Google Cloud Associate Cloud Engineer Course [2025] - Pass the Exam!

Key Takeaways

Hey, this is Andrew Brown bringing you another free certification course. And this time it's the Google Cloud Associate Engineer, also known as the ACE. And the way we're going to get certified is as always going through lecture content, hands-on labs. And as always, I provide you a free practice exam uh so that you can uh do your best in the exam, pass that exam, get that certification, put on your resume to get that job you've been looking for. Um, I do want to just remind you that if you want to support more of these free courses, you can purchase the additional paid materials which includes cheat sheets, downloadable lecture slides, flashcards uh, and more which will just help you have a better chance of passing in the end and again supports uh, this kind of content here. If you don't know me, I've taught a lot of courses here. I've taught Adabus, Azure, GCP, Kubernetes, Terraform, security, DevOps, everything. You name it, I've taught it in the cloud. Uh, so you're in good hands and let's go jump into it. Okay. [Music] Hey, it's Andrew Brown and we're taking a look here at the Google Cloud Associate Cloud Engineer, which is a conceptbased certification, meaning it's more focused on the conceptuals than the practical. Um, you're going to need to know the four core services. So, STA, storage, database, computing, networking, cloudnative workloads has a large emphasis in this course. Um I think it's just because Kubernetes comes from Google. Uh Google has a very good offering for running Kubernetes workloads through GKE and so they want you to know it. Um we have automation, configuration, patching, securing workloads. So everything that you'd expect from DevOps, uh governance, security, identity, observability. I wouldn't say it's security heavy, but you need to know uh the general best practices for security. Um and so you know that is good there. Google does not have course codes, but um often this course is called the GCPA. So if you hear Google ACE or GCP, they're talking about the certification. I would not say this um certification is hard, but I would just say that it requires a significant amount of study time because you are basically setting yourself up with all the fundamentals that you're going to need to do all of the other uh certifications. And this is a core path. You really cannot skip um this certification. Um, but a lot of folks kind of do in the sense that they do study for the ACE, but they end up going for the pro. As some folks don't care about getting the ACE, they want to get the pro certification. But we'll talk about that as we work through this. Okay. So, who's a certification for? Well, if you are going to be working in Google, so that means you know utilizing as your primary workload, then you absolutely want this certification along with the digital leader. It's must-have certifications. If you enjoy working and uh uh working with architectures and trying to understand how multiple services need to work together, you're going to like the certification. Um or if you're going for the pro, so basically 80% of the content that's in the certification is going to be needed for the pro. The pro focuses on refining that knowledge through business case studies and going deeper in certain areas, but the bulk of the knowledge that you need is in the certification. That's why I say uh some folks skip the ACE. I don't think you should. You should sit the exam, but some folks skip the ACE because they have to get their pro and they know that there's so much overlap um and and they might score the pros a bit higher. But I'm going to just tell you right now, you should really make sure you get your uh associate um because it's going to make the pro certification a lot easier to do. I really don't recommend um skipping it. And absolutely you should get your um fundamentals uh the sorry cloud digital leader prior to the associate um because there's just content in there that builds off of into the associate level into the professional. Do note that there are other um I said earlier there's only basically one um associate level and there basically is it's just the uh this cloud engineer but they have introduced the Google Workspace admin data practitioner. Those are kind of like specialized associates. They're not really the core path, but you can do them if you need to. Generative AI is also um new and it's okay. And I believe that security operations is a new one which is a little bit different from the cloud security one which I think is I mean this one this one is basically general security. Maybe security operations is like dev secc ops. I'm not sure. But the point is that they have a lot of professionals. One thing about Google certifications is the professionals aren't as hard as other providers. um they feel very well sized um in terms of the work. So that is one good thing. I do need to tell you that certifications do not validate programming, technical diagramming, code management and many other technical skills that are required for obtaining technical roles. So understand that you need to gain those skills and you will not be tested on them on the certifications, but I will fill that information in as as best I can um throughout this course for you. Okay. How long does it take to pass um the certification? Well, I would probably put it at 30 hours, maybe even in 40 hours if you're a beginner. If you have your GCP CDL, um, you know, and you really should have that before you attempt the the GCPAS or study for it. Um, it's still going to take you 30 hours if you're experienced. Um, and you have knowledge of GCP or with another provider and you just have a strong background technology, you can clear this in 12 hours. I would set the study time for 15 hours. So, a little bit higher than my other courses just because this associate is packed where other providers will break them up into three or four courses. It's literally they just have the one course. Um, so there's definitely more time lecture and lab side like so I would put more time into that than practice exams, but it is recommended that you study one to two hours a day for 14 