Topic 1 of 10
Operating Compute Engine
Once VMs are deployed, section 3.1 of the exam guide asks you to operate them: connect remotely, view running instances, work with snapshots and images (create, view, delete, and schedule snapshots), and attach GPUs and TPUs. Creating instances and MIGs is in domain D2.
Contents
Connecting to a Linux VM
| Method | How | SSH key |
|---|---|---|
| SSH-in-browser | VM instances page → SSH button | Compute Engine creates an ephemeral key |
| gcloud | gcloud compute ssh VM_NAME --zone=ZONE, also from Cloud Shell | Compute Engine creates a persistent key |
| OpenSSH client or PuTTY | ssh -i PRIVATE_KEY USERNAME@EXTERNAL_IP | You add the key to the VM yourself |
- These methods are for VMs with external IPs; for internal-only VMs use IAP (next section) or other connectivity options.
- With OS Login, the username comes from your Google profile; with metadata keys, it is the one you set when creating the key.
- Whoever connects can use the IAM permissions of the service account attached to the VM.
VMs without external IPs: IAP TCP forwarding
Identity-Aware Proxy (IAP) TCP forwarding creates an encrypted tunnel to forward SSH, RDP, or other traffic to VMs that have no external IP or don't allow direct internet access, with fine-grained control of who can open tunnels and to which VMs.
Firewall rule: Allow ingress from 35.235.240.0/20 (IAP's TCP range; for IPv6, 2600:2d00:1:7::/64) to the needed ports, e.g. 22 and 3389.
Permissions: Grant IAP-secured Tunnel User (roles/iap.tunnelResourceAccessor) on the project or on specific VMs.
Connect: gcloud compute ssh VM_NAME --tunnel-through-iap, or gcloud compute start-iap-tunnel VM_NAME 3389 --local-host-port=localhost:PORT for RDP or other ports.
gcloud compute firewall-rules create allow-ssh-ingress-from-iap \ --direction=INGRESS --action=allow --rules=tcp:22 --source-ranges=35.235.240.0/20
The default-allow-ssh and default-allow-rdp rules allow SSH and RDP from any IP, not only IAP: Google suggests disabling or deleting them if you want to prevent direct access.
Connecting to a Windows VM
- You use an RDP client against TCP port 3389.
- First you create a Windows account and password on the instance; if you forget the password, you can reset it.
- If the VM has no external IP, RDP goes through an IAP tunnel with
start-iap-tunnel.
Viewing running instances
In the console, the VM instances page shows every VM with its zone, IP, and status. With gcloud:
gcloud compute instances list gcloud compute instances list --filter="status=RUNNING" --zones=us-central1-a gcloud compute instances list --sort-by=name --limit=20 gcloud compute instances describe VM_NAME --zone=us-central1-a
--filterapplies a Boolean expression;--zoneslimits zones;--sort-byand--limitsort and trim.- Name arguments and
--regexpare deprecated: use--filter="name=(…)"or--filter="name~'REGEXP'". --formatchanges the output (table, JSON, YAML…).
Snapshots
A snapshot captures the contents of one disk at a point in time, even if it is attached to a running VM. To back up a whole VM or several disks at once, use a machine image.
| Type | What for | Redundancy | Deleted with the disk? | Schedulable? |
|---|---|---|---|---|
| Standard | Geo-redundant backup against local, zonal, and regional outages | One or more regions | No | Yes |
| Archive | The same, but cheaper for keeping months or years (compliance, audit) | One or more regions | No | No |
| Instant | Very fast restore after human error or corruption | Only the disk's zone or region | Yes | No |
- They are incremental: each one stores only what changed since the previous one, so you aren't billed for duplicate data.
- By default they are global resources: a disk created from a snapshot can be in any region or project. You can restrict regions and share across projects.
- To use the data you restore it: create a new disk from the snapshot, with immediate maximum performance. Restoring doesn't overwrite the original disk.
- Recovery time: instant < standard < archive.
gcloud compute snapshots create web-snap-01 --source-disk=web-disk --source-disk-zone=us-central1-a gcloud compute snapshots list gcloud compute snapshots delete web-snap-01
Google recommends gcloud compute snapshots create over gcloud compute disks snapshot because it supports more features, such as creating the snapshot in another project.
Scheduling snapshots
A snapshot schedule is a resource policy you create once and attach to one or more disks.
gcloud compute resource-policies create snapshot-schedule daily-backup \ --region=us-central1 --max-retention-days=14 \ --start-time=04:00 --daily-schedule \ --on-source-disk-delete=keep-auto-snapshots gcloud compute disks add-resource-policies web-disk \ --resource-policies=daily-backup --zone=us-central1-a
- Frequency:
--hourly-schedule,--daily-schedule, or--weekly-schedule(use only one). --max-retention-days: how many days automatic snapshots are kept.--start-timeis in UTC.--on-source-disk-delete:keep-auto-snapshotsby default (keep them forever if the disk is deleted) orapply-retention-policy(keep applying retention).- Schedules only create standard snapshots.
