Google Cloud architecture check

Projects provide useful trust, quota and lifecycle boundaries. A shared parent folder can carry common IAM or organization policies.

Budgets primarily provide monitoring and alerts. They do not automatically cap all spend unless you deliberately build automation, which has its own risks.

Workload Identity Federation exchanges a trusted external identity for short-lived Google credentials and avoids a downloaded service-account key.

A service account is both a principal and a resource. Permission to impersonate it can create an indirect access path to everything the account may access.

VPC networks are global resources; their subnetworks are regional resources.

Shared VPC separates network administration in a host project from workload ownership in attached service projects.

Cloud Run is a fully managed container application platform and fits stateless request-driven services without cluster management.

A job represents finite work that runs to completion and can be invoked on a schedule.

Kubernetes can reconcile workload resources, but the application must still externalize durable state, handle termination and expose meaningful health.

Cloud SQL is the managed relational service for PostgreSQL, MySQL and SQL Server. Schema, connection and recovery design remain team responsibilities.

Partition pruning and avoiding SELECT * reduce unnecessary scanned data, improving performance and cost.

Asynchronous delivery and retries mean consumers must account for duplicate processing and make side effects safe.

SLO and error-budget burn connect alerts to user-visible reliability and reduce noisy resource-only paging.

Availability is end-to-end. A zonal dependency can dominate the failure model even when the compute tier spans zones.

Google's Well-Architected Framework uses six pillars and encourages explicit trade-offs and operational readiness rather than a deployment-only view.