days. That's basically the most optimal way to study. Um, so what is it going to take to pass? So, you're going to watch the lecture videos, you're going to do the hands-on labs and follow along with your own account, do the paid online practice exams, and um if you sign up at Exam Pro, we do have a full free practice exam. No credit card required to get you started. We're the only provider that does full free practice exams. We're super generous that way, but it is very hard to pass GCPs without practice exams. So, make sure that you do acquire them, whether they're with us or with somebody else. Um, one thing I do need to emphasize is that you really want to try the hands-on labs as much as you can with Google. Their their documentation is um, I would say very incomplete and out ofd. And this makes it very challenging to know what actually works. And throughout this course, I had to stumble through and figure things out. Even though I've used Google before, um, you just have to stumble through and validate things. So, it's extremely important that you do uh the hands-on and I gave you a bunch of hands-on in this course. Where do you take the exam? Well, in person or at the convenience of your own home. Most people doing it online these days. And Google uses Criterion. Um, and so Web Assessor is the tool that Criterion uses. So, if you see web assessor, it's basically Criterion or vice versa. I'm not exactly sure I understand the relationship, but um I just know that when you look up web accessor, it links back to Criterion. Google said prior that they were going to switch out and use something other than Criterion, but they've not done so. So, I guess they're staying with them as a provider where other folks use um Pearson View. Um Pearson Views has been very popular, but Google sticks with Criterion, which is totally fine. These exams are procured. That means there's a supervisor, a person who monitors students during the examination. So, when you're there, make sure you have a nice clean desk and noises in the background, etc. be ready to have your identification and maybe even to show what your room looks like to make sure um you know you can sit the exam. Okay, let's take a look at the content outline. So we have 23% setting up a cloud solution environment which is just basically uh governance like how do you set up projects and folders and um organizational policies and billing. A lot of the stuff I covered in the GCP uh CDL the cloud digital leader. So if if it feels a bit light here, it's because my expectation is that you went and did did that one first. If you didn't, then go look at that content because I didn't carry it all over into this course because I didn't want to make it bloated. Okay? So just consider that uh planning implementing a cloud solution. So this is understanding the core services, we ensuring successful operation of cloud solutions, configuring access and security. But you know this doesn't really help you understand what's inside the core. So there are subdomains under this stuff. Um but I would say um which it really doesn't show from this list this the summary here but Kubernetes is definitely something that you're going to want to have a base knowledge in like the the found like the a primer on it. So we are going to include a primer of Kubernetes here just because again Google really wants to promote cloudnative workloads here. Each domain has its own weight that determines how many questions are in that domain that show up. Um but let's continue on here. uh to pass it's 70%. They don't necessarily say that um anywhere in the FAQs, but if you take the exam, you know it's 70%. We say around because you technically could fail with a 70%. So try to always aim a bit higher. This just has to do with how many questions you get because there could be an odd number and how they scale and scale and score things. So, you know, make sure that you're aiming for 80% at the very least. Uh but you can get exactly 70% and technically fail. There are 50 to 60 questions. This is what I mean when I say there's a range of questions, but there's 50 to 60 questions. You can get about 18 wrong. There's no penalty for wrong questions. Formatic questions, multiple choice, multiple answer. So, you know, pretty straightforward. The duration is two hours. You get a lot of time on this exam. Considerable amount compared to other ones. And this is why I say it's easy because you got two minutes per question. Um, so, you know, it's not it's not like you're super rushed. So, two hours is 120 minutes. Your seat time is 150 minutes. See time is the time you need to allocate for time to review the instructions, show the online proctor workspace, read and accept the NDAs, complete the exam, provide feedback at the end. Um it is stressful checking in especially for online exams checking in. So make sure 30 minutes to 45 minutes early um just so that you don't have any problems and you don't uh you know waste your money. Okay, this uh this exam guide is or the exam is valid for uh 3 years before reertification. Reertification is a bit different. It seems like they have a separate uh exam and the scope of the the materials is less, but you could still technically use this course to brush up on it, but it the process is a little bit different. Um I do want to point out that uh you know cloud certifications expect you to already have foundational knowledge and technical skills like programming scripting SQL IT networking Linux and Windows project management developer tools app dev skills compile algorithms and more. If you do not have that knowledge and you feel that you're lacking it check out free coamp their large catalog um or you can get a subscription on exam pro because I do make uh other materials that go along with it. I do need to point out GCP itself does not care about certifications for hiring for their own technical role. Certifications serve as a structured way of learning from a goalpost. But one thing that's really interesting is that if you do work at Google, I can't say this with other providers, but if you do work with Google, they really want you to get the pro. Okay? So, not during the hiring process, but after you're hired, they're