Setting up a cloud solution environment Study Guide — ACE

Setting Up a Cloud Solution Environment

This domain covers the foundational administrative tasks required before any workload runs on GCP: structuring resources, connecting billing, controlling identity and access, and configuring the command-line toolchain. It represents 18% of the Associate Cloud Engineer exam, making it one of the highest-weighted domains. Expect 8–11 questions testing your ability to select the correct IAM role, configure billing exports, create service accounts safely, or execute the right gcloud command — often in scenario form where one wrong word in the requirement changes the answer.

Resource Hierarchy: Organization, Folders, Projects

Concepts

GCP resources are organized in a strict four-level hierarchy: Organization → Folders → Projects → Resources. Policies applied at a higher level are inherited downward and cannot be overridden to grant less access — only to grant more access (the union of all applicable policies is effective).

Key facts the exam tests:

• A project is the minimum billing and quota boundary. You cannot have a resource that is not inside a project.
• A project has exactly one billing account attached, but a billing account can be linked to many projects.
• An organization node is automatically created when you set up Google Workspace or Cloud Identity. Without it, you can still create projects but you cannot create folders.
• Folders require an Organization node — you cannot create folders without one.
• Projects have three identifiers: Project Name (mutable, human-readable), Project ID (immutable, globally unique, set at creation), and Project Number (immutable, auto-assigned integer).
• Default project quota for new accounts: 10 projects per account (requestable increase).

IAM policy inheritance rule:

The effective policy at any resource is the union of all policies applied at or above it in the hierarchy.

Common Traps

• Folders do NOT require an Org node to exist in the exam stem — they do in real life. Know that the constraint is real.
• Removing a project from a billing account suspends resources but does not delete them immediately.
• The Project ID cannot be changed after creation. Exam distractors suggest editing it.
• Assigning a role at the Org level grants it on every project — a common over-privilege scenario the exam uses to identify the wrong answer.
• "Shutting down" a project starts a 30-day pending deletion period; resources are still recoverable during this window.

Worked Scenario

Requirement: A company has three departments (Finance, Engineering, Marketing). Each department must manage its own projects but must not affect other departments. Billing must be centralized.

Reasoning: Create an Organization node (requires Google Workspace/Cloud Identity). Create three Folders (one per department). Place department projects inside the respective folder. Assign departmental IAM roles at the folder level so they don't inherit permissions across departments. Attach all projects to a single billing account managed centrally. This is the canonical GCP landing zone pattern.

Billing Accounts, Budgets, Alerts, and Billing Exports

Concepts

A billing account is a GCP resource that tracks charges and links to a payment method. It lives at or above the project level and is not inside a project.

Key relationships:

• One billing account → many projects (no hard limit).
• One project → exactly one billing account at a time.
• You can move a project to a different billing account if you have billing.resourceAssociations.create on the target account.
• Billing accounts can be linked to an Organization but are not required to be — self-serve accounts often exist without an Org node.

Budgets and Alerts:

• Budgets are set on a billing account and can be scoped to all projects, specific projects, specific products, or labels.
• Budget amounts can be a fixed spend target or last month's spend (percentage-based).
• Alert thresholds are set as percentages (default: 50%, 90%, 100%); up to five thresholds per budget.
• Alerts are sent via email to Billing Account Admins and Billing Account Users by default.
• Budgets can also send notifications to a Pub/Sub topic, enabling automated cost-control actions (e.g., trigger Cloud Functions to disable billing).
• Budgets do NOT automatically cap or stop spending — they only alert. This is a critical exam trap.

Billing Export to BigQuery:

• Export must be enabled explicitly; it is not on by default.
• Exports land in a BigQuery dataset in a project you specify.
• Two export types: Standard usage cost (daily, detailed per-resource) and Detailed usage cost (includes resource-level data with labels; requires allowlisting).
• Pricing data export is a third type (publishes GCP pricing data, not your spend).
• Data is exported with a ~1 day lag and is append-only (historical data is not backfilled when you first enable it).
• You cannot export to Cloud Storage directly from the billing UI — use BigQuery, then export from BigQuery if needed.

Budget alert flow and billing export path.

Common Traps

• Budgets do NOT stop spending — they alert only. The exam frequently offers "set a budget to prevent overspending" as a distractor.
• Billing export is not retroactive — data before enabling the export is not available in BigQuery.
• Alerts go to Billing Account Admins and Users by default — not to Project Owners unless they also have those billing roles.
• A Pub/Sub-triggered function is the only automated way to truly stop billing (by disabling the billing account link on a project).
• You can set up multiple budgets on one billing account for different scopes.