google-cloud-solution-architecture

<!-- Use this template to compile the content that you generate based on the
instructions in `SKILL.md`. -->

# Google Cloud solution architecture: [Workload Name]

## 1. Executive summary and workload overview
[A brief description of the workload, its business goals, and the high-level
solution architecture proposed.]

## 2. Requirements and current state

### 2.1. Functional requirements
* **Business processes**: [Details of the business processes supported]
* **Activities and use cases**: [Details of the key activities and use cases]

### 2.2. Non-functional requirements
* **Security**: [Details of the security requirements including compliance,
  encryption, access control requirements]
* **Reliability**: [Details of the reliability requirements including SLA,
  RTO/RPO, backup, redundancy requirements]
* **Cost**: [Details of the cost constraints and pricing models]
* **Operations**: [Details of the operational requirements including
  monitoring, logging, deployment, maintenance requirements]
* **Performance**: [Details of the performance requirements including latency,
  throughput, scaling requirements]
* **Sustainability**: [Details of the sustainability requirements including
  carbon footprint, resource optimization requirements]

### 2.3. Current state
[If applicable, describe the current on-premises or other-cloud architecture.]
* **Current infrastructure**: [Details of existing setup]
* **Pain points and drivers for migration/redesign**: [Details of the drivers
  for migration/redesign]

### 2.4. Dependencies
* **Internal dependencies**: [Details of internal dependencies including other
  workloads and internal services]
* **External dependencies**: [Details of external dependencies including
  third-party products and on-premises tools]

## 3. Technical decomposition of the workload
[Technical decomposition of the workload components, breaking down the
application into logical services or layers.]

## 4. Proposed solution architecture

### 4.1. Google Cloud products and features mapping
[Identify Google Cloud products and features mapped to the technical
components. For each component, justify the selection, note alternatives
considered, and describe the pros and cons of the recommended product/feature
and alternatives.]

| Component | Recommended Google Cloud product/feature | Justification and citations | Alternatives considered | Pros and cons of alternatives |
| :--- | :--- | :--- | :--- | :--- |
| **[Component Name]** | **[Product Name]** | [Why this product is chosen, citing official docs] | [Alternative product] | **Pros**: ... <br> **Cons**: ... |

### 4.2. Architecture diagram
[Architecture diagram in Mermaid format showing the relationships and flows
between the components of the architecture.]

```mermaid
%% Example structure
graph TD
    User([User]) --> Web[Load Balancer]
    Web --> App[Application Layer]
    App --> DB[(Database)]
```

### 4.3. Architecture description
[Detailed description of the architecture. Describe the task flow and data
flow between the components of the architecture.]
* **Data flow**: [Describe the flow of data.]
* **Tasks/control flow**: [Describe the flow of tasks/control.]

## 5. Design and configuration recommendations
[Best practices and configuration recommendations for each pillar of the
Google Cloud Architecture Framework.]

### 5.1. Security, privacy, and compliance
* **Access control**: [E.g., IAM roles, least privilege policy]
* **Data protection**: [E.g., Encryption at rest/in transit, Cloud KMS]
* **Network Security**: [E.g., VPC, Firewalls, Cloud Armor, Private Service Connect]

### 5.2. Reliability
* **Redundant deployment**: [E.g., Multi-region/regional deployment, load
balancing]
* **Backup and DR**: [E.g., Backups, failover procedures, RTO/RPO strategies]

### 5.3. Operational excellence
* **Monitoring and logging**: [E.g., Cloud Logging, Cloud Monitoring, Dashboards]
* **Infrastructure as Code (IaC)**: [E.g., Terraform, Deployment Manager]

### 5.4. Cost optimization
* **Sizing and scaling**: [E.g., Autoscaling configuration, right-sizing resources]
* **Pricing models**: [E.g., Commitment discounts, Spot VMs, flat-rate pricing]

### 5.5. Performance efficiency
* **Caching and CDN**: [E.g., Cloud CDN, Memorystore]
* **Database and query optimization**: [E.g., Partitioning, indexing, caching]

### 5.6. Sustainability
* [E.g., Serverless adoption, resource utilization, carbon footprint]

## 6. Deployment guidance
[Instructions and code for deploying the architecture.]

### 6.1. Deployment prerequisites
* [Prerequisite 1: E.g., Enabling APIs]
* [Prerequisite 2: E.g., Installing SDK/tools]
* ...and so on

### 6.2. Step-by-step deployment instructions
1. [Step 1: E.g., Authenticate with Google Cloud]
2. [Step 2: E.g., Initialize Terraform]
3. [Step 3: E.g., Apply Terraform configuration]

## 7. Validation plan
[Details of the steps to verify that the generated solution meets the workload's
 requirements. Also include references to any validation scripts that were
 generated.]

