Spot VMs, and custom machine types. Each one changes the cost, the security, or how the VM behaves during Google maintenance.

Contents

Creating an instance
Machine families and types
Custom machine types
Spot VMs
Availability policy (host maintenance)
SSH access: keys in metadata
OS Login
VM Manager
Exam scenarios
Common exam traps

Creating an instance

The console's Create an instance page groups options into panes: Machine configuration (name, zone, machine type), OS and storage (boot disk and image), Data protection, Networking, Observability (Ops Agent), Security, and Advanced (metadata, reservations, provisioning model, sole-tenancy). The Equivalent code button generates the matching gcloud, REST, or Terraform code.

gcloud compute instances create web-1 --zone=us-central1-a \
  --machine-type=e2-medium --image-family=debian-13 --image-project=debian-cloud

--image-family uses the latest non-deprecated image in the family; --image pins a specific version.
To create many at once: gcloud compute instances bulk create. To run a container image: create-with-container.
Most public images have no extra cost, except premium ones. Importing your own images is free, but you pay for their storage.
Anyone who connects to a VM can use all the IAM permissions of the service account attached to it.

Machine families and types

Family	Series	What for
General-purpose	N4, N4A, N4D, N2, N2D, N1 · C4, C4A, C4D, C3, C3D · E2 · Tau T2D, T2A	N: balanced price/performance. C: consistently high performance. E2: day-to-day computing at a lower cost. Tau: scale-out workloads
Storage-optimized	Z3, Z4D, Z4M	SQL/NoSQL databases, analytics, search
Compute-optimized	H4D, H3, C2, C2D	HPC, simulation, compute-bound workloads
Network-optimized	C4N, M4N	I/O- and bandwidth-intensive workloads
Memory-optimized	X5, X4, M4, M3, M2, M1	SAP HANA, in-memory databases
Accelerator-optimized	A4X Max, A4X, A4, A3, A2, G4, G2	Generative AI, training and inference, HPC, transcoding

Shared-core types timeshare a physical core for small apps: e2-micro, e2-small, and e2-medium (2 vCPUs in short bursts) and f1-micro and g1-small in N1.

Custom machine types

If no predefined type fits, you can choose the number of vCPUs and the amount of memory. Available on the N4, N4D, N4A, N2, N2D, E2, and N1 series, and on G2 among the accelerator-optimized ones.

When

Workloads that don't fit predefined types, that need a bit more CPU or memory without jumping to the next size, or software licensed per CPU.

Price

A 5% premium over the equivalent predefined type, both on demand and with commitments.

Extended memory

More memory per vCPU than the default maximum, for an extra charge. Available on N4, N4A, N4D, N2, N2D, and N1.

gcloud compute instances create app-1 --zone=us-central1-a \
  --custom-vm-type=n2 --custom-cpu=6 --custom-memory=40960

Each series has a minimum and maximum memory per vCPU; --custom-extensions requests extended memory.

Spot VMs

Excess Compute Engine capacity with discounts of up to 91% on many machine types, GPUs, TPUs, and Local SSDs. In exchange, Compute Engine can preempt them at any time. They are the latest version of preemptible VMs.

No minimum or maximum runtime, unless you limit it.
When preempted they are stopped (STOP, the default) or deleted (DELETE), depending on the termination action.
Notice: Compute Engine sets preempted=TRUE in the metadata. The notice duration can be 0 s (default) or 120 s; then comes the shutdown signal and a shutdown period of up to 30 seconds (best effort), when the shutdown script runs.
They can't live migrate or restart automatically after a host event, and they have no SLA.
If they are preempted in their first minute, they aren't billed. While stopped, VM hours aren't charged, but persistent disks are.
They don't support the A4X series or bare metal, and Free Tier credits don't apply. Their price can change up to once a day.

gcloud compute instances create batch-1 --zone=us-central1-a \
  --machine-type=n2-standard-8 --provisioning-model=SPOT \
  --instance-termination-action=STOP --preemption-notice-duration=120s \
  --metadata shutdown-script=SHUTDOWN_SCRIPT

Availability policy (host maintenance)

A VM's host goes through events: planned maintenance, emergent maintenance (usually with 7 to 14 days' notice), or hardware errors. The host maintenance policy decides what the VM does:

Setting	Options
Maintenance behavior	MIGRATE (default for most): live migration without shutting down, with a brief performance dip. TERMINATE: soft power-off, 60 s wait, and TERMINATED status
Automatic restart	On by default: after a host error, the VM usually restarts within about 3 minutes (up to 5.5). It doesn't apply if you shut it down from the OS
Host error detection time	Between 90 and 330 seconds before restarting an unresponsive VM
Local SSD recovery	0 to 168 hours trying to recover the data (one hour by default)

No live migration

Instances with GPUs or TPUs, bare metal, H4D, X4 and X5, most Confidential VMs, and certain Z3/Z4 configurations with lots of Titanium SSD. They stop during host events.

gcloud compute instances set-scheduling web-1 --zone=us-central1-a \
  --maintenance-policy=MIGRATE --restart-on-failure

The events show up in zone operations and System Events logs: compute.instances.migrateOnHostMaintenance or terminateOnHostMaintenance.