going to want you to go for your pro. Um, so, uh, but just consider during the hiring process, they're not going to care if you already have it. Okay? um understand there's about 250 to 500 hours of additional work outside of certifications that um you know you need to have. So that's why my courses are are very long is because I'm always cramming in all these additional things on the side to help you have practical knowledge. Uh but that's our general overview for the GCP. And there you go. [Music] All right, let's take a look here at the exam guide so we have a good idea what's going on. And as I said over here, the renewal exam information is a little bit different and they have a different exam guide for that, but you can pretty much use the same materials and you'll be good in good shape. But let's zoom in here and take a look. So, um, they don't tell you a whole lot on the top here, but um, that's fine. We can work our way through here. And I just want to show you that the interior of these things, it some of these make sense and some of these don't align. So, you have to, um, be be careful and look at what you need to study for. So, setting up a cloud environment, creating resource hierarchies, organizational policies, um, IM roles, cloud identity, enabling APIs with projects. So, we got a lot of stuff here. I'm not sure if we did Google Cloud, Gemini Cloud Assist with analy analyzing resources. Um, to be honest, at at least at this time when I'm recording it, I'm not finding Gemini Cloud to be working very well. Um, I did try in a few videos and you'll see that it's uh spectacularly fails in multiple areas, but I think that has to do with the lack of documentation that Google currently has. Um, I I know they have a platform like called Skilluer or something or Skill Boost where they have a lot of labs and that's for learning and so I feel like a lot of the knowledge is locked up there which is bizarre because they really should push it out to their documentation but that's just how it is. Going over to managing building configuration. So we have this stuff here. Um I did all this in the digital leader and if you do not find that content in this course and it's over there but we'll do our best to carry it over as long as we're not bloating up the course here. Planning implementing a cloud solution. So this is where you need to know how to use basically everything. So uh compute engine uh GKE cloud run cloud run functions K native serving um compute engine which we said over there already but like oh yeah all the storage methods. Yep. um autoscaling OS log and VM manager basically a huge collection of stuff. So there's that then over here basically something very similar where we're saying planning implementing storage solutions. So now they're just talking about data and storage right and then we have networking. So again this is all the four core stuff under planning implementing a cloud solution and yeah there's more stuff here. So yeah we do include that. Let's go over to ensuring successful operation. And so here you'll notice a lot of talk about containers and Kubernetes. So this is where I had to bring in our Kubernetes content. We already had some content for it and so I rolled it into this course, but I chose just the right amount. So you're we're not going fully into Kubernetes, but just enough that uh you'll know what is going on here. Okay. Uh then we have managing storage data solutions. So, a bit of a repeat up here, but just talking again about um possible storage solutions that we can uh utilize in Google Cloud. And then again, repeat of networking. I don't know why they made these two separate sections because there's so much overlap between the two, but that's totally fine. Then we have configuring configuring access and security. So, IM policies, IM ROS um and very basic stuff. So, security here is very very light and I think the reason why is they have specialized certifications for those two. We probably do more hands-on than we actually have to do for this course. But I think it's important because again um certific or the documentation is a bit lacking and a lot of things did not match up or they were out of date or uh you know sometimes I would do things once and it would work and not a second time and so I want you to get comfortable. I want you to get hands-on uh for the ACE. Okay, but there you go. [Music] Let's take a look at what is a resource within Google Cloud Platform. So a resource is an entity that you can create, manage or use within uh your cloud environment. And there are two main types of resources. The first being service level resources. Uh this is what you think of when you think of resources in any other provider. It's the um uh the actual things that you're launching such as uh the virtual machines, uh your storage or your databases. Um, and the other one are account level resources. Now, I put an asterct on it because I don't like calling these resources, but that is just the name that Google uh defines them as. And so I'm being very explicit to give you Google's language, but other providers, I don't think we would call those um resources. It would just be uh ways of logically grouping your actual resources together. But let's make it clear what they are. So this is where we have uh your organization, your folders, your projects. Um and these are logical grouping uh a way of logically grouping um your service level resources uh so that you can organize them. Okay. So hopefully that's really clear. But when you think of a resource I just want you to think of service level resources. And that's how I'm going to treat the language uh throughout this course is when I say resources I'm just talking about service level resources. And I'm not going to call account level resources account level resources. Okay. [Music] All right. All right, let's take a look here at resource hierarchy. So here on the right hand side, I've pulled this graphic from the documentation. And this is a general representation, a generic representation of how you could organize your resources using um uh those account level account level resources. But let's go through and define the most top level stuff that we're