## 8. References
* [E.g., Horizontal scalability](https://docs.cloud.google.com/architecture/framework/reliability/horizontal-scalability)
* [E.g., Regional managed instance groups](https://docs.cloud.google.com/compute/docs/instance-groups/regional-migs)

# Architecture guides

| Technology category | Brief description | Line hints |
|---------------------|-------------------|------------|
| [Fundamentals](#fundamentals) | Design guides, reference architectures, and best practices for foundational cloud architectures, landing zones, and deployment archetypes. | Lines 19-46 |
| [AI and ML](#ai-ml) | Design guides, reference architectures, and best practices for AI, MLOps, generative AI, and agentic workflows. | Lines 47-98 |
| [Application development](#application-development) | Design guides, reference architectures, and best practices for building, deploying, and running applications in the cloud. | Lines 99-132 |
| [Security, privacy, and compliance](#security-privacy-and-compliance) | Design guides, reference architectures, and best practices for security, privacy, and compliance. | Lines 133-207 |
| [Reliability and disaster recovery](#reliability-and-disaster-recovery) | Design guides, reference architectures, and best practices for reliability and disaster recovery. | Lines 208-230 |
| [Data and analytics](#data-and-analytics) | Design guides, reference architectures, and best practices for data warehousing, data mesh, data analytics, and data streaming. | Lines 231-248 |
| [Databases](#databases) | Design guides, reference architectures, and best practices for planning and implementing databases for cloud workloads. | Lines 249-268 |
| [Migration](#migration) | Methodologies, assessment frameworks, and guides for migrating VMs, databases, and applications to Google Cloud. | Lines 269-295 |
| [Networking](#networking) | Design guides, reference architectures, and best practices for planning and implementing networking for cloud workloads. | Lines 296-315 |
| [Hybrid, multi-cloud, and distributed cloud](#hybrid-multi-cloud-and-distributed-cloud) | Design guides, reference architectures, and best practices for hybrid, multi-cloud, and distributed cloud environments. | Lines 316-337 |
| [Financial services](#financial-services) | Design guides, reference architectures, and best practices for financial services workloads. | Lines 338-341 |
| [Monitoring and logging](#monitoring-and-logging) | Best practices and operational patterns for observability, log streaming, and infrastructure monitoring. | Lines 342-354 |
| [Storage](#storage) | Design guides, reference architectures, and best practices to help you plan and implement storage for cloud workloads. | Lines 355-361 |