Images
Public
Maintained by Google, open-source communities, and vendors. Every project has access. Updated regularly or when a critical CVE appears.
Custom
Only for your project (they can be shared). Created from boot disks, other images, or snapshots, or by importing virtual disks.
gcloud compute images list gcloud compute images create web-image-v2 --source-disk=web-disk \ --source-disk-zone=us-central1-a --family=web-images gcloud compute images create web-image-v3 --source-snapshot=web-snap-01 gcloud compute images delete web-image-v1
- By default you can't create an image from a running instance;
--forceallows it, at the risk of inconsistencies. --storage-locationchooses where the image is stored.- A custom image lets you create VMs already configured with the apps you need, without starting from a public image.
- To migrate many VMs to Compute Engine, Google recommends the VM migration service instead of importing disk by disk.
Image families and states
An image family always points to the latest version that isn't deprecated (for example, debian-13 in debian-cloud). If the latest image fails, you deprecate it and the family rolls back to the previous one.
| State | Effect |
|---|---|
| DEPRECATED | No longer the latest; it can be used, but users get a warning at launch |
| OBSOLETE | Shouldn't be used: creating an instance from it fails. Useful for archiving and mounting as a non-boot disk |
| DELETED | Deleted or marked for deletion; can't be launched |
You change it with gcloud compute images deprecate, which can also schedule future states (--obsolete-in, --obsolete-on). Deprecated and deleted images are hidden by default; you see them with --show-deprecated.
Attaching GPUs and TPUs
GPUs
- On the N1 series (except shared-core) you choose GPU model and count (T4, V100, P4) with
--accelerator type=…,count=…. - On accelerator-optimized series (A and G) the GPU comes with the machine type.
- You must install GPU drivers and check the region's GPU quota.
- VMs with GPUs don't support live migration: they stop during host events.
- Role to create them: Compute Instance Admin (v1).
TPUs
- Managed with Compute Engine resources.
- TPU VM: a VM connected directly to TPU hardware; the same as a single-host slice.
- Multi-host slice: several TPU VMs joined by a high-speed interconnect; created as a MIG with an accelerator topology.
- The legacy Cloud TPU API is deprecated.
gcloud compute instances create gpu-vm --zone=us-central1-a \ --machine-type=n1-standard-8 --accelerator=type=nvidia-tesla-t4,count=1 \ --maintenance-policy=TERMINATE --image-family=debian-13 --image-project=debian-cloud
Exam scenarios
| Situation | Answer | Why |
|---|---|---|
| SSH into a VM with no external IP and no bastion | IAP TCP forwarding (gcloud compute ssh --tunnel-through-iap) | An encrypted tunnel through IAP. |
| Administrators should only open IAP tunnels to certain VMs | IAP-secured Tunnel User on those VMs | Fine-grained control of who connects and where. |
| A daily disk backup with 14-day retention | Snapshot schedule with max-retention-days 14 | Automatic snapshots with automatic deletion. |
| Keep disk backups for years for auditing at the lowest cost | Archive snapshots | Cheaper and meant for long retention. |
| Recover from a human error on the same disk in seconds | Instant snapshot | The best recovery time. |
| Create many identical, preconfigured VMs | Custom image (ideally in a family) | Boots VMs with the apps already installed. |
| A new image causes problems and you want the family to roll back | Mark the new one as DEPRECATED | The family points to the latest non-deprecated image. |
| Back up a whole VM with several disks | Machine image | Snapshots cover a single disk. |
Common exam traps
❓ Which range must the firewall allow for IAP TCP forwarding?
35.235.240.0/20 (and 2600:2d00:1:7::/64 for IPv6).
❓ Does an instant snapshot survive if the disk is deleted?
No. Instant snapshots are deleted with the disk; standard and archive snapshots aren't.
❓ Is each snapshot a full copy of the disk?
No. They are incremental: they store only changes since the previous one.
❓ Can a snapshot back up a VM with several disks?
No. A snapshot covers one disk; for the whole VM use a machine image.
❓ Can you launch a VM from an image in the OBSOLETE state?
No, it fails. DEPRECATED still allows it, with a warning.
❓ Can you create an image from a running VM?
Not by default; you need --force, and it is better to stop the VM to avoid inconsistencies.
Did you get this topic?
Test what you just learned
Production VMs have no external IPs. On-call engineers need SSH to troubleshoot, without a bastion or VPN, and access must be limited by IAM. What should you configure?
Ready to test "Operating Compute Engine"?
Original questions, each with a full explanation.
Start a mock exam