The map

Ten families. Every family has references, one error catalogue, at least one guide, a parity guide and a release note. The identity column is the hub's standing answer to "what should this call be made as", and it is the same answer everywhere: the workload's own attached service account, or a federated external identity — never a key.

1. Identity and access

reference/identity/iam-model.md · reference/identity/predefined-roles-and-permissions.md · reference/identity/workload-identity-federation.md · reference/identity/secret-manager-and-kms.md · reference/identity/errors.md · guides/identity/fix-permission-denied.md · guides/identity/github-actions-without-keys.md · guides/parity/identity.md · changelog/2026-10-21-identity-family.md

IAM · Workload Identity Federation (external and GKE) · Secret Manager · Cloud KMS. Identity: this family is the identity question.

2. Infrastructure as code

reference/iac/terraform-on-google-cloud.md · reference/iac/deployment-manager-status.md · reference/iac/config-connector.md · reference/iac/errors.md · guides/iac/terraform-first-apply.md · guides/parity/iac.md · changelog/2026-10-21-iac-family.md

Terraform · Infrastructure Manager · Deployment Manager (out of support) · Config Connector. Identity: the pipeline's own — attached, or federated. Config Connector reconciles as its own service account.

3. Storage

reference/storage/cloud-storage.md · reference/storage/cloud-storage-access-control.md · reference/storage/persistent-disk-and-hyperdisk.md · reference/storage/filestore.md · reference/storage/errors.md · guides/storage/create-a-bucket-that-is-not-public.md · guides/parity/storage.md · changelog/2026-10-21-storage-family.md

Cloud Storage · Hyperdisk and Persistent Disk · Filestore. Identity: the workload's service account, bound at the bucket. A browser gets a signed URL.

4. Compute

reference/compute/compute-engine.md · reference/compute/gke-cluster-modes.md · reference/compute/cloud-run.md · reference/compute/cloud-functions.md · reference/compute/errors.md · guides/compute/deploy-a-container-on-cloud-run.md · guides/parity/compute.md · changelog/2026-10-21-compute-family.md

Compute Engine · GKE (Autopilot, Standard) · Cloud Run · Cloud Run functions. Identity: a dedicated service account attached per service; the deployer needs roles/iam.serviceAccountUser on it.

5. Networking

reference/networking/vpc.md · reference/networking/cloud-load-balancing.md · reference/networking/cloud-nat.md · reference/networking/cloud-armor.md · reference/networking/private-service-connect.md · reference/networking/errors.md · guides/networking/reach-a-private-service.md · guides/parity/networking.md · changelog/2026-10-21-networking-family.md

VPC (global) · Cloud Load Balancing · Cloud NAT · Cloud Armor · Private Service Connect. Identity: networking is mostly not identity-gated at call time; the producer's accept list is the authorisation boundary for Private Service Connect.

6. Databases

reference/databases/cloud-sql.md · reference/databases/alloydb.md · reference/databases/spanner.md · reference/databases/firestore.md · reference/databases/bigtable.md · reference/databases/errors.md · guides/databases/connect-to-cloud-sql-with-iam-auth.md · guides/parity/databases.md · changelog/2026-10-21-databases-family.md

Cloud SQL · AlloyDB · Spanner · Firestore · Bigtable. Identity: IAM database authentication plus a connector, with roles/cloudsql.client. No password.

7. Messaging

reference/messaging/pubsub.md · reference/messaging/cloud-tasks.md · reference/messaging/eventarc.md · reference/messaging/errors.md · guides/messaging/deliver-pubsub-to-cloud-run.md · guides/parity/messaging.md · changelog/2026-10-21-messaging-family.md

Pub/Sub · Cloud Tasks · Eventarc. Identity: the push identity needs roles/run.invoker; keep the endpoint private.

8. Data and analytics

reference/data/bigquery.md · reference/data/dataflow.md · reference/data/dataproc.md · reference/data/errors.md · guides/data/query-bigquery-from-typescript.md · guides/parity/data.md · changelog/2026-10-21-data-family.md

BigQuery · Dataflow · Dataproc (Managed Service for Apache Spark). Identity: two separate grants — one to run the job, one to read the data.

9. Observability

reference/observability/cloud-logging.md · reference/observability/cloud-monitoring.md · reference/observability/cloud-trace.md · reference/observability/errors.md · guides/observability/find-the-failing-call-in-cloud-logging.md · guides/parity/observability.md · changelog/2026-10-21-observability-family.md

Cloud Logging · Cloud Monitoring · Cloud Trace. Identity: the workload writes as itself; log views scope who may read.

10. Migration

reference/migration/migration-center.md · reference/migration/migrate-to-virtual-machines.md · reference/migration/database-migration-service.md · reference/migration/storage-transfer-service.md · reference/migration/errors.md · guides/migration/assess-before-you-move.md · guides/parity/migration.md · changelog/2026-10-21-migration-family.md

Migration Center · Migrate to Virtual Machines · Database Migration Service · Storage Transfer Service. Identity: the host project controls, the target project receives — two sets of permissions.

Cross-cutting

Document	What it is for
reference/overview/projects-and-resource-hierarchy.md	the container model everything sits in
reference/overview/regions-zones-and-locations.md	what is zonal, regional, global
reference/overview/quotas-and-limits-model.md	quota against system limit, and the call that reads a live value
guides/parity-and-migration-method.md	the owner's use case: using the three hubs for one estimate
guides/when-the-docs-have-changed.md	the drift report
patterns/cloud-run-to-cloud-sql-with-iam.md	a service reaching a database with no credential
patterns/github-actions-to-google-cloud-keyless.md	CI onto Google Cloud with no key
patterns/lift-and-shift-a-vm-estate.md	a VM estate moving, with the decisions named
examples/estimate-a-three-tier-migration.md	the method applied end to end
changelog/2026-10-21-release-notes.md	everything this release does not cover