Google Cloud Platform: Complete Cloud Learning Guide for .NET Full Stack Developers

Learn Google Cloud fundamentals, compute services, Cloud Run, databases, networking, identity, security, storage, deployment, monitoring, and DevOps through practical C# and ASP.NET Core examples.

Introduction

Modern applications need more than a frontend, backend API, and database. They also need reliable hosting, secure configuration, identity management, file storage, networking, monitoring, deployment automation, and a strategy for scaling.

Google Cloud Platform (GCP), commonly called Google Cloud, is Google's cloud computing platform. It provides infrastructure and managed services for building, deploying, operating, and scaling applications.

As a .NET full stack developer, you can use Google Cloud to host ASP.NET Core applications, deploy Angular frontends, connect to relational databases, store files, process messages, manage application secrets, and monitor production workloads.

This guide begins with cloud fundamentals and gradually moves toward practical application deployment. It explains what Google Cloud services do, when to use them, and how they fit into a modern application architecture.

Learning approach: We will use a sample Employee Management application as a running example: an Angular frontend, an ASP.NET Core Web API, and a relational database. The same concepts apply to many business applications.

1. What Is Cloud Computing?

Cloud computing is the delivery of computing resources over the internet. Instead of purchasing and maintaining physical servers in your own office or data center, you use computing resources provided by a cloud provider.

These resources can include virtual machines, application hosting, databases, storage, networking, identity services, analytics, and managed platforms.

Traditional Hosting vs Cloud Computing

Traditional / On-Premises	Cloud Computing
The organization purchases physical servers.	Resources are provisioned from a cloud provider.
Hardware capacity must be planned in advance.	Capacity can often be increased or reduced on demand.
The organization maintains hardware and facilities.	The provider manages the underlying facilities.
Scaling can require purchasing additional hardware.	Scaling can be configured through service settings and automation.
Large upfront capital expenditure may be required.	Usage-based and subscription pricing models are common.

Important Benefits of Cloud Computing

Scalability: Increase or decrease resources as application demand changes.
Availability: Use redundancy and managed infrastructure to reduce downtime.
Global reach: Deploy workloads in regions closer to users.
Managed services: Reduce infrastructure administration work.
Cost flexibility: Pay according to the selected service and usage model.
Security capabilities: Use identity, encryption, network controls, policies, and monitoring.

Important: Cloud does not automatically mean cheaper, secure, or highly available. These outcomes depend on architecture, configuration, service selection, and ongoing operational practices.

2. What Is Google Cloud?

Google Cloud is Google's cloud computing platform. It offers services for compute, storage, databases, networking, security, analytics, application development, and artificial intelligence.

Developers can use Google Cloud to deploy an ASP.NET Core Web API, host a frontend, connect to Cloud SQL, store uploaded documents, manage application identities, and monitor application performance.

What Can You Build with Google Cloud?

ASP.NET Core MVC applications and Web APIs.
Angular, React, and other frontend applications.
Containerized applications and microservices.
Event-driven applications and background workers.
Applications using SQL and NoSQL databases.
File-processing and messaging solutions.
Data analytics and AI-enabled applications.

Google Cloud Tools Commonly Used by Developers

Tool	Purpose
Google Cloud Console	Browser-based interface for managing cloud resources.
Google Cloud CLI (gcloud)	Command-line tool for managing Google Cloud resources.
Cloud Shell	Browser-based command-line environment with Google Cloud tools.
Cloud Code	IDE extensions and development tools for Google Cloud applications.
Docker	Build and run application containers.
Artifact Registry	Store container images and other build artifacts.
Cloud Build	Build and automate software delivery workflows.
Terraform	Provision infrastructure using configuration files.

3. Cloud Service Models: IaaS, PaaS and SaaS

Cloud services are commonly grouped into three models. The difference is how much of the technology stack the cloud provider manages and how much remains your responsibility.

1. Infrastructure as a Service (IaaS)

IaaS provides infrastructure such as virtual machines, disks, and networking. You manage the operating system, installed software, runtime, application, and much of the configuration.

Google Cloud example: Compute Engine.

Physical infrastructure  - Managed by Google
Virtual machine          - Google provides the VM
Operating system         - Managed by you
.NET runtime / web host  - Managed by you
Application              - Managed by you
Application data         - Managed by you

When to use: When you need operating-system control, custom server software, legacy application hosting, or a specialized server environment.

2. Platform as a Service (PaaS)

PaaS provides a managed application platform. You deploy your application without managing the underlying virtual machines and operating system in the same way as IaaS.

Google Cloud examples: App Engine, Cloud Run, and Cloud SQL for their respective workloads.

Physical infrastructure  - Managed by Google
Operating system        - Managed by Google
Hosting platform        - Managed largely by Google
Application code        - Managed by you
Application data        - Managed by you

When to use: When you want to focus on application development and deployment instead of managing servers.

3. Software as a Service (SaaS)

SaaS provides a ready-to-use software application. The provider manages the application platform and infrastructure while you configure and use the product.

Examples: Google Workspace, Gmail, and Google Drive.

Model	You primarily manage	Google Cloud example
IaaS	OS, runtime, application, data and configuration.	Compute Engine
PaaS	Application code, data, configuration and access.	Cloud Run, App Engine, Cloud SQL
SaaS	Usage, users, settings and business data according to the product.	Google Workspace

Developer perspective: For many new ASP.NET Core applications, Cloud Run is a useful starting point because it runs containerized applications without requiring you to manage virtual machines or a Kubernetes cluster.

4. Cloud Deployment Models

Public Cloud

Resources are hosted by a cloud provider and delivered to customers through the provider's infrastructure. Google Cloud is a public cloud platform.

Private Cloud

Cloud infrastructure is dedicated to a single organization. It may be operated by the organization or a service provider.