SSH access: keys in metadata

There are two ways to manage user access to Linux VMs: OS Login (recommended in most cases) or SSH keys in metadata, for teams that run their own directory service or can't use OS Login. If you connect from the console or with gcloud compute ssh, Compute Engine creates the keys for you.

Project metadata

An ssh-keys key valid for every VM in the project, except those that enable Block project-wide SSH keys.

Instance metadata

Keys valid only for that VM. Added at creation or later, and they can have an expiration time.

Risks of managing keys manually

Every user with keys in metadata has sudo.
You have to remove the keys of anyone who leaves the project by hand.
A mistyped command can wipe out all public keys in the project or on the VM.
Anyone who can modify project metadata can add keys for all its VMs.

OS Login

It links the Linux account to the Google identity and controls SSH with IAM, without creating or managing individual keys. It is the recommended way to manage many users across multiple VMs or projects.

Automatic lifecycle

The same Linux account on every VM in the project or organization.

IAM authorization

You can grant login without sudo. Removing the role revokes access; it is checked on every login.

2FA and certificates

Optional 2-step verification and SSH certificate authentication.

Auditing

Audit logs for connections. It can import Linux accounts from AD or LDAP.

Role	Access
`roles/compute.osLogin`	Login without sudo
`roles/compute.osAdminLogin`	Login with sudo
`roles/iam.serviceAccountUser`	Also needed if the VM runs as a service account

# For the whole project
gcloud compute project-info add-metadata --metadata enable-oslogin=TRUE
# For a single VM
gcloud compute instances create vm-1 --metadata enable-oslogin=TRUE ...
# 2FA (also requires enable-oslogin=TRUE)
--metadata enable-oslogin-2fa=TRUE

With OS Login enabled, the VM ignores SSH keys in metadata.
enable-oslogin=FALSE on the instance disables it even if the project has it set to TRUE.
The compute.requireOsLogin organization policy enforces it across the organization.
Usernames follow the USERNAME_DOMAIN_SUFFIX format; users from another organization get the ext_ prefix and service accounts sa_.

VM Manager

A suite of tools to manage the operating systems of large fleets of Windows and Linux VMs on Compute Engine:

Patch

On-demand and scheduled patches, plus patch compliance reporting.

OS inventory management

Collects operating system information. Feeds Cloud Asset Inventory's OS_INVENTORY content type.

OS policies

Install, remove, and auto-update software packages.

Enable the OS Config API. In the project, or in every project in a folder or organization.

Have the OS Config agent. It comes with many public images; check each VM.

Turn on the metadata. enable-osconfig=TRUE on the project or each VM. An organization policy can enforce it.

Exam scenarios

Situation	Answer	Why
Software licensed per vCPU needs 6 vCPUs and 40 GB of RAM	Custom machine type	Matches vCPUs and memory to the license.
Fault-tolerant batch job at the lowest cost	Spot VMs	Up to 91% off, but they can be preempted.
The VM must keep running during Google maintenance	MIGRATE maintenance policy	Live migration to another host.
A VM with GPUs gets a maintenance event	It stops (TERMINATE)	Instances with GPUs don't support live migration.
Manage SSH for 200 engineers with their Google accounts	OS Login with IAM roles	No manual key management; removing the role revokes access.
Give SSH access without sudo	roles/compute.osLogin	osAdminLogin grants sudo.
Patch 500 Linux and Windows VMs on a schedule	VM Manager (Patch)	On-demand and scheduled patching.
A small, low-traffic web server at the lowest cost	E2 (including shared-core)	Day-to-day computing at a lower cost.

Common exam traps

❓ Does a Spot VM have an SLA?

No. It is excluded from the Compute Engine SLA because it can be preempted at any time.

❓ What happens by default when a Spot VM is preempted?

It stops (STOP) and moves to TERMINATED. It is deleted only if the termination action is DELETE.

❓ Can a VM use OS Login and metadata SSH keys at the same time?

No. With OS Login enabled, the VM ignores keys in metadata.

❓ Can a VM with GPUs live migrate?

No. Instances with GPUs or TPUs stop during host events.

❓ Do custom machine types cost the same as predefined ones?

No. They carry a 5% premium, and extended memory costs extra.

❓ Which OS Login role grants sudo?

roles/compute.osAdminLogin. roles/compute.osLogin grants access without sudo.

❓ How long can a preempted Spot VM's shutdown last?

Up to 30 seconds, best effort, after the optional 120-second notice.

Did you get this topic?

Test what you just learned

A team of 150 developers needs SSH to Linux VMs across several projects. When someone leaves the company, their access must disappear immediately without touching the VMs, and only administrators should have sudo. What should you configure?

Ready to test "Compute Engine: creating and configuring instances"?

Original questions, each with a full explanation.

Start a mock exam

Next · Planning and implementing a cloud solutionDisks and managed instance groups Previous: Choosing a compute option