Skip to content

Google Cloud

Google Cloud (GCP) is a strong choice for data-heavy and AI-native work — BigQuery for analytics at scale and Vertex AI for the ML platform. This sheet covers the services data scientists and ML engineers actually use, with gcloud/gsutil commands you can run today.

Table of Contents

Installation / Setup

pip install google-cloud-sdk          # or the official installer
gcloud auth login                     # browser sign-in
gcloud config set project my-project  # every command needs a project
gcloud config set compute/zone us-central1-a
gcloud projects list

Project is the top-level container for all GCP resources (billing + IAM boundary). Create one per team/environment.

Core Services

Service Category What it does Typical AI/data use
Cloud Storage (GCS) Storage Object storage, multi-regional options Datasets, models, artifacts, backups
Compute Engine Compute VMs incl. GPU (T4/A100/H100 via accelerators) Training boxes, custom servers
BigQuery Data warehouse Serverless SQL analytics at exabyte scale Querying large datasets, feature stores
Vertex AI ML platform Notebooks, training, endpoints, model registry Managed training & serving
Cloud Functions Serverless Event-driven code GCS-triggered preprocessing
Cloud SQL Databases Managed Postgres/MySQL App + metadata storage
Firestore NoSQL Document store Chat history, user state
GKE Containers Managed Kubernetes Deploy model services at scale
Vertex AI Gemini API GenAI Managed Gemini models + embeddings LLM APIs without owning infra
IAM Security Roles, service accounts, policies All access control
Secret Manager Secrets Encrypted secret storage API keys, credentials
Cloud Logging / Monitoring Observability Logs, metrics, dashboards Monitoring jobs and services

Common Operations

Cloud Storage

gsutil cp model.pt gs://my-bucket/models/
gsutil rsync -r ./dataset gs://my-bucket/dataset/     # incremental mirror
gsutil ls gs://my-bucket/models/
gsutil cp gs://my-bucket/models/model.pt ./
gsutil rm -r gs://my-bucket/tmp/

# Signed URL — temporary access without public bucket
gsutil signurl -d 1h sa-key.json gs://my-bucket/models/model.pt

Compute Engine

gcloud compute instances create train-vm \
  --zone us-central1-a \
  --machine-type n1-standard-8 \
  --accelerator type=nvidia-tesla-t4,count=1 \
  --maintenance-policy TERMINATE \
  --image-family pytorch-2-4-gpu --image-project deeplearning-platform-release \
  --preemptible                       # up to 80% cheaper; killed at any time

gcloud compute instances stop train-vm --zone us-central1-a
gcloud compute instances delete train-vm --zone us-central1-a --quiet

BigQuery

-- Query a public or project dataset with standard SQL
SELECT event_date, COUNT(*) AS events
FROM `my-project.analytics.events`
WHERE event_date >= '2026-09-01'
GROUP BY event_date
ORDER BY event_date;

bq query --use_legacy_sql=false 'SELECT COUNT(*) FROM `my-project.analytics.events`'
bq load --source_format=CSV my-project:analytics.events gs://my-bucket/events.csv

Vertex AI

gcloud ai endpoints create --region us-central1 --display-name my-endpoint
gcloud ai models upload --region us-central1 --display-name my-model \
  --container-image-uri us-docker.pkg.dev/vertex-ai/prediction/sklearn-cpu.1-1:latest \
  --artifact-uri gs://my-bucket/models/
gcloud ai endpoints deploy-model ...   # see docs for full deploy flags

Practical Examples

Example 1 — Query a large dataset with BigQuery, no ETL

-- Analyze model request logs stored in BigQuery (or query public datasets)
SELECT model_id,
       AVG(latency_ms) AS avg_latency,
       COUNTIF(status_code = 429) / COUNT(*) AS rate_limit_rate
FROM `my-project.ml_logs.requests`
WHERE date >= '2026-08-01'
GROUP BY model_id;

BigQuery separates storage from compute: you can query terabytes without loading them into a VM — the classic ELT pattern for data science.

Example 2 — GCS-triggered preprocessing with Cloud Functions

# main.py — deployed as a Cloud Function triggered by object finalize events
def preprocess(event, context):
    bucket = event["bucket"]
    name = event["name"]
    print(f"Processing gs://{bucket}/{name}")
    # ... read via google-cloud-storage, clean, write to gs://my-bucket/clean/

gcloud functions deploy preprocess \
  --runtime python312 --trigger-bucket my-bucket --region us-central1

Example 3 — Gemini API (Vertex AI)

import vertexai
from vertexai.generative_models import GenerativeModel

vertexai.init(project="my-project", location="us-central1")
model = GenerativeModel("gemini-2.0-flash")
resp = model.generate_content("Explain retrieval-augmented generation in one sentence.")
print(resp.text)

Common Patterns

Storage layout

gs://my-bucket/
  raw/       # untouched source
  curated/   # validated data
  features/  # feature stores / datasets for training
  models/    # artifacts + metadata

Service accounts for automation

# Machine identity for CI or VMs — never a human's credentials
gcloud iam service-accounts create ml-ci --display-name "ML CI"
gcloud projects add-iam-policy-binding my-project \
  --member "serviceAccount:ml-ci@my-project.iam.gserviceaccount.com" \
  --role "roles/storage.objectViewer"
gcloud iam service-accounts keys create ci-key.json --iam-account ml-ci@my-project.iam.gserviceaccount.com

Secret Manager

gcloud secrets create gemini-key --data-file=key.txt
gcloud secrets versions access latest --secret=gemini-key
# Access from code with the Secret Manager SDK, never in the repo

Best Practices

  • One project per team/environment — clean IAM and billing boundaries; use folders for orgs.
  • Use service accounts, not personal keys — grant scoped roles (roles/storage.objectViewer, not Owner).
  • Prefer preemptible/spot VMs for experiments — huge savings for resumable training; use checkpoints.
  • Leverage BigQuery instead of loading CSVs into pandas — query first, materialize only what you need.
  • Keep buckets private — signed URLs for sharing; avoid allUsers/allAuthenticatedUsers.
  • Use gsutil rsync for dataset syncs — resumable and incremental over cp -r.
  • Cap training runtimes — Vertex AI custom jobs support max runtime to avoid runaway cost.

Common Mistakes

Mistake Consequence Correct approach
Bucket with allUsers read access Public data leak Private buckets + signed URLs / IAM
Using a personal account in automation Permission churn when the human leaves Service account with scoped roles
Leaving GPU VMs running 24/7 billing for idle machines Preemptible for experiments; auto-stop scripts
Loading 10 GB CSV into pandas instead of BigQuery Slow, expensive, wasteful Push-down to BigQuery SQL
No project-level budget alert Surprise bill Budgets & alerts at 50/80/100%
Committing service-account JSON keys to Git Full project access leaked Secret Manager; rotate and revoke if leaked

Troubleshooting

Symptom Cause Fix
PERMISSION_DENIED IAM role missing on the resource gcloud projects get-iam-policy; add scoped role
BILLING_NOT_ENABLED Project lacks billing account Link billing in console; check gcloud billing projects describe
VM stuck PROVISIONING Zone capacity / quota gcloud compute regions describe us-central1 for GPU quota; change zone
BigQuery Resources exceeded Query too big for slot capacity Add WHERE pushdown, use partitioning/clustering
ExpiredToken OAuth creds stale gcloud auth login / gcloud auth application-default login
GCS slow download Single-stream, far region gsutil -m cp parallel; same-region bucket

Official Documentation

Last Updated

2026-09-07 — Initial version.

Found a mistake or something outdated? Open an issue or submit a pull request — see CONTRIBUTING.md.