Hybrid Cloud

A hybrid approach combines on-premises infrastructure or private cloud with public cloud services. For example, an organization may retain an existing SQL Server installation while deploying a new ASP.NET Core application on Google Cloud.

Multi-Cloud

A multi-cloud approach uses services from more than one cloud provider. It can address business, regulatory, resilience, or vendor strategy requirements, but it also increases operational complexity.

5. Google Cloud Global Infrastructure

Google Cloud operates a global infrastructure organized into geographic regions and zones. Understanding these concepts helps developers choose where applications and databases should run.

Region

A region is a specific geographic area where Google Cloud provides resources. Examples include regions in India, Asia, Europe, and North America.

Zone

A zone is a deployment area within a region. A region generally contains multiple zones. Zone names include the region name and a letter identifier, such as asia-south1-a.

Data Center

A data center is a physical facility containing servers, storage, networking, power, and cooling equipment. Google Cloud zones are backed by its physical infrastructure.

Global, Regional and Zonal Resources

Global resources: Can be used across regions, depending on the service.
Regional resources: Associated with a specific region.
Zonal resources: Associated with a particular zone.

Remember: Not every Google Cloud service supports every region or zone. Verify service availability, data residency requirements, and regional capabilities before designing production infrastructure.

6. Google Cloud Console and Resource Hierarchy

Google Cloud Console

The Google Cloud Console is a browser-based interface for creating, configuring, monitoring, and managing Google Cloud resources.

Console: https://console.cloud.google.com/

Google Account and Organization

A Google Cloud user signs in through a Google identity. In business environments, an organization resource can be associated with a Google Workspace or Cloud Identity domain. It provides a central point for organizing projects, permissions, and policies.

Organization

The organization is the top-level resource in the Google Cloud resource hierarchy. It is generally associated with a company's identity domain.

Folder

Folders group projects and other folders. They help organize departments, teams, environments, and shared governance requirements.

Project

A project is the fundamental organizational unit for Google Cloud resources. Resources such as Cloud Run services, Compute Engine instances, Cloud SQL databases, and storage buckets belong to projects.

Resource

A resource is an individual service or object created inside a project, such as a virtual machine, database, storage bucket, or Cloud Run service.

7. Projects, Billing and Resource Organization

Google Cloud Project

A project provides a boundary for resources, APIs, permissions, and configuration. It also has a project name, project ID, and project number.

Identifier	Meaning
Project name	Human-readable display name.
Project ID	Unique identifier used in commands, APIs, and configuration.
Project number	Google-assigned numeric identifier.

Billing Account

A Cloud Billing account defines how usage costs are paid. Projects are linked to a billing account so that their resource usage can be charged.

Enable APIs

Many Google Cloud services require their corresponding API to be enabled in a project before you can use them.

# Set the active project
gcloud config set project employee-project

# Enable Cloud Run API
gcloud services enable run.googleapis.com

# Enable Cloud Build API
gcloud services enable cloudbuild.googleapis.com

# Enable Artifact Registry API
gcloud services enable artifactregistry.googleapis.com

Example Project Organization

Organization
    |
    +-- Folder: Development
    |      |
    |      +-- Project: employee-dev
    |
    +-- Folder: Production
    |      |
    |      +-- Project: employee-prod
    |
    +-- Folder: Shared Services
           |
           +-- Project: networking-shared
           +-- Project: monitoring-shared

Labels

Labels are key-value pairs that help categorize resources and support filtering and cost analysis.

environment = production
application = employee-portal
team        = development
cost-center = it-operations
managed-by  = terraform

Best practice: Separate production and non-production projects where appropriate. Use consistent project naming, labels, IAM permissions, and billing ownership.

8. Google Cloud CLI and Developer Tools

Google Cloud CLI

The Google Cloud CLI provides commands for creating, configuring, deploying, and managing Google Cloud resources.

Install and Initialize

Install the Google Cloud CLI using the official installation instructions, then initialize it:

gcloud init

Useful Commands

# Display active account and project configuration
gcloud config list

# Set the active project
gcloud config set project employee-project

# List projects
gcloud projects list

# List enabled services
gcloud services list --enabled

# Display Cloud Run services
gcloud run services list

# Display Compute Engine instances
gcloud compute instances list

Cloud Shell

Cloud Shell provides a browser-based command-line environment with the Google Cloud CLI and other development utilities. It is useful when you want to manage resources without configuring the CLI on your local machine.

Local Development Authentication

Application Default Credentials (ADC) provide a standard way for supported Google Cloud client libraries to discover credentials in development and production environments.

gcloud auth application-default login

Security: Developer credentials are for local development. Production workloads should use an appropriate service identity or workload identity mechanism, not a developer's personal credentials.

9. Core Google Cloud Services

Service	Purpose	Typical .NET use
Compute Engine	Virtual machine infrastructure.	Host custom Windows or Linux workloads.
App Engine	Managed application platform.	Deploy supported web applications.
Cloud Run	Managed serverless container platform.	Host ASP.NET Core APIs and workers.
Cloud Run functions	Event-driven function execution.	Run event-triggered C# code.
Google Kubernetes Engine	Managed Kubernetes.	Operate containerized microservices.
Cloud SQL	Managed relational databases.	Use MySQL, PostgreSQL, or SQL Server.
Firestore	Managed document database.	Store document-oriented application data.
Cloud Storage	Object storage.	Store documents, images, and exports.
Secret Manager	Manage application secrets.	Protect credentials and API keys.
Cloud IAM	Manage access and permissions.	Authorize users and workloads.
Pub/Sub	Messaging and event distribution.	Connect APIs and background workers.
Cloud Monitoring	Metrics, dashboards, and alerting.	Observe application health.
Cloud Logging	Centralized log management.	Investigate application failures.
Artifact Registry	Store container images and packages.	Store deployment artifacts.
Cloud Build	Build and automation service.	Build and test application code.