going to care about here. It's not going to include everything, but it's going to include u 99% of the things we need to know about resource hierarchy. So the first thing is a resource. And and when we say resource, I'm going to just refer to anything that's a service level resource as a resource through this course. These are the things that are used to process your workloads. So the things that you're deploying again, uh servers, databases, um uh cloud storage, whatever, anything you're pressing a button to launch, it's likely going to be a service level resource. Um let's make sure we understand resource management. So this is how you should configure and grant access to cloud resources for your team to set up uh set up your organization uh for account uh utilizing account level resources. Uh the top level thing is your domain. This is a prim primary identity for your organization. Um if you notice on the right hand side here um it doesn't show the domain in that uh representation graphic but it absolutely is there. Um but we'll continue to work through here. So it defines which users should be associated with your org. um universally administered policies for your users and devices linked to either a Google Workspace or cloud identity account. Um a Google workspace or cloud identity can only have one org. Okay. Then we have our organization. So this is the root node of your Google cloud hierarchy of resources. It defines settings, permissions and policies for all projects, folders, resources, cloud billing accounts uh for it uh uh at its parents. Organizations is associated with exactly one domain. Right? Right. So there's a a a very strong coupling between a domain and an organization. Using your organization, you can essentially manage your Google Cloud resources and your users access with proactive and reactive management. Um then we have folders. So folders are I mean they're exactly what you think they are, but um depending on how you structure them, there's um you can uh have better or worse kind of um uh posture in terms of the way you um organize your resources. And Google is very prescriptive in terms of ways that you can organize them. But the one on the right hand side um looks pretty generic here. So I'm not really sure if it represents any of the three that Google uh suggests, but we will look at those here in a moment. U but anyway, so yeah, folders are logical groupings of projects or other folders. Folders can be used to group resources that share common IM policies. Then you have projects themselves. This is logical grouping of service level resources. This is basically always where you're launching your stuff into. Uh, and you're going to find I mean projects are okay. I think I like Azure uh resource groups better, but um there is a limit. I don't know what the limit is, but there is a limit of how many uh projects you can have and I always kind of find that at least at my account level kind of frustrating. Um they do take a little bit of time to spin up initially but anyway we'll see that as we work through the course here. Projects can represent teams, environments, org units, uh business departments. So between folders and projects, you have a lot of ways of um isolating things. uh basis for enabling services APIs and IM permissions a service level resource can only belong to a single project and there isn't something here where it talks about API so when you make a new project and let's say you use something like um uh Vertex AI um you have to turn that API on every single time when you go to a new project if you're from the ads world basically you can think of projects as like being accounts right literally being accounts um whereas in something like Azure if you um enable something It's across it's across everything. Um and so it's just a different way of isolation. So again, if you're coming from those other clouds, you're going to notice the difference. Here we have labels. These are used to categorize and filter your resources with key and values. They're great for uh tracking costs at a granular level. There are three suggested hierarchy architectures that you can use. They might have more now, but um again, these are just whatever you just have to decide what you want. Uh but we have environmental oriented, functionoriented, and granular accessoriented. We'll look at those separately uh in the next video. But there you go. Um I think there's a few things we didn't cover here like organizational policies, but we'll cover those in uh separate slides. Okay. [Music] All right. So I said that Google has three or maybe more now but three um architectural hierarchies u that you can use to organize uh your resources using folders and projects. So let's take a look at uh these three and you know whatever you're doing you can do whatever you want. Again this is just something that they suggest but I find that uh in terms of real application uh you got to do what works for your team. So again just take this stuff with a grain of salt. um uh but whatever you learn from this adapted in your organization. Let's take a look at environmental or environmentoriented hierarchy. So here we have our diagram below and let's look at some of the points and then try to make sense of it. So you have one organization that contains one folder per environment. Simple to implement, right? Pretty straightforward. Uh this can pose challenges if you have to deploy services that are shared by multiple environments. Um so yeah let's take a look here. So yeah, we have a single organization. Underneath we have production, quality assurance, development. I might call mine like production, staging. Um staging to me would be Q&A and then we' we'd have development and we have resources underneath. Um how could you expand this further? Well, I mean down below you you see like we have projects and they actually have projects isolated per I'm going to get my pen out here, but it looks like they have uh projects per like um per workload. So here it says net host app and things like here and so it's suggesting that these are all well these are resources but it's not really suggesting if this is a single project or if this is multiple projects right because