## <a id="fundamentals"></a>Fundamentals

- [Authentication and authorization](https://docs.cloud.google.com/architecture/blueprints/security-foundations/authentication-authorization.md.txt): Introduces how to use Cloud Identity to manage identities for accessing Google Cloud services.
- [Comparative analysis of Google Cloud deployment archetypes](https://docs.cloud.google.com/architecture/deployment-archetypes/comparison.md.txt): Compares the cloud deployment archetypes in terms of the availability they provide, resilience to zone and region outages, cost, and operational complexity.
- [Decide a resource hierarchy for your Google Cloud landing zone](https://docs.cloud.google.com/architecture/landing-zones/decide-resource-hierarchy.md.txt): Provides guidance to help you decide the resource hierarchy for your Google Cloud landing zone.
- [Decide how to onboard identities to Google Cloud](https://docs.cloud.google.com/architecture/landing-zones/decide-how-to-onboard-identities.md.txt): Describes identity provisioning options for Google Cloud and the decisions that you must make when you onboard your users to Cloud Identity or Google Workspace.
- [Decide the network design for your Google Cloud landing zone](https://docs.cloud.google.com/architecture/landing-zones/decide-network-design.md.txt): Describes common network designs for landing zones, and helps you choose the option that best meets your requirements.
- [Decide the security for your Google Cloud landing zone](https://docs.cloud.google.com/architecture/landing-zones/decide-security.md.txt): Provides guidance to help you decide the security design for your Google Cloud landing zone.
- [Deploy the blueprint](https://docs.cloud.google.com/architecture/blueprints/security-foundations/summary.md.txt): Describes the process to deploy an enterprise foundation using a blueprint.
- [Deployment methodology](https://docs.cloud.google.com/architecture/blueprints/security-foundations/deployment-methodology.md.txt): Provides guidance to use declarative infrastructure to deploy an enterprise foundations blueprint.
- [Detective controls](https://docs.cloud.google.com/architecture/blueprints/security-foundations/detective-controls.md.txt): Describes the threat detection and monitoring controls that are incorporated into an enterprise foundations blueprint.
- [Enterprise foundations blueprint](https://docs.cloud.google.com/architecture/blueprints/security-foundations.md.txt): Describes a blueprint to deploy foundational resources, configurations, and capabilities to help ensure consistent governance, security, scaling, and observability for your workloads in Google Cloud.
- [Google Cloud deployment archetypes](https://docs.cloud.google.com/architecture/deployment-archetypes.md.txt): Describes the deployment archetypes that you can use for cloud applications, the use cases for each deployment archetype and the design considerations.
- [Google Cloud global deployment archetype](https://docs.cloud.google.com/architecture/deployment-archetypes/global.md.txt): Describes the global deployment archetype, and its use cases and design considerations.
- [Google Cloud hybrid deployment archetype](https://docs.cloud.google.com/architecture/deployment-archetypes/hybrid.md.txt): Describes the hybrid deployment archetype, and its use cases and design considerations.
- [Google Cloud multi-regional deployment archetype](https://docs.cloud.google.com/architecture/deployment-archetypes/multiregional.md.txt): Describes the multi-regional deployment archetype, and its use cases and design considerations.
- [Google Cloud multicloud deployment archetype](https://docs.cloud.google.com/architecture/deployment-archetypes/multicloud.md.txt): Describes the multicloud deployment archetype, and its use cases and design considerations.
- [Google Cloud regional deployment archetype](https://docs.cloud.google.com/architecture/deployment-archetypes/regional.md.txt): Describes the regional deployment archetype, and its use cases and design considerations.
- [Google Cloud zonal deployment archetype](https://docs.cloud.google.com/architecture/deployment-archetypes/zonal.md.txt): Describes the zonal deployment archetype, and its use cases and design considerations.
- [Implement your Google Cloud landing zone network design](https://docs.cloud.google.com/architecture/landing-zones/implement-network-design.md.txt): Provides steps and guidance to implement your chosen network design for your landing zone.
- [Landing zone design in Google Cloud](https://docs.cloud.google.com/architecture/landing-zones.md.txt): This series shows how to design and build a landing zone in Google Cloud, guiding you through high-level decisions about identity onboarding, resource hierarchy, network design, and security.
- [Operations best practices](https://docs.cloud.google.com/architecture/blueprints/security-foundations/operation-best-practices.md.txt): Provides best practices for deploying and operating workloads in a Google Cloud environment that&#39;s based on an enterprise foundations blueprint.
- [Organization structure](https://docs.cloud.google.com/architecture/blueprints/security-foundations/organization-structure.md.txt): Describes how the resources in an enterprise foundations blueprint are organized.
- [Preventative controls for acceptable resource configurations](https://docs.cloud.google.com/architecture/blueprints/security-foundations/preventative-controls.md.txt): Describes preventative controls that you can incorporate into an enterprise foundations blueprint.
- [Well-Architected Framework: Cost optimization pillar](https://docs.cloud.google.com/architecture/framework/cost-optimization/printable.md.txt): Provides principles and recommendations to help you optimize the cost of your workloads in Google Cloud.
- [Well-Architected Framework: Performance optimization pillar](https://docs.cloud.google.com/architecture/framework/performance-optimization/printable.md.txt): Provides principles and recommendations to help you optimize the performance of your workloads in Google Cloud.
- [Well-Architected Framework: Sustainability pillar](https://docs.cloud.google.com/architecture/framework/sustainability/printable.md.txt): Provides principles and recommendations to help you design, build, and manage workloads in Google Cloud that are energy-efficient and carbon-aware.