10. Compute Engine: Virtual Machines

Compute Engine is Google Cloud's Infrastructure as a Service (IaaS) offering for creating and running virtual machines.

A virtual machine provides a configurable Windows or Linux environment where you can install software, configure web servers, deploy applications, and manage the operating system.

What Do You Manage?

Operating system installation and updates.
Web server configuration, such as IIS or Nginx.
.NET runtime and application dependencies.
Application deployment and configuration.
Security hardening and firewall configuration.
Monitoring, backups, and maintenance responsibilities.

Example VM Creation

gcloud compute instances create employee-vm \
  --zone=asia-south1-a \
  --machine-type=e2-medium \
  --image-family=debian-12 \
  --image-project=debian-cloud

This example creates a Linux VM. Select the machine type, operating system, zone, disk, network, and security configuration according to your requirements.

When Should You Use Compute Engine?

When an application requires operating-system-level control.
When hosting legacy applications or custom server software.
When a workload needs a specialized machine configuration.
When migrating a server-based application with minimal architectural changes.

Developer perspective: If your application only needs to run an ASP.NET Core API, consider Cloud Run before choosing a VM. A VM introduces additional operating-system and server maintenance responsibilities.

11. Google App Engine

App Engine is a managed application platform that allows developers to deploy supported applications without directly managing virtual machines.

App Engine Environments

Standard environment: Runs applications in a managed environment with supported runtimes and scaling behavior.
Flexible environment: Runs applications in configurable container-based environments on Compute Engine infrastructure.

App Engine Configuration

An App Engine application uses an app.yaml configuration file to define supported deployment settings.

runtime: nodejs22

handlers:
  - url: /.*
    script: auto

This is an illustrative configuration for a supported Node.js application, not an ASP.NET Core deployment file. For .NET applications, verify the current runtime and deployment support before selecting App Engine. A custom runtime or another hosting service may be more appropriate.

App Engine vs Cloud Run

App Engine	Cloud Run
Managed application platform.	Managed container platform.
Uses supported environment and runtime models.	Runs applications packaged as containers or supported source deployments.
Useful for applications that fit its environment model.	Useful for APIs, services, workers, and containerized workloads.
Platform-specific configuration.	Container runtime and service configuration.

12. Cloud Run for ASP.NET Core

Cloud Run is a fully managed application platform for running containers. It supports services, jobs, and worker pools, allowing teams to run applications without managing the underlying infrastructure directly.

For .NET developers, Cloud Run is an important service because an ASP.NET Core Web API can be packaged as a Docker container and deployed as a Cloud Run service.

How Cloud Run Works

Create a Web API

dotnet new webapi -n EmployeeApi
cd EmployeeApi
dotnet run

Dockerfile for ASP.NET Core

Create a file named Dockerfile in the project directory:

FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
WORKDIR /src

COPY . .
RUN dotnet restore
RUN dotnet publish -c Release -o /app/publish

FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS final
WORKDIR /app

COPY --from=build /app/publish .

ENV ASPNETCORE_URLS=http://+:8080
EXPOSE 8080

ENTRYPOINT ["dotnet", "EmployeeApi.dll"]

Use a supported .NET SDK and runtime image that matches your project target. Replace EmployeeApi.dll with the actual published assembly name.

Deploy to Cloud Run

After configuring the project, enabling the required APIs, and authenticating:

# Deploy from source using Cloud Build
gcloud run deploy employee-api \
  --source . \
  --region asia-south1 \
  --allow-unauthenticated

The source deployment workflow builds the application into a container using the supported build process and deploys it to Cloud Run.

Production security: The --allow-unauthenticated option makes the service publicly accessible. Use it only when a public endpoint is intended. For protected APIs, configure Cloud Run authentication and application-level authorization appropriately.

Cloud Run Important Concepts

Service: A deployed application endpoint.
Revision: An immutable version of a service configuration and container image.
Concurrency: Number of requests a container instance can process simultaneously, subject to configuration and application behavior.
Minimum instances: Keep a configured number of instances ready where supported.
Maximum instances: Limit the number of instances to control scaling and resource usage.
Cloud Run Jobs: Execute tasks that run to completion rather than serving continuous HTTP requests.

13. Cloud Run Functions and Serverless Computing

Cloud Run functions provide event-driven execution for small pieces of application code. They are useful for responding to HTTP requests, storage events, messaging events, and other supported triggers.

Google Cloud's current serverless function experience is integrated with Cloud Run. Older documentation and examples may refer to Cloud Functions, especially earlier generations of the product.

Common Use Cases

Process uploaded documents.
Execute scheduled or event-triggered tasks.
Generate reports.
React to messages published to Pub/Sub.
Perform lightweight integrations.

Cloud Run Functions vs Cloud Run Services

Cloud Run service	Cloud Run function
Designed for containerized applications and services.	Designed for event-driven function code.
You generally manage the container or source deployment configuration.	You focus on the function entry point and supported runtime.
Useful for APIs, web applications and workers.	Useful for individual event handlers and integrations.

Remember: Serverless does not mean there are no servers. It means the cloud provider manages much of the underlying infrastructure and scaling operations.

14. Containers, Artifact Registry and GKE

What Is a Container?

A container packages an application and its runtime dependencies into an image. It helps maintain consistency across development, testing, and production environments.

Docker

Docker is commonly used to build and run containers. A Dockerfile defines how an application image is created.

Artifact Registry

Artifact Registry stores container images and other supported build artifacts. Cloud Run and Google Kubernetes Engine can use container images stored in Artifact Registry.

