Cloud Logging and Cloud Storage, where the quiet Google Cloud money goes
An exclusion filter at the sink is the highest-return control in the whole platform, and the storage class minimums punish a lifecycle rule written without reading them.
Blog
Google Cloud
Articles about Google Cloud from the ConsultorIA blog: cloud, applied AI and security in production.
GKE cost, and why Autopilot moves the waste rather than removing it
Standard bills for nodes you provision, Autopilot bills for pod resources you request. Both are dominated by the same number, and it is the gap between what pods ask for and what they use.
Getting the Google Cloud hierarchy right: folders, projects and org policies
In GCP the project is the blast radius and the folder is where policy lives. Most estates we see have neither used deliberately. Here is the structure we deploy and the eight policies we set on day one.
BigQuery bills that triple overnight, and the six controls that stop it
On-demand BigQuery charges for bytes scanned, so one badly written dashboard can cost more than your compute. Here is how we cap it without slowing anyone down.
Service account keys are the GCP credential that leaks. Here is how to stop creating them
Almost every Google Cloud incident we have investigated started with a JSON key file. Workload Identity Federation removes the need for them entirely, and the migration is smaller than you think.
GKE Autopilot or Standard: the decision, with the costs nobody quotes
Autopilot charges for what your pods request and removes node management. That is a better deal than it sounds for most teams and a worse one for a few. Here is how to tell which you are.
Vertex AI for RAG: the pieces worth using and the ones to build yourself
Vertex gives you a managed vector search, a grounding API and an evaluation service. Two of those are worth taking as-is. Here is how we assemble a production assistant on Google Cloud.
Cloud Run or GKE: the four questions that decide it
Most teams running GKE would be better served by Cloud Run, and a few running Cloud Run are fighting it. The decision is not about scale — it is about four specific requirements.
Security Command Center without the wall of findings
SCC Premium turns on and produces thousands of findings in an hour. Here is the triage order that gets an estate from "unreadable" to "twelve open items" in about three weeks.
Committed use discounts in Google Cloud, and the order to buy them in
CUDs come in two flavours that behave very differently, and buying the wrong one locks you to a machine family for three years. Here is the sequence we follow.
VPC Service Controls: the only real defence against data exfiltration in GCP, and why it is hard
IAM stops the wrong people reading your data. It does not stop the right people copying it somewhere else. Service perimeters do, and they will break things on the way in. Here is how to roll one out without an outage.
Terraform on Google Cloud: the patterns that hold and the traps in the provider
The google provider has behaviours that will surprise you the first time — authoritative IAM resources that wipe bindings, projects that will not delete, APIs that must be enabled before anything works. Here is the setup we use.