you know I could see um here that you could have production and then maybe you have uh this workload let's just represent this as a project but this is a workload like this is workload one uh workload two and workload three and you could repeat that across the board here and I think that would work out pretty well for uh small to mediumsiz organizations. Um so I don't really see an issue uh with that there. But the other thing is that you can have folders inside of folders. So yeah, I think this is fine starting out. Um so I think it's pretty straightforward here. Uh and the drawbacks are pretty pretty clear. Let's look at function oriented hierarchy. So here on the right hand side um we have a little bit more structure. So one organization that contains one folder per business function. Each business function uh folder can contain multiple environments folders. Um multiple business functions apps manage uh uh or apps management and information technology. More flexible compared to environment oriented gives you the same environment separation allows you to deploy um similar services. Function oriented hierarchy is more complex to manage an environment oriented um separated access by business. And again it depends on how granular you go with the projects. Um here it looks like these are the projects like if we go back to this one this is uh net host my app whatever whatever um like if these are the projects under here let's start over here all right let's take a look at how we can organize our hierarchies with folders and projects and how we get different outcomes. These are the three that are recommended uh by Google, but I'm going to um provide my own opinion as we're working through this. First one is environment oriented hierarchy. So here it is down below. The idea here is you have one or that contains one folder per environment. Um and the idea is it's just simple to implement and Google's saying that a compos challenge is if you have to deploy services that are shared by multiple environments. What I think is um what I think Google should be doing is saying like okay you have this or organizational structure and how do you change it over time um which is I don't know why they don't do this but like this is what they really should be doing is saying like start here go and then you can go from here or there or there kind of like your Tamagotchi or your Pokemon you have like your upgrade path but they don't do that they just show you three here. Um is this okay? I think it's fine. Like if we go down below here um it's a little bit unusual because here this looks like a resource. These all look like appgines, but I guess these are all projects. And so we have our main org, we have prod, Q&A, I'll call that staging, and then dev. And then down below we have our isolate project. So we have net host, app one, app two. Um, and I think that's fine. Like here we're seeing the app repeated once, twice, thrice, right? So the idea is that you have that app across the board. Um, like I don't know why they just wouldn't suggest in this case like this would make sense if you had one project for your entire organization like you're a really really small company but why wouldn't they just put another folder up here like just put a folder here like app one like app one and then you could isolate um these into the three folders. But even if you had this folder here like the app folder up here um uh you know like you can use labels to to isolate things as well kind of. So why wouldn't you just have a folder that is app one or simply just have a project that is folder a project that is your logical isolation for your app workload and then use labels underneath. So I kind of feel like they could have gone a bit simpler here. Um and I mean like this is fine like this is still okay if you want to have a bunch of folders but I don't think that this is the starting point for most folks. I think that they should be starting with projects and labels and then introducing uh like bubbling up and having a folder here and then if they really want if they really need three folders underneath for for their different environments then have a folder there. But why they did this way I don't know let's take a look at function oriented uh hierarchy. So here on the right hand side the idea is that one or that contains one folder per business function. Um so what are they saying here? So on the right hand side we have apps management infrastructure technology. So we have a generic business function. Um and then down below they have their environments. Um and then they have their projects. Again, this is okay, but I I don't know why this is their suggestion. Um this is the other thing is like you can't understand as to like they say like that you should use this, but they don't really justify it in terms of an org. But let's take a look here. Each business function folder can contain multiple environments. Multiple business functions and apps managed in different information technology. Gives you the same environment separation. Allows you to deploy shared services. um separate access by business um it's fine but again I don't understand like I don't see how apps management and infrastru u you had like large data workloads that you wanted to keep separate maybe for like anal analytics or something I could see that maybe that's information that's not that's not it so maybe they're they're suggesting this for like uh more um large organizations that aren't just deploying apps but have are utilizing uh Google cloud from anything. So that might make sense. Like I could see a school maybe separating apps management uh it but you know I'm I'm not completely sold on function oriented hierarchy but whatever. We have granular access uh oriented hierarchy. So this is just where we get a ton of folders. Um so one or that contains one folder per business unit. Each business unit folder can contain one folder per business function. Each business function folder can contain one per environment. It's most flexible. You need to spend a great effort to manage the the structure roles and permissions. network topology is more complex. Um, and so yeah, I mean this is like endgame where you have your