# Create a Docker repository
gcloud artifacts repositories create employee-repo \
  --repository-format=docker \
  --location=asia-south1

# Configure Docker authentication
gcloud auth configure-docker asia-south1-docker.pkg.dev

# Build the image
docker build -t employee-api:1.0 .

# Tag the image
docker tag employee-api:1.0 \
  asia-south1-docker.pkg.dev/employee-project/employee-repo/employee-api:1.0

# Push the image
docker push \
  asia-south1-docker.pkg.dev/employee-project/employee-repo/employee-api:1.0

Google Kubernetes Engine (GKE)

GKE is Google Cloud's managed Kubernetes service. Kubernetes orchestrates containers across a cluster of machines and provides capabilities for deployment, scaling, service discovery, and workload management.

GKE Use Cases

Large containerized applications.
Microservices with complex deployment requirements.
Applications requiring Kubernetes APIs and ecosystem tools.
Workloads requiring cluster-level control.

Cloud Run vs GKE

Cloud Run	GKE
Managed container application platform.	Managed Kubernetes platform.
Less infrastructure administration.	More control over cluster and workload orchestration.
Useful for APIs, services and background jobs.	Useful for complex container platforms and Kubernetes workloads.
Good starting point for many containerized applications.	Requires Kubernetes knowledge and operational practices.

Architecture advice: Do not choose GKE just because an application contains multiple APIs. Start with the simplest platform that meets your requirements. Adopt Kubernetes when its capabilities justify the additional operational complexity.

15. Cloud SQL and Database Services

Cloud SQL is a managed relational database service. It supports MySQL, PostgreSQL, and Microsoft SQL Server.

This is particularly relevant to developers who already work with SQL Server because Cloud SQL offers a managed SQL Server option on Google Cloud.

Cloud SQL Supported Database Engines

Database	Typical use
Cloud SQL for SQL Server	Applications built around Microsoft SQL Server.
Cloud SQL for PostgreSQL	Applications using PostgreSQL and its ecosystem.
Cloud SQL for MySQL	Applications using MySQL.

Cloud SQL vs SQL Server on a VM

SQL Server on Compute Engine	Cloud SQL for SQL Server
You manage the VM and operating system.	Google manages the database service infrastructure.
You control the SQL Server installation and configuration.	You use supported managed database capabilities.
You manage more of the maintenance and backup process.	Managed backup, maintenance, and availability capabilities are available.
Useful when full server control is required.	Useful when managed SQL Server hosting fits the application.

Important distinction: Cloud SQL for SQL Server is not the same product as Azure SQL Database. Cloud SQL provides managed SQL Server instances with its own feature support, limitations, pricing, and operational model. Check engine compatibility before migration.

Connect ASP.NET Core to SQL Server

A typical EF Core registration uses a connection string:

builder.Services.AddDbContext<AppDbContext>(options =>
    options.UseSqlServer(
        builder.Configuration.GetConnectionString("DefaultConnection")
    ));

For Cloud SQL, configure the connection using a supported connectivity approach, such as private IP networking or the Cloud SQL Auth Proxy where appropriate. The exact setup depends on the database engine, hosting service, and authentication method.

Other Google Cloud Database Services

Service	Database type	Typical use
Cloud SQL	Relational SQL	Traditional business applications.
AlloyDB	PostgreSQL-compatible relational	High-performance PostgreSQL workloads.
Firestore	Document database	Flexible document-oriented applications.
Spanner	Distributed relational database	Globally distributed transactional workloads.
Bigtable	Wide-column NoSQL	Large-scale, low-latency data workloads.
Memorystore	Managed in-memory data store	Caching and fast data access.

16. Cloud Storage and File Management

Cloud Storage is Google Cloud's object storage service. It stores data as objects inside buckets.

Important Concepts

Bucket: A container used to organize and store objects.
Object: The stored file or data item.
Object name: The identifier used to locate an object within a bucket.
Storage class: Determines the storage and access characteristics.
Location: Determines where the bucket's data is stored.

Common Use Cases

Employee profile images.
Uploaded PDF and Word documents.
Generated reports and exports.
Application backups and archived files.
Static assets and media files.

Use Cloud Storage from .NET

Install the official client library:

dotnet add package Google.Cloud.Storage.V1

Example upload using Application Default Credentials:

using Google.Cloud.Storage.V1;

var storage = StorageClient.Create();

using var stream = File.OpenRead("employee-report.pdf");

await storage.UploadObjectAsync(
    bucket: "employee-documents",
    objectName: "reports/employee-report.pdf",
    contentType: "application/pdf",
    source: stream
);

The application identity must have the appropriate Cloud Storage permissions on the target bucket. Creating a bucket does not automatically grant your application permission to upload or read objects.

Security: Avoid making document buckets public simply to simplify downloads. Use IAM-controlled access or short-lived signed URLs when appropriate.

17. Networking: VPC, Subnets and Firewalls

Networking connects application components and controls how they communicate with the internet, on-premises systems, and other cloud resources.

Virtual Private Cloud (VPC)

A VPC network is a logically isolated network in Google Cloud. It provides connectivity for supported resources and a foundation for network segmentation and security.

Subnet

A subnet is a regional IP address range within a VPC network. You can create subnets in different regions as part of the same VPC network.

Firewall Rules

VPC firewall rules control network traffic based on supported properties such as source, destination, protocol, and port.

Routes

Routes determine where network traffic is sent. They help direct communication between internal resources and external networks.

Private Connectivity

Private connectivity options help applications communicate with supported cloud services without exposing every resource through a public endpoint. The exact design depends on the service and networking requirements.

Remember: Google Cloud VPC networks are global resources, while their subnets are regional. Do not assume they follow the same networking model as another cloud provider.

18. Cloud Load Balancing, DNS and Connectivity

Cloud Load Balancing

Cloud Load Balancing distributes incoming traffic across supported backends. It can help improve application availability, scalability, and traffic management.

Cloud DNS

Cloud DNS is a managed DNS service. It allows you to manage DNS zones and records so that domain names can resolve to the appropriate application endpoints.

