Google Cloud Platform
Beginner 14 min read Google Cloud Platform

Compute Engine & IAM

Compute Engine is GCP's virtual machine service; IAM is how you authorize every action. Learn machine types, images and zones, instance groups for scaling, service accounts for machine identity, and how IAM roles and VPC firewall rules keep access least-privileged.

Compute EngineVMmachine typeimagezoneinstance groupservice accountIAM rolefirewall ruleleast privilege
Prerequisites: GCP Platform Overview
Introduction

What is this?

Compute Engine is GCP's virtual machine service. An instance is launched from an image (an OS template) and sized with a machine type (for example e2-micro: 2 vCPU, 1 GB RAM), placed in a zone and a VPC subnet, and secured with firewall rules and IAM. Instance groups — managed and unmanaged — treat a set of VMs as one unit for scaling and updates. IAM is the separate identity layer: users and groups represent humans, service accounts represent machines, and roles bundle the permissions each identity may use. VPC firewall rules filter the actual traffic at the network layer.

Motivation

Why do you need it?

  • Compute Engine is the compute workhorse of GCP — most production workloads, managed instance groups and GKE nodes are VMs under the hood.
  • Machine types, zones and instance groups are daily DevOps decisions that affect cost, latency and availability.
  • Service accounts are how VMs safely authenticate to Google APIs without keys on disk.
  • IAM mistakes (over-broad roles, shared keys, blanket owner) cause most real GCP security incidents.
  • Firewall rules are the first network defense layer for everything you deploy.
Think about it

Mental model

Imagine

A company fleet garage

Think of

Compute Engine and IAM

The garage rents you cars (VMs): you pick a model (machine type), a standard engine (image), and a parking bay (zone) in a specific compound (VPC). The gate (firewall rules) decides which cars may leave the lot. IAM is the badge system: your badge (user) opens certain lots, a valet card (service account) lets the car itself drive to specific destinations, and fleet passes (roles) bundle what each driver may do — least privilege means the badge only opens the lots you actually need.

Mechanics

How it works

  • You create an instance by choosing a machine type, image, zone, subnet and firewall tags; Compute Engine provisions a VM from pooled hardware in seconds.
  • The instance boots the image's OS; startup scripts can run at first boot to install packages and configure the machine.
  • Managed instance groups enforce a target instance count, autoscale on metrics, and use instance templates for rolling updates.
  • IAM authenticates every action: your CLI or Console call is checked against the roles attached to your user, group or service account.
  • VPC firewall rules filter traffic by network, target tags and IP ranges, while the service account controls which Google APIs the VM may call.

Launching a Compute Engine instance and connecting over SSH.

Pick a machine type and image
Choose a zone
Service account + tags
Create the instance
IAM checks each call
SSH from your laptop
Reference

Key commands

gcloud compute instances create my-vm --zone=us-central1-a --machine-type=e2-micro

Create a VM with an explicit zone and machine type.

gcloud compute instances list

List every VM in the project with its zone, type and status.

gcloud compute ssh my-vm --zone=us-central1-a

Open an SSH session; gcloud manages the key pair for you.

gcloud compute instance-groups list

List managed and unmanaged instance groups in the project.

gcloud iam service-accounts list

List the service accounts available as machine identities.

gcloud projects get-iam-policy my-project

Dump the full IAM role bindings for a project.

Hands-on

Examples

Create a Compute Engine VM and connect over SSH

Create a Compute Engine VM and connect over SSH
$ gcloud compute instances create my-vm \
    --zone=us-central1-a \
    --machine-type=e2-micro \
    --image-family=ubuntu-2204-lts \
    --image-project=ubuntu-os-cloud \
    --tags=http-server
Created [https://www.googleapis.com/compute/v1/projects/my-project/zones/us-central1-a/instances/my-vm].
NAME    ZONE           MACHINE_TYPE  PREEMPTIBLE  INTERNAL_IP  EXTERNAL_IP   STATUS
my-vm   us-central1-a  e2-micro                    10.128.0.2   34.122.5.10   RUNNING
 
$ gcloud compute ssh my-vm --zone=us-central1-a
Welcome to Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-91-generic x86_64)

gcloud compute instances create provisions the VM with a machine type, an Ubuntu 22.04 image, a zone and a network tag. gcloud compute ssh generates and injects a temporary SSH key pair into the project metadata and connects — the service manages keys for you instead of you storing a .pem file.