divisions of your um at the top there and then the second level is your functions and then your environments and your projects. Again, it's fine. I would probably try to use labels to separate environments and just kind try to keep things a little bit flat unless there you have a very specific reason to separate them out into separate projects because it's like governance reasons and you need to really restrict things in a particular way which you can still again do at a project level. Uh I would just try to keep things a little bit simpler than this. Um it's not like it's defining the divisions as like the organi organizational units of your business. It says business unit and so I guess it is like it says retail risk management financial commercial. Um yeah, I don't know. It just feels a little bit off to me. But um anyway, it's just what they suggest. And again, if you come up with something different, it's totally fine. Uh the question more is like can you like once you put a project in a folder, can you move it? Right? Because you know what happens if you don't like it? So just a second here. Yes. So I just wanted to double check that um my knowledge is up to date. And I mean like you can move projects to other folders. So I don't feel like you're really locked into any of this mess. I think the hard part is probably setting up the permissions and things like that. But again, I would start small, right? Uh start with a single project, use labels, and then bubble up to a folder. You could uh do that based on environments and then if you have more than one workload, then bubble that up into separate uh the scope on the projects. Um yeah so it's it's fine but I do think there are some improvements that could be made with these um resource hierarchy graphs here. Okay [Music] let's talk about projects within Google cloud. So a project in Google cloud is a logical grouping of resources and a cloud resource must belong to a project. So here in the uh top right corner you see exam pro. That is a name of a project that I have. Though in this course uh you'll you'll notice I call it GCP playground or I might have a few different names. A project made up of settings, permissions, other metadata. A project can't access another project's resources unless you use shared VPC or VPC networking pairing and that stuff is going to be related specifically to virtual machines. Okay. Um resources within a single project can work together easily. For example, by communicating through an internal network uh subject to the regions and zones rules. Each Google cloud project has the following. A project name which you provide a project ID which you or Google cloud can provide for you. A project number which uh Google cloud provides. Um as you work with Google cloud you'll use these identifiers in certain command lines and API calls. Once you give it a project ID, you cannot change it. So be very careful um that you get your project ID right because a good project ID is going to make things a lot easier for you. Each project ID is unique across Google cloud. Once you have created a project, you can delete the project but its ID can never be used again. When billing is enabled, each project is associated with one billing account. Multiple projects can have their resources uh resource usage build to the same account. A project serves as a namespace. This means that every resource within each project must have a unique name, but you can usually reuse resource names if they are separate projects. Uh folders allow you to logically group multiple projects that share common IM permissions. So that is obviously a huge benefit. Folders are commonly used to isolate projects from different departments or for different environments. though I do feel like you could utilize tags um to get a little bit more or labels to get more flexibility within a project for permissions. But there you go. [Music] Hey folks, it's Andrew Brown. Let's take a look at where the resource hierarchy is and what we can do with it. So right now I'm in my Google Cloud account. If you do not have a Google Workspaces uh account, you'll have to make one first because you need to be an organization in order to u manage your resource hierarchy. But you can see here I already have an existing project. But if you click here, um what you can do is go to the three ellipses and manage resources. If for whatever reason this path is not working for you, you can go on the lefth hand side here to the three pancakes. And I like to think of those pancakes instead of hamburger hamburgers, but it's pancakes for me. If you go to AM and admin under manage resources, it will get us to the same place. So our organization is at the top level. You can see we have folders underneath and then we have our projects and then resources are within the projects. So it's pretty straightforward at this step here. Um but you know if we wanted to uh create some uh create some things like a folder project, we can do that. So I'll make a new one and I'm going to call this one learning. Okay. And you can see I'm putting this organization and this location. We'll go ahead and create that. Sometimes there's a bit of a delay here. So, you need to be a little bit patient dealing with um um uh this here. And so, yeah, notice like right away I do not see my uh folder. So, we'll go ahead and give that a refresh, right? So, I'm like, where did it go? And so, that's that's generally what my experience is uh trying to find uh some of these resources. Now, we can go up to I believe it's up in our notifications. And so, we can see that it has been created, but just notice that we do not see it. So, what I'm going to do is I'm just going to wait a little bit here, maybe 5 minutes, 3 minutes, and give it a refresh and see if it appears. Okay. You have to have confidence when working with the Google Cloud um management console because sometimes things just don't show up immediately. Okay. All right. So, I was doom scrolling for a bit. Now, I'm back. Let's give it a refresh and see if it appears. And so, now it appears. So, yeah, again, have patience for these resources being created. Going to go here on the right hand side, see if we can directly create. We can move them. And there are um very little settings for us to do. You see, you have application APIs here if you want to have that feature on. It's still in preview, so there's not much to talk about there. But let's say we want to create a new project under here. I'm going to check box this here. Let's go ahead and do that. And there is a limit to how many uh projects you can have in your repo or sorry, your organization. I can't remember what the number is, but I'm going to make a new one here. And this will just be called um I just want to have a generic one that I'm going to keep using here again and again. So, this will just be GCP playground. Okay. And if you want to make sure you have a nice name, uh, that one's fine. I might want a number I can remember. 