Cloud VPN

Cloud VPN provides encrypted connectivity between a Google Cloud VPC network and another network, such as an on-premises data center.

Cloud Interconnect

Cloud Interconnect provides connectivity options for connecting on-premises infrastructure to Google Cloud through dedicated or partner connectivity.

Typical Use Cases

Connect a custom domain to a web application.
Distribute application traffic across backends.
Connect a cloud application to an on-premises SQL Server.
Build private connectivity between cloud environments.

19. IAM, Roles and Service Accounts

Cloud IAM (Identity and Access Management) controls who can access Google Cloud resources and which actions they can perform.

Authentication vs Authorization

Authentication: Determines who or what is making a request.
Authorization: Determines what that identity is allowed to do.

IAM Principals

A principal represents an identity that can receive permissions. Examples include users, groups, service accounts, and federated identities.

IAM Roles

Role type	Purpose
Basic roles	Broad permissions such as Owner, Editor, and Viewer.
Predefined roles	Google-provided permissions for specific services and tasks.
Custom roles	Organization-defined combinations of permissions.

Service Accounts

A service account is an identity used by an application or workload to access Google Cloud services. For example, a Cloud Run application may use a dedicated service account to access Cloud Storage or Secret Manager.

Example Service Account

# Create a service account
gcloud iam service-accounts create employee-api \
  --display-name="Employee API Service Account"

# Display service accounts
gcloud iam service-accounts list

Grant Permissions

Assign only the permissions required by the workload. For example, an application that uploads files should receive the appropriate object-writing permissions on the required bucket rather than broad project-level access.

Security principle: Follow least privilege. Avoid giving service accounts broad Owner or Editor permissions by default. Do not create and distribute long-lived service account keys when a managed identity or federation approach is available.

20. Secret Manager and Application Configuration

What Is Secret Manager?

Secret Manager is a managed service for storing and controlling access to sensitive information such as API keys, passwords, certificates, and application credentials.

Why Use Secret Manager?

Keep secrets out of application source code.
Control access through IAM.
Manage multiple secret versions.
Support controlled rotation and recovery workflows.
Audit secret access where configured.

Access a Secret from .NET

Install the official client library:

dotnet add package Google.Cloud.SecretManager.V1

Illustrative C# example:

using Google.Cloud.SecretManager.V1;

var client = SecretManagerServiceClient.Create();

var secretVersion = new SecretVersionName(
    "employee-project",
    "database-password",
    "latest"
);

var result = client.AccessSecretVersion(secretVersion);

string secretValue =
    result.Payload.Data.ToStringUtf8();

The runtime identity needs permission to access the selected secret. Configure the project and secret names for your environment.

Configuration in ASP.NET Core

ASP.NET Core configuration can come from several sources, including:

appsettings.json for non-sensitive defaults.
Environment variables for deployment-specific settings.
Secret Manager for sensitive values.
Command-line configuration where appropriate.

Best practice: Keep development, testing, and production secrets separate. Give each workload access only to the secrets it needs.

21. Authentication and Authorization for Web Applications

In a full-stack application, the frontend, backend API, and Google Cloud resources can have different identity requirements.

Application User Authentication

Google Cloud applications can integrate with identity providers and authentication systems such as Google Identity services, Identity Platform, or an organization's existing identity provider.

The correct option depends on whether the application is an internal business application, a customer-facing application, or a service-to-service system.

Typical User Sign-In Flow

Protect an ASP.NET Core Endpoint

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

[Authorize]
[ApiController]
[Route("api/[controller]")]
public class EmployeesController : ControllerBase
{
    [HttpGet]
    public IActionResult GetEmployees()
    {
        return Ok(new[]
        {
            new { Id = 1, Name = "Alex" }
        });
    }

    [Authorize(Roles = "HR")]
    [HttpGet("salary")]
    public IActionResult GetSalaryDetails()
    {
        return Ok("Restricted salary information");
    }
}

This example demonstrates authorization attributes. A complete application must also configure authentication, token validation, claims or role mapping, and the intended authorization policies.

Remember: A frontend route guard improves user experience, but it does not secure backend data. Enforce authorization on the API and, where appropriate, at the data or service boundary.

22. Pub/Sub and Background Processing

Not every operation should run during the original HTTP request. Tasks such as sending notifications, generating reports, processing uploaded files, and synchronizing records can be moved to background processing.

What Is Google Cloud Pub/Sub?

Pub/Sub is a managed messaging service that allows independent applications to communicate asynchronously.

Important Pub/Sub Concepts

Publisher: The application that sends a message.
Topic: The named resource to which publishers send messages.
Subscription: Represents a consumer's interest in messages from a topic.
Subscriber: The application that receives and processes messages.

Example Background Processing Workflow

Publish a Message from .NET

Install the client library:

dotnet add package Google.Cloud.PubSub.V1

Illustrative publisher example:

using Google.Cloud.PubSub.V1;
using Google.Protobuf;

var topicName = TopicName.FromProjectTopic(
    "employee-project",
    "employee-events"
);

var publisher = await PublisherClient.CreateAsync(topicName);

var message = new PubsubMessage
{
    Data = ByteString.CopyFromUtf8(
        "Employee report requested"
    )
};

await publisher.PublishAsync(message);

The topic must exist and the application's identity must have permission to publish messages. A subscriber or worker must be configured separately to process them.

Other Background Processing Options

Service	Purpose
Pub/Sub	Asynchronous messaging and event distribution.
Cloud Run Jobs	Run tasks that execute to completion.
Cloud Run functions	Execute event-triggered functions.
Cloud Tasks	Manage asynchronous task delivery and scheduling.

Important: Design message consumers to handle retries, duplicate deliveries, failed processing, and idempotency. Do not assume every message is processed exactly once.