Real world

In production

  • Run stateless web tiers in a managed instance group behind a load balancer, autoscaling on CPU or request count.
  • Attach a service account to each VM so it can reach GCS, BigQuery or Pub/Sub without keys on disk.
  • Use spot VMs for batch jobs and preemptible-tolerant workloads to cut compute cost.
  • Build repeatable VMs with startup scripts and instance templates, and replace instead of patch.
  • Provide access into private VMs through IAP (Identity-Aware Proxy) tunnels instead of public SSH exposure.
Guidelines

Best practices

  • Follow least privilege in IAM: grant the minimum role on the minimum resource, and prefer predefined roles.
  • Attach service accounts to VMs instead of downloading and storing service account keys.
  • Use firewall rules with target tags so rules apply to groups of instances, not ad-hoc IP lists.
  • Right-size instances: start small, watch utilization, and scale out before scaling up.
  • Enable MFA on admin identities and use IAP for SSH instead of opening port 22 to the internet.
Watch out

Common mistakes

  • Opening firewall port 22 to 0.0.0.0/0 and then dealing with brute-force login attempts.
  • Downloading service account JSON keys and committing them into the repository.
  • Using the organization-level owner role for daily work because it is simpler than configuring IAM.
  • Choosing an oversized machine type 'to be safe' and paying for idle vCPUs.
  • Creating one VM per environment instead of using a managed instance group.
Root cause analysis

Common issues

Error
Permission denied (publickey)
Root cause

The OS user is wrong, the key does not match the project metadata, or the key permissions are too open.

Fix

Use gcloud compute ssh my-vm, which manages the key automatically, and confirm the OS user for the image (ubuntu, debian, etc.).

Error
Connection timed out on port 22
Root cause

The firewall rule blocks your IP, or the VM has no external IP or route.

Fix

Add a firewall rule allowing tcp:22 from your IP, confirm an external IP is assigned, and verify the subnet has a route to the internet.

Error
PERMISSION_DENIED when creating an instance
Root cause

The IAM identity lacks compute.instances.create or compute.instances.setServiceAccount.

Fix

Grant the roles/compute.instanceAdmin role to the identity, or use an identity with broader permissions and retry.

When things break

Debugging tips

  • Permission denied (publickey) almost always means wrong OS user, wrong key, or the project lacks your SSH key metadata.
  • Check the firewall rule allows your source IP on port 22 before blaming the key.
  • Use gcloud compute instances describe to read status, machine type and attached service accounts.
  • Use gcloud compute instances get-serial-port-output to read boot logs when SSH is not reachable.
  • Verify IAM with gcloud auth list and gcloud projects get-iam-policy before debugging a denied API call.
Interviews

Interview checkpoint

Practice

Hands-on lab

Inspect Local Identity and Compute Like a VM
25 min · beginner
In progress
Objectives
  • Identify the current user, groups and UID the way a VM identity works
  • Inspect the OS image and kernel as a startup script would
  • Enumerate local accounts the way IAM users are listed
  • Measure compute capacity for right-sizing decisions

Inspect Local Identity and Compute Like a VM

25 min · beginner

0/6 steps
0%
sandbox · Linux sandbox
$
Try these commands
Test yourself

Quick quiz

0/3
1

Which identity is designed for a machine or application to call Google APIs?

2

IAM roles granted at the project level apply to all resources in that project.

3

Your new VM is RUNNING but you cannot reach it over SSH. What should you check first?

Quick reference

Cheat sheet

Compute essentials
Machine typee2-micro, n2-standard-2 — CPU/RAM sizing
ImageOS template, e.g. ubuntu-2204-lts
ZoneIsolated data center placement
Instance groupScale and update VMs as one unit
Startup scriptRuns at first boot
IAM building blocks
User / groupHuman identities
Service accountMachine identity with short-lived credentials
RoleBundle of permissions, e.g. roles/compute.admin
Policy bindingWho gets which role on what resource
Firewall ruleNetwork-layer traffic filter by tag and port
Go deeper

Official documentation

Compute Engine Instances
docs
Machine Families Resource Guide
docs
About Instance Groups
docs
IAM Overview
docs
Service Accounts
docs