1212. We'll do that if I'm allowed to take that. And I'm going to go ahead and create that. There we go. Okay. And, you know, again, these things take time, but you know, managing resources is pretty straightforward. You can move things around, right? You can create folders. Um, and this structure is obviously going to be valuable when you want to apply uh organizational policies, which we'll look at uh pretty soon. But again, we're just waiting for that resource as we're waiting. Let's just take a look here. So, uh yeah, you can apply tags, but I'm not really interested in doing that here today. So, I'm going to wait and once that's created, then we will um we'll continue on here. Yeah. And again, notice you have to wait a little while. So, we'll wait a little while. Okay. All right. Again, back and we'll give this a refresh. See if that resource is there. Um, it is, but it's not where I want it to be. I want it to be in this folder here, which is fine. So, we'll go ahead and move it. And we'll go ahead and say move. And there we go. Now, it's been moved. So, now it is over here. Okay. So, again, we can apply tags if we want to. Um, edit tags for the resources. [Music] So, we could do this and apply tag if we want to. So, [Music] I guess I don't really care. One second. I was thinking about it. We can go ahead and do some tags. So, if we were going to want to have tags, we'll have to make some first. I'm going to go ahead and open a new link here. We'll type in tags at the top. And that should bring us over to IM admin. Again, if you need to find it another way, it's probably here. Um, and so we'll go ahead and create ourselves a new tag. What do I want to call this tag? Um, learning maybe. Well, it depends. There's a key and a value, right? So, yeah, I'll go ahead and type in learning uh for fun here for use of network firewalls. No, we're just doing that. Add one or more tag values that can be enforced for the policy categorization. So, we can go ahead here. Maybe I'm typing in ace um for its value. And we can give it a descriptor. I'm not going to go ahead and give it a descriptor. We'll go ahead and create that tag. So that tag is creating. Again, this is not a very useful tag, but it is a tag. So that we at least uh learn that little bit there. And if we go back over to here, I want to see if I can actually apply that tag. So select current project. And uh this is the thing. It's propagation. You got to wait. So we'll give it again another few minutes and maybe we can apply that tag. Okay. Again, uh quite a bit of waiting here. And so we're going to give this a nice hard hard refresh. hard refresh up here just in case. Give them lots of hard refreshes. And what we're going to do here if these popups is get out of the way. There we go. We'll go ahead and checkbox that. See if we can apply tags again. We'll scope the tags. Um cannot contain tags. Okay. Why not? Okay, that's fine. We'll say select current project. I mean, that's just another way to do it. And uh learning. So, yeah, I'm not sure why I can't select my tags right now, but that's totally fine. So, I'm going to go ahead uh but my point is we'll come back to tagging when we need it. Right now, we do not need it, and I really just want to focus on uh managing hierarchies, but yeah, there you go. Okay, [Music] we're taking a look here at organizational policies and they allow you to apply constraints across your entire resource hierarchy. Um, if you know um or policies from ads, it's very very similar. I can't remember what Azure has. Um, but you know, one thing I want to make clear is that when you are distinguishing these from your IM roles, IM lets you focus on who has access. org policies let you focus on what has access. Now the interesting part is that they don't call org policies policies, they call them constraints, which is confusing. Um but the idea is that when you want to create an organizational policy, you're going to create a constraint. And organizational policies is really the organizational policy service that allows you to create create constraints. Um whoever named this stuff over Google, um I I wonder if you're still there because it is really confusing. But the idea here is that when you create a constraint, you need to apply an enforcement. So within your constraint, you are now creating enforcement within it. Again, I don't know why they just didn't not have this level of enforcement. It's called a constraint. But within that, you'll need to have the following. You need to define the resource type. So that's going to be what resource you can apply to the constraint. I believe you can choose multiple resource types, but I've only ever chosen one. Uh you have the enforcement method. So this is u when it should be applied on create or update. Um there are some other ones like based on tags but usually on create and update are the the options you can choose not necessarily both but one or the other. Um then we need to create a condition using cel expression. I really dislike cel but um it's something that you do have to learn when utilizing Google um but it's its uh own little logical language um that you can write in YAML or I guess JSON but I've only ever used it in YAML. Then you need to choose whether you want to allow or deny the action. Um, and there are two types of constraints. We have managed created by GCP and then custom created by you. And here's an example of me creating a uh constraint. In