Public cloud:  What is a public cloud?

The cloud resources are owned and operated by a third-party cloud service provider and delivered over the Internet. With a public cloud, all hardware, software, and other supporting infrastructure are owned and managed by the cloud service provider. Lower costs – no need to purchase hardware or software, and you pay only for the service you use. Near-unlimited scalability – on-demand resources are available to meet your business needs.

Container Optimized OS: Container-Optimized OS Overview

Container-Optimized OS from Google is an operating system image for your Compute Engine VMs that is optimized for running Docker containers. Container-Optimized OS is maintained by Google and based on the open source Chromium OS project. With Container-Optimized OS, you can bring up your Docker containers on Google Cloud Platform quickly, efficiently, and securely.

• You pay based on usage:

There’s no upfront cost but has a recurring cost. You pay for a service or product as you use it i.e. pay-as-you-go pricing.

What Is OpEx?

• You can stop paying for on-premise licenses:

Leasing software and customized features – Using a pay-per-use model require actively managing subscriptions to ensure users do not misuse the services, and that provisioned accounts are being utilized and not wasted.

Capex vs Opex Cloud

If you need to grant a role to a user or group that spans across multiple projects, set that role at the folder level instead of setting it at the project level. Folders are a grouping mechanism and can contain projects, other folders, or a combination of both. Folders can be used to group resources that share common IAM policies.

Best practices

Anthos is a managed application platform that extends Google Cloud services and engineering practices to your environments so you can modernize apps faster and establish operational consistency across them.

Anthos enables you to run Kubernetes clusters anywhere, in both cloud and on-premises environments. You get consistent managed Kubernetes experience with simple installs as well as upgrades validated by Google.

Anthos is Google’s new managed applications platform, which lets you run Kubernetes and other workloads consistently, across on-premises data centers and multiple public clouds.

https://cloud.netapp.com/blog/gcp-cvo-blg-google-anthos-the-first-true-multi-cloud-platform

Compliance Reports Manager: Google Cloud’s industry-leading security, third-party audits and certifications, documentation, and contract commitments help support your compliance. Compliance reports manager provides you with easy, on-demand access to these critical compliance resources, at no additional cost. You can download reports directly via Compliance Reports Manager.

Apply to the Root Node: An Organization is the root node of the Google Cloud hierarchy of resources. When you apply the Root Node to the organization policy, you can define settings, permissions, and policies for all projects, folders, resources, and Cloud Billing accounts it parents​, etc to ensure that any current or future Virtual Machine has no external internet access.

You can set an IAM policy at the organization level, the folder level, the project level, or (in some cases) the resource level. Resources inherit the policies of the parent node. If you set a policy at the Organization level, it is inherited by all its child folders and projects, and if you set a policy at the project level, it is inherited by all its child resources.

Source: The Organization resource

Migrate for Compute Engine Test Clones:

You can use test clones to try out migrated VMs on Compute Engine before putting them in production. When you create a test clone, Migrate for Compute Engine clones the VM from the source platform, then moves the clone to Compute Engine for testing.

• Creating a test clone
• Migrate for Compute Engine 5.0 documentation

Cloud VPN:

Cloud VPN securely connects your peer network to your Virtual Private Cloud (VPC) network through an IPsec VPN connection. Traffic traveling between the two networks is encrypted by one VPN gateway and then decrypted by the other VPN gateway. This action protects your data as it travels over the internet. You can also connect two instances of Cloud VPN to each other.

According to the Google Cloud Documentation:

If you don't require the low latency and high availability of Cloud Interconnect, consider using Cloud VPN to set up IPsec VPN tunnels between your networks. IPsec VPN tunnels encrypt data by using industry-standard IPsec protocols as traffic traverses the public internet.

Using Cloud VPN instead

• CloudVPN requires no expensive carrier circuits or committed contracts
• CloudVPN allows you to build an encrypted connection over the Internet from a VPN device on-prem and GCP
• CloudVPN's transport is over the Internet, so the quality of the connection will be lower than you could get from a dedicated carrier circuit
• Cloud Interconnect involves purchasing a circuit between GCP and your on-prem facility, which can be very expensive on a monthly basis
• Cloud Interconnect is useful for companies who have to transfer a very large, constant flow of data between on-prem and GCP, and who require a very high quality of connection for that data flow between on-prem and GCP

Cloud VPN overview

• Physical datacenter:

The cloud service provider is responsible for the physical data centers.

Google Cloud’s shared responsibility model

• Hardware patching:

Google Cloud’s shared responsibility model states they are responsible for the underlying infrastructure, including hardware, firmware, kernel, OS, storage, network, and more.

Google Cloud’s shared responsibility model