23. Cloud Logging and Cloud Monitoring

Deploying an application is only the beginning. Developers also need to understand its performance, availability, errors, and behavior in production.

Cloud Logging

Cloud Logging provides centralized log collection, searching, analysis, and retention capabilities for supported Google Cloud resources and applications.

Cloud Monitoring

Cloud Monitoring collects metrics, provides dashboards, and supports alerting for applications and infrastructure.

Cloud Trace

Cloud Trace helps analyze request latency and distributed tracing information across application components.

What Should You Monitor?

HTTP request count and response time.
Application errors and unhandled exceptions.
Database connectivity and query performance.
CPU and memory utilization.
Container instance counts and scaling behavior.
Message processing failures and backlog.
Application availability and service health.

Logging from ASP.NET Core

ASP.NET Core provides built-in logging abstractions:

var builder = WebApplication.CreateBuilder(args);

builder.Logging.ClearProviders();
builder.Logging.AddConsole();

var app = builder.Build();

app.MapGet("/", (ILogger<Program> logger) =>
{
    logger.LogInformation(
        "Employee API received a request"
    );

    return Results.Ok("API is running");
});

app.Run();

Cloud Run captures supported container output and integrates with Google Cloud Logging. For more advanced observability, use appropriate OpenTelemetry instrumentation and exporters.

Best practice: Monitor application behavior, not only whether the server is running. Track latency, error rates, dependencies, and business-critical operations.

24. CI/CD with Cloud Build and GitHub Actions

CI/CD automates the process of building, testing, packaging, and deploying application changes. It reduces manual deployment steps and improves consistency.

Continuous Integration (CI)

CI typically restores dependencies, builds the code, runs automated tests, and creates a deployable artifact whenever code changes are submitted.

Continuous Delivery / Deployment (CD)

CD promotes validated artifacts through environments such as development, staging, and production. Production deployments can include approvals and additional checks.

Google Cloud Build

Cloud Build is a managed build and automation service. It can execute build steps, run tests, build containers, and integrate with deployment workflows.

Typical .NET Pipeline

Developer Pushes Code
        |
        v
Source Repository
        |
        v
Restore Dependencies
        |
        v
Build Solution
        |
        v
Run Unit Tests
        |
        v
Build Docker Image
        |
        v
Push to Artifact Registry
        |
        v
Deploy to Cloud Run
        |
        v
Smoke Tests and Verification

Example GitHub Actions Workflow

This workflow builds and tests a .NET solution. It does not deploy to Google Cloud; deployment authentication and deployment steps must be configured separately.

name: Build and Test

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Setup .NET
        uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '10.0.x'

      - name: Restore
        run: dotnet restore

      - name: Build
        run: dotnet build --configuration Release --no-restore

      - name: Test
        run: dotnet test --configuration Release

Cloud Deploy

Cloud Deploy supports controlled delivery of application releases through configured target environments. It can be used as part of a more structured deployment process.

Security: Prefer Workload Identity Federation or another supported short-lived credential approach for CI/CD authentication. Avoid storing long-lived service account keys in repository secrets whenever possible.

25. Deploy an ASP.NET Core Web API

Let's bring the concepts together by deploying an ASP.NET Core Web API to Cloud Run.

Prerequisites

A supported .NET SDK installed locally.
An ASP.NET Core Web API project.
A Google Cloud project with billing configured.
Google Cloud CLI installed and initialized.
Required APIs enabled.
Appropriate IAM permissions.

Step 1: Create the API

dotnet new webapi -n EmployeeApi
cd EmployeeApi

Step 2: Run Locally

dotnet run

Test the API using the local HTTPS endpoint and the endpoints defined in the project.

Step 3: Create the Dockerfile

Use the multi-stage Dockerfile shown in the Cloud Run section and ensure that the assembly name and runtime version match your project.

Step 4: Select the Google Cloud Project

gcloud config set project employee-project

Step 5: Enable Required APIs

gcloud services enable run.googleapis.com
gcloud services enable cloudbuild.googleapis.com
gcloud services enable artifactregistry.googleapis.com

Step 6: Deploy the Application

gcloud run deploy employee-api \
  --source . \
  --region asia-south1 \
  --allow-unauthenticated

Step 7: Verify the Deployment

Open the Cloud Run service URL.
Verify the API health endpoint.
Review the service logs.
Confirm environment variables and configuration.
Test database connectivity if the application uses a database.
Verify authentication and authorization.

26. Deploy an Angular and .NET Full Stack Application

A full-stack application can separate frontend hosting, API hosting, and database hosting. This allows each layer to be deployed and scaled independently.

Reference Architecture

Responsibilities of Each Layer

Layer	Google Cloud service	Responsibility
Frontend	Firebase Hosting or suitable static hosting	Serve Angular build files.
Backend	Cloud Run	Run ASP.NET Core business logic and API endpoints.
Database	Cloud SQL	Store relational application data.
File storage	Cloud Storage	Store uploaded documents and generated files.
Secrets	Secret Manager	Protect credentials and sensitive configuration.
Messaging	Pub/Sub	Connect APIs and background workers.
Monitoring	Cloud Logging / Monitoring	Observe application and infrastructure health.

Important Deployment Considerations

Configure the production API base URL in the Angular application.
Configure CORS on the API for the exact trusted frontend origin.
Use HTTPS and configure custom domains as required.
Protect API endpoints with authentication and authorization.
Configure private database connectivity where required.
Use a dedicated service account for the API.
Configure monitoring, logs, and alerts.

Frontend hosting note: Firebase Hosting is a common Google ecosystem choice for static Angular applications. It is a separate product from Cloud Run. Select hosting based on frontend requirements, routing, custom domains, deployment workflow, and pricing.

27. Scaling, Availability and Disaster Recovery

Scalability

Scalability is the ability of an application to handle changing workloads.

Vertical scaling: Increase the CPU or memory capacity of an instance.
Horizontal scaling: Increase the number of application instances.