fact, I actually failed at creating this correctly because I'm going to tell you it's just really hard to make organizational policies and and being very clear on what you can do. You can barely do dry runs and there's ways to evaluate them. But honestly, I find policies very difficult to set in uh GCP. So, if you do find it confusing or frustrating, uh, understand that that is normal for these, but they are very powerful. if you can get them to work. And so the example down below is I wanted to uh create a constraint only for a VM in Canada. You can see right now its enforcement state is inactive, meaning it's not being applied. Um let's take a look at an example. So I pulled this from the docs because again my examples uh you know don't always work correctly. But here we can see that there's the name, we have that resource type, and here you can see it's for node poolool. We have the method type. So apparently you can include both create and update. Though in the console it makes it seem like you only select one or the other. So I suppose you can uh select more there than your condition itself. So this um this you do have to do quite a bit of research to try to find it out. In the documentation they don't really make it easy to figure out uh like what you can apply to different resources. Each resource is a little bit different in terms of what is being set there. Um and it's very hard. You have to play around with the G-Cloud and try to find it out or find existing examples. Um LLMs are going to lie to you. um they're just going to tell you nonsensical things because again if there's no docs then LLMs are just going to make things up and it's hard to find. Um, so you can see the action type is allow. Um, there's a display name, a description, pretty straightforward, but understand that creating those conditions can be a bit of a headache. You will see CEL appear in other places. So, it's not just in or policies, but um, you know, we will we will be touching CL throughout this course. Let's talk about how you change the hierarchy evaluation by setting the policy source. So here's a diagram and they kind of try to explain in the docs based on like different colors and hear from different things but really um changing the hierarchy evaluation is called policy source. They don't mention this in the docs but it's definitely there in the UI and it's clearly tied to this specific thing. But there are three options we can choose. We have inherent parent policy. So follow the policy that the folder or or above it is using or Google define default if no parent exists. Uh we have Google manage default. So follow the default policy set by Google. Um override parent policy. So policy includes rules from the parent folder or replaces the parent policy uh entirely. Okay. Um now once you create your policy, it doesn't necessarily take effect until you um create a a rule. So now you have rules and basically rule is is it on or is it off? Why don't they put this under the enforcement section? I don't know. You can add a condition but for the most part you'll do that. Um and again uh these are frustrating. It's hard to tell when they're working. So you know just understand the nature of them. But if you know ads organization policies, then you have an idea what these are. Uh but there you go. Okay. [Music] Hey, this is Andy Brown. In this video, we're going to see if we can apply an organizational policy. Um I find these very hard to set and my last attempt I failed. So hopefully we'll I'll learn from my mistake and and we'll get it working this time. But let's make our way over um to organizational policies. So I'll go ahead and type that in here. organizational policies and I remember there being two options here at the top now just says custom constraints so maybe they changed something but down below we have constraints and actually I have the one that I made here before I'm going to go ahead and take a look and see if I can find it so over here uh if we scroll to the right we have constraint type managed and there's going to be custom ones those are the ones that you create so I'm going to go ahead and try to find mine so go constraint type and type custom you're not going to see this here this is what I created before and so I have one here called only VM Canada right so I created this one before Um, and I told it to restrict on this information. I'm gonna copy that out. It's really, really hard to figure out these conditions. So, I'm just going to copy this over here. Um, but what I'm going to do is I'm going to go ahead and see if I can delete this policy if there is even a way to do that. It's so hard to figure this stuff out. Um, just a moment here. Let me see. Okay, I'm back at top level here. Can I have edit the policy? Right. And so I'm looking for that delete cancel. Uh and then we have um manage the policy. So like like I can't even figure out how to delete this thing. It's so darn hard. So um constraints can only be deleted at the organizational level. So switch to parent organization. Maybe that's the reason why I can't delete it. There we go. Now I can delete it. So you can see how it can be a little bit of a challenge to getting rid of that. Let's go ahead and create ourselves a new custom constraint. And I believe I'm at the organizational level. I am right up here. Okay. And so let's go ahead and create a new custom constraint. I'm going to try this again. Say Canada VM only. Right. So what I want to do is I want to cons uh restrict uh this VM to be only in Canada. So Canada VM only. So only VMs in Canada should be launching. Nowhere else should they work. We're going to enforce this on our instance for compute. There we go. And so we have an enforce method. So enforce on create. I'm going to do create or end update so that we're catching all conditions uh when this is happening. And then we need to find our conditions. So we've expanded this. We can go over here. We can try to figure out uh where it is. But again, I said that this is just talking about the common expression language. This is not necessarily talking about uh the resource underneath, right? Its properties. And it's kind of hard um to find that. So let's go ahead. I jus