--- cuppy_hub: gcp cuppy_path: reference/overview/services-and-identities.md cuppy_section: docs cuppy_doc: Y4AK-S1YE cuppy_doc_uuid: de86e670-341b-4398-8d6f-502206eb6745 cuppy_permalink: https://cuppy.io/gcp/d/Y4AK-S1YE cuppy_version: 1 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/gcp/docs/reference/overview/services-and-identities cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: 32f9890097a982244970d1c2aa134b23b28feff74a1a182a83fb851d933d4cb2 # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- # The map Ten families. Every family has references, one error catalogue, at least one guide, a **parity guide** and a release note. **The identity column** is the hub's standing answer to "what should this call be made as", and it is the same answer everywhere: the workload's own attached service account, or a federated external identity — never a key. ## 1. Identity and access `reference/identity/iam-model.md` · `reference/identity/predefined-roles-and-permissions.md` · `reference/identity/workload-identity-federation.md` · `reference/identity/secret-manager-and-kms.md` · `reference/identity/errors.md` · `guides/identity/fix-permission-denied.md` · `guides/identity/github-actions-without-keys.md` · `guides/parity/identity.md` · `changelog/2026-10-21-identity-family.md` IAM · Workload Identity Federation (external and GKE) · Secret Manager · Cloud KMS. *Identity:* this family **is** the identity question. ## 2. Infrastructure as code `reference/iac/terraform-on-google-cloud.md` · `reference/iac/deployment-manager-status.md` · `reference/iac/config-connector.md` · `reference/iac/errors.md` · `guides/iac/terraform-first-apply.md` · `guides/parity/iac.md` · `changelog/2026-10-21-iac-family.md` Terraform · Infrastructure Manager · **Deployment Manager (out of support)** · Config Connector. *Identity:* the pipeline's own — attached, or federated. Config Connector reconciles as **its own** service account. ## 3. Storage `reference/storage/cloud-storage.md` · `reference/storage/cloud-storage-access-control.md` · `reference/storage/persistent-disk-and-hyperdisk.md` · `reference/storage/filestore.md` · `reference/storage/errors.md` · `guides/storage/create-a-bucket-that-is-not-public.md` · `guides/parity/storage.md` · `changelog/2026-10-21-storage-family.md` Cloud Storage · Hyperdisk and Persistent Disk · Filestore. *Identity:* the workload's service account, bound **at the bucket**. A browser gets a **signed URL**. ## 4. Compute `reference/compute/compute-engine.md` · `reference/compute/gke-cluster-modes.md` · `reference/compute/cloud-run.md` · `reference/compute/cloud-functions.md` · `reference/compute/errors.md` · `guides/compute/deploy-a-container-on-cloud-run.md` · `guides/parity/compute.md` · `changelog/2026-10-21-compute-family.md` Compute Engine · GKE (Autopilot, Standard) · Cloud Run · **Cloud Run functions**. *Identity:* a dedicated service account **attached** per service; the deployer needs `roles/iam.serviceAccountUser` on it. ## 5. Networking `reference/networking/vpc.md` · `reference/networking/cloud-load-balancing.md` · `reference/networking/cloud-nat.md` · `reference/networking/cloud-armor.md` · `reference/networking/private-service-connect.md` · `reference/networking/errors.md` · `guides/networking/reach-a-private-service.md` · `guides/parity/networking.md` · `changelog/2026-10-21-networking-family.md` VPC (**global**) · Cloud Load Balancing · Cloud NAT · Cloud Armor · Private Service Connect. *Identity:* networking is mostly not identity-gated at call time; the **producer's accept list** is the authorisation boundary for Private Service Connect. ## 6. Databases `reference/databases/cloud-sql.md` · `reference/databases/alloydb.md` · `reference/databases/spanner.md` · `reference/databases/firestore.md` · `reference/databases/bigtable.md` · `reference/databases/errors.md` · `guides/databases/connect-to-cloud-sql-with-iam-auth.md` · `guides/parity/databases.md` · `changelog/2026-10-21-databases-family.md` Cloud SQL · AlloyDB · Spanner · Firestore · Bigtable. *Identity:* **IAM database authentication** plus a connector, with `roles/cloudsql.client`. No password. ## 7. Messaging `reference/messaging/pubsub.md` · `reference/messaging/cloud-tasks.md` · `reference/messaging/eventarc.md` · `reference/messaging/errors.md` · `guides/messaging/deliver-pubsub-to-cloud-run.md` · `guides/parity/messaging.md` · `changelog/2026-10-21-messaging-family.md` Pub/Sub · Cloud Tasks · Eventarc. *Identity:* the push identity needs `roles/run.invoker`; keep the endpoint private. ## 8. Data and analytics `reference/data/bigquery.md` · `reference/data/dataflow.md` · `reference/data/dataproc.md` · `reference/data/errors.md` · `guides/data/query-bigquery-from-typescript.md` · `guides/parity/data.md` · `changelog/2026-10-21-data-family.md` BigQuery · Dataflow · Dataproc (**Managed Service for Apache Spark**). *Identity:* two separate grants — one to run the job, one to read the data. ## 9. Observability `reference/observability/cloud-logging.md` · `reference/observability/cloud-monitoring.md` · `reference/observability/cloud-trace.md` · `reference/observability/errors.md` · `guides/observability/find-the-failing-call-in-cloud-logging.md` · `guides/parity/observability.md` · `changelog/2026-10-21-observability-family.md` Cloud Logging · Cloud Monitoring · Cloud Trace. *Identity:* the workload writes as itself; **log views** scope who may read. ## 10. Migration `reference/migration/migration-center.md` · `reference/migration/migrate-to-virtual-machines.md` · `reference/migration/database-migration-service.md` · `reference/migration/storage-transfer-service.md` · `reference/migration/errors.md` · `guides/migration/assess-before-you-move.md` · `guides/parity/migration.md` · `changelog/2026-10-21-migration-family.md` Migration Center · Migrate to Virtual Machines · Database Migration Service · Storage Transfer Service. *Identity:* the **host project** controls, the **target project** receives — two sets of permissions. ## Cross-cutting | Document | What it is for | |---|---| | `reference/overview/projects-and-resource-hierarchy.md` | the container model everything sits in | | `reference/overview/regions-zones-and-locations.md` | what is zonal, regional, global | | `reference/overview/quotas-and-limits-model.md` | quota against system limit, and the call that reads a live value | | **`guides/parity-and-migration-method.md`** | **the owner's use case: using the three hubs for one estimate** | | `guides/when-the-docs-have-changed.md` | the drift report | | `patterns/cloud-run-to-cloud-sql-with-iam.md` | a service reaching a database with no credential | | `patterns/github-actions-to-google-cloud-keyless.md` | CI onto Google Cloud with no key | | `patterns/lift-and-shift-a-vm-estate.md` | a VM estate moving, with the decisions named | | `examples/estimate-a-three-tier-migration.md` | the method applied end to end | | `changelog/2026-10-21-release-notes.md` | everything this release does **not** cover | --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 91 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/gcp/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.