Cloud Run Scaling

Cloud Run can automatically scale container instances based on incoming demand, subject to service configuration, quotas, and platform limits.

High Availability

High availability is achieved through appropriate redundancy, health monitoring, failure handling, and service configuration.

Disaster Recovery

Disaster recovery focuses on restoring application services and data after a major failure.

Important Recovery Concepts

Concept	Meaning
Backup	A copy of data that can be restored.
Replication	Maintaining copies of data or services in different locations.
RTO	Recovery Time Objective: acceptable time to restore a service.
RPO	Recovery Point Objective: acceptable amount of data loss measured in time.
Failover	Switching to another healthy instance or location.

Remember: Backups alone do not guarantee disaster recovery. Test restoration procedures, document recovery steps, and validate your RTO and RPO requirements.

28. Google Cloud Security Best Practices

Cloud security is a shared responsibility. Google secures its underlying cloud infrastructure, while customers remain responsible for their application code, identity configuration, data, and service settings according to the chosen service model.

Important Security Practices

Use IAM roles based on least privilege.
Prefer dedicated service accounts for workloads.
Avoid long-lived service account keys when better identity options are available.
Store sensitive values in Secret Manager.
Use HTTPS for application communication.
Configure network access carefully.
Protect databases from unnecessary public exposure.
Enable appropriate logging and audit capabilities.
Keep application dependencies and container images updated.
Use secure CI/CD authentication and protect production environments.
Apply regular backup and recovery testing.

Security Responsibilities

Area	Typical responsibility
Physical data centers	Google Cloud
Underlying infrastructure	Google Cloud
Operating system	Depends on the service model
Application code	Customer / development team
Application authorization	Customer / development team
Data classification and access	Shared responsibility
Secrets and identity configuration	Customer / development team configuration

29. Pricing and Cost Management

Google Cloud pricing depends on the selected services, resource configuration, region, usage, storage, network traffic, and other service-specific factors.

Common Cost Factors

Compute resources such as VM CPU and memory.
Cloud Run request and resource usage.
Database compute, storage, and availability configuration.
Cloud Storage capacity and operations.
Network traffic and data transfer.
Logging, monitoring, and data retention.
Load balancing and networking resources.

Cost Management Practices

Set budgets and billing alerts.
Use labels to identify resource ownership and environment.
Review unused resources regularly.
Stop or scale down non-production resources when appropriate.
Choose service tiers based on measured requirements.
Review database and storage capacity.
Monitor actual usage after deployment.

Pricing resources:

Cost reminder: Free trials, credits, and free usage limits have eligibility and usage restrictions. Always check current service pricing and regional availability before estimating production costs.

30. Infrastructure as Code with Terraform

Infrastructure as Code (IaC) defines cloud infrastructure through configuration files. It allows teams to version, review, test, and deploy infrastructure in a repeatable way.

Common IaC Tools

Tool	Description
Terraform	Declarative infrastructure provisioning tool that supports Google Cloud and other providers.
Google Cloud CLI	Command-line resource management and automation.
Google Cloud deployment tooling	Google Cloud provides service-specific infrastructure and deployment capabilities.
Configuration management tools	Support automation and repeatable infrastructure configuration.

Example Terraform Configuration

This example defines a Google Cloud project-level Cloud Run service configuration. It assumes the project, APIs, permissions, and container image are prepared.

resource "google_cloud_run_v2_service" "employee_api" {
  name     = "employee-api"
  location = "asia-south1"
  project  = var.project_id

  template {
    containers {
      image = var.container_image

      ports {
        container_port = 8080
      }
    }
  }
}

Use variables and environment-specific configuration for project IDs, image references, and deployment settings. The service's IAM access policy and runtime service account should also be configured according to the application's security requirements.

Terraform Workflow

# Initialize providers and modules
terraform init

# Validate configuration
terraform validate

# Preview changes
terraform plan

# Apply infrastructure changes
terraform apply

Best practice: Treat infrastructure code like application code. Review changes, protect state files, separate environments, and never store secrets directly in Terraform configuration or source control.

31. Google Cloud Architecture for .NET Developers

Choosing cloud services is an architecture decision, not just a deployment task. A good design starts with requirements such as expected traffic, data sensitivity, availability targets, integration needs, team skills, and budget.

Simple Three-Tier Architecture

Expanded Production-Oriented Architecture

Frontend: Angular hosted through Firebase Hosting or another suitable static hosting service.
Backend: ASP.NET Core API hosted on Cloud Run.
Database: Cloud SQL for relational data.
File storage: Cloud Storage for uploaded documents.
Secrets: Secret Manager for sensitive configuration.
Identity: Cloud IAM and an appropriate user identity provider.
Messaging: Pub/Sub for asynchronous communication.
Observability: Cloud Logging and Cloud Monitoring.
CI/CD: Cloud Build or GitHub Actions.

Choosing the Right Compute Service

Requirement	Possible service
Full operating-system control	Compute Engine
Managed application platform	App Engine
Containerized API or web service	Cloud Run
Event-driven function	Cloud Run functions
Kubernetes orchestration	Google Kubernetes Engine

Google Cloud and Azure: Conceptual Service Comparison

Requirement	Google Cloud	Azure
Virtual machines	Compute Engine	Azure Virtual Machines
Managed web application hosting	Cloud Run / App Engine	Azure App Service
Container orchestration	Google Kubernetes Engine	Azure Kubernetes Service
Managed SQL Server	Cloud SQL for SQL Server	Azure SQL / SQL Server on Azure VM, depending on requirements
Object storage	Cloud Storage	Azure Blob Storage
Secrets management	Secret Manager	Azure Key Vault
Messaging	Pub/Sub	Azure Service Bus
Monitoring	Cloud Monitoring / Logging	Azure Monitor / Application Insights
Container image registry	Artifact Registry	Azure Container Registry
Identity and permissions	Cloud IAM	Azure RBAC / Microsoft Entra ID

Important: This is a conceptual comparison, not a one-to-one feature equivalence. Each provider has different architecture, service limits, pricing, networking, and operational capabilities.

32. Practical Projects and Learning Roadmap

The best way to learn Google Cloud is to build real applications and connect each cloud service to a specific requirement.

Project 1: Deploy an ASP.NET Core Web API

Create an ASP.NET Core Web API.
Containerize it with Docker.
Deploy it to Cloud Run.
Test the public or authenticated endpoint.
Inspect application logs.

Project 2: Employee Management Application

Create an Angular frontend.
Create an ASP.NET Core Web API.
Deploy the API to Cloud Run.
Deploy the frontend through Firebase Hosting.
Connect the API to Cloud SQL.
Configure CORS and application authentication.

Project 3: Document Management Application

Build document upload endpoints in ASP.NET Core.
Store files in Cloud Storage.
Use Secret Manager for sensitive configuration.
Apply IAM permissions to the application identity.
Use private object access and controlled downloads.

Project 4: Background Report Processing

Publish report requests through Pub/Sub.
Create a worker to process messages.
Generate PDF or Excel reports.
Store output in Cloud Storage.
Update processing status in Cloud SQL.

Project 5: Production-Oriented Deployment

Build CI/CD using GitHub Actions or Cloud Build.
Store container images in Artifact Registry.
Deploy to Cloud Run.
Configure IAM and service accounts.
Enable logs, metrics, dashboards, and alerts.
Set budgets and review application costs.
Define backup and recovery procedures.

Recommended Learning Sequence

Stage	Focus
Beginner	Cloud fundamentals, Google Cloud Console, projects, regions, zones, and billing.
Application Hosting	Compute Engine, App Engine, Cloud Run, and Docker.
Data and Storage	Cloud SQL, Cloud Storage, and database connectivity.
Security	IAM, service accounts, Secret Manager, and application authentication.
Integration	Pub/Sub, Cloud Run functions, and background processing.
Operations	Cloud Logging, Monitoring, CI/CD, scaling, and cost management.
Advanced	GKE, networking, Terraform, production architecture, and disaster recovery.

33. Important Google Cloud Interview Questions

1. What is Google Cloud?

Google Cloud is Google's cloud computing platform that provides compute, storage, networking, database, security, and application development services.

2. What is a Google Cloud project?

A project is the fundamental organizational unit for Google Cloud resources, APIs, permissions, and configuration.

3. What is the difference between a region and a zone?

A region is a geographic area, while a zone is a deployment area within a region.

4. What is Compute Engine?

Compute Engine provides virtual machines for running applications and workloads on Google Cloud.

5. What is Cloud Run?

Cloud Run is a managed platform for running containerized applications, services, jobs, and worker workloads.

6. What is App Engine?

App Engine is a managed application platform that supports deploying applications without directly managing virtual machines.

7. What is Google Kubernetes Engine?

GKE is Google Cloud's managed Kubernetes service for container orchestration.

8. What is Artifact Registry?

Artifact Registry stores container images and other supported software artifacts.

9. What is Cloud SQL?

Cloud SQL is a managed relational database service supporting MySQL, PostgreSQL, and SQL Server.

10. Does Google Cloud support SQL Server?

Yes. Cloud SQL supports Microsoft SQL Server, subject to its supported editions, versions, features, and service limitations.

11. What is Cloud Storage?

Cloud Storage is an object storage service that stores files and other data as objects inside buckets.

12. What is Cloud IAM?

Cloud IAM manages access to Google Cloud resources by assigning roles to identities.

13. What is a service account?

A service account is an identity used by applications and workloads to authenticate to Google Cloud services.

14. What is Secret Manager?

Secret Manager stores and controls access to sensitive information such as passwords, API keys, and certificates.

15. What is Pub/Sub?

Pub/Sub is a managed messaging service that enables asynchronous communication between independent applications.

16. What is a VPC network?

A VPC network is a logically isolated network that provides connectivity and network controls for supported Google Cloud resources.

17. What is Cloud Build?

Cloud Build is a managed service for executing build, test, packaging, and automation steps.

18. What is Cloud Monitoring?

Cloud Monitoring collects metrics, provides dashboards, and supports alerting for applications and infrastructure.

19. What is Cloud Logging?

Cloud Logging provides centralized log collection, searching, and analysis.

20. What is the difference between Cloud Run and GKE?

Cloud Run provides managed container hosting with less infrastructure administration, while GKE provides Kubernetes orchestration and greater cluster-level control.

21. What is Infrastructure as Code?

Infrastructure as Code defines and manages cloud resources through version-controlled configuration files rather than relying only on manual configuration.

22. What is Workload Identity Federation?

Workload Identity Federation allows supported external workloads to access Google Cloud resources using federated identity rather than requiring long-lived service account keys.

23. What is the difference between Cloud Storage and Cloud SQL?

Cloud Storage is object storage for files and unstructured data, while Cloud SQL is a relational database service for structured data.

24. What is the shared responsibility model?

It describes how security and operational responsibilities are divided between Google Cloud and the customer. The division changes according to the service model.

Official Learning Resources

Use official Google Cloud documentation for current service capabilities, supported runtimes, regional availability, security requirements, and pricing.

What's Next?

You now have a foundation for understanding Google Cloud from a .NET full stack development perspective. The next step is practical implementation: build an ASP.NET Core Web API, containerize it, deploy it to Cloud Run, connect it to Cloud SQL, store files in Cloud Storage, and configure application identity and monitoring.

Learn each service by connecting it to a real application requirement. Understanding why a service is needed, how it communicates with other components, and how it behaves in production is more valuable than simply memorizing product names.

Programming