## <a id="ai-ml"></a>AI and ML

- [Agentic AI use case: Administer interactive learning](https://docs.cloud.google.com/architecture/agentic-ai-interactive-learning.md.txt): Design a single-agent AI system that assesses a user&#39;s knowledge on a specific topic and generates a personalized learning experience.
- [Agentic AI use case: Automate data science workflows](https://docs.cloud.google.com/architecture/agentic-ai-data-science.md.txt): Design a multi-agent AI system that automates complex data analytics and machine learning tasks.
- [Agentic AI use case: Build a multicloud open data lakehouse](https://docs.cloud.google.com/architecture/agentic-ai-build-multicloud-open-data-lakehouse.md.txt): A high-level architecture to build a multicloud open data lakehouse that establishes a highly governed, secure pipeline from raw multicloud silos to AI and agentic driven actions.
- [Agentic AI use case: Classify multimodal data](https://docs.cloud.google.com/architecture/agentic-ai-classify-multimodal-data.md.txt): A high-level architecture to design a multi-agent AI system that analyzes disparate multimodal data and produces a high-confidence classification.
- [Agentic AI use case: Enable live bidirectional multimodal streaming](https://docs.cloud.google.com/architecture/agentic-ai-bidirectional-multimodal-streaming.md.txt): A high-level architecture to build and deploy a multi-agent AI system that provides technical guidance and automated safety monitoring through a continuous, bidirectional stream of multimodal data.
- [Agentic AI use case: Multimodal GraphRAG resource orchestration](https://docs.cloud.google.com/architecture/agentic-ai-multimodal-graph-rag-resource-orchestration.md.txt): A high-level architecture to build and deploy a multi-agent AI system that consolidates fragmented multimodal data into a searchable knowledge graph.
- [Agentic AI use case: Orchestrate access to disparate enterprise systems](https://docs.cloud.google.com/architecture/agenticai-orchestrate-access-disparate-systems.md.txt): Use agentic AI to orchestrate access to disparate enterprise systems.
- [Agentic AI use case: Orchestrate security operations workflows](https://docs.cloud.google.com/architecture/agentic-ai-orchestrate-security-ops-workflows.md.txt): A high-level architecture to build a multi-agent AI system that orchestrates complex investigation and triage processes in a security operations center (SOC).
- [Architecture for MLOps using TensorFlow Extended, Agent Platform Pipelines, and Cloud Build](https://docs.cloud.google.com/architecture/architecture-for-mlops-using-tfx-kubeflow-pipelines-and-cloud-build.md.txt): Describes the architecture of a machine learning (ML) system using TensorFlow Extended (TFX) libraries.
- [Automate utilization-review of health insurance claims using generative AI](https://docs.cloud.google.com/architecture/use-generative-ai-utilization-management.md.txt): A reference architecture for health insurance companies to automate prior authorization (PA) request processing and improve their utilization review (UR) processes.
- [Best practices for implementing machine learning on Google Cloud](https://docs.cloud.google.com/architecture/ml-on-gcp-best-practices.md.txt): Introduces best practices for implementing machine learning (ML) on Google Cloud, with a focus on custom-trained models based on your data and code.
- [Build an ML vision analytics solution with Dataflow and Cloud Vision API](https://docs.cloud.google.com/architecture/building-a-vision-analytics-solution.md.txt): How to deploy a Dataflow pipeline to process large-scale image files with Cloud Vision. Dataflow stores the results in BigQuery so that you can use them to train BigQuery ML pre-built models.
- [Build and deploy generative AI and machine learning models in an enterprise](https://docs.cloud.google.com/architecture/blueprints/genai-mlops-blueprint.md.txt): Describes the generative AI and machine learning (ML) blueprint, which deploys a pipeline for creating AI models.
- [Build trusted AI agents with Google Maps Platform](https://docs.cloud.google.com/architecture/agentic-ai-system-with-grounding-using-maps.md.txt): A high-level architecture to build trusted and effective AI agents by grounding them in real-world contextual data from Google Maps Platform and Google Calendar.
- [C3 AI architecture on Google Cloud](https://docs.cloud.google.com/architecture/partners/c3-ai-architecture.md.txt): Develop applications using C3 AI and Google Cloud.
- [Choose a design pattern for your agentic AI system](https://docs.cloud.google.com/architecture/choose-design-pattern-agentic-ai-system.md.txt): Learn how to select an agent design pattern to build your agentic system.
- [Choose your agentic AI architecture components](https://docs.cloud.google.com/architecture/choose-agentic-ai-architecture-components.md.txt): Learn how to select architecture components to build your agentic AI system.
- [Confidential computing for data analytics, AI, and federated learning](https://docs.cloud.google.com/architecture/security/confidential-computing-analytics-ai.md.txt): &#34;Learn about how you can use confidential computing in Google Cloud to encrypt data in use for confidential data analytics, AI machine learning, and federated learning.&#34;
- [Cross-silo and cross-device federated learning on Google Cloud](https://docs.cloud.google.com/architecture/cross-silo-cross-device-federated-learning-google-cloud.md.txt): Provides guidance to help you create a federated learning platform that supports either a cross-silo or cross-device architecture.
- [Delete the Generative AI document summarization](https://docs.cloud.google.com/architecture/ai-ml/generative-ai-document-summarization.md.txt): Delete the Generative AI document summarization Jump Start Solution.
- [Delete the Generative AI Knowledge Base](https://docs.cloud.google.com/architecture/ai-ml/generative-ai-knowledge-base.md.txt): Delete the Generative AI Knowledge Base Jump Start Solution.
- [Delete the Generative AI RAG with Cloud SQL](https://docs.cloud.google.com/architecture/ai-ml/generative-ai-rag.md.txt): Delete the Generative AI RAG with Cloud SQL Jump Start Solution.
- [Deploy an ML vision analytics solution with Dataflow and Cloud Vision API](https://docs.cloud.google.com/architecture/building-a-vision-analytics-solution/deployment.md.txt): Describes how to deploy a Dataflow pipeline that processes image files at scale with Cloud Vision API and then stores the processed output in BigQuery for analytics and model training.
- [Deploy and operate generative AI applications](https://docs.cloud.google.com/architecture/deploy-operate-generative-ai-applications.md.txt): Discusses techniques for building and operating generative AI applications using MLOps and DevOps principles.
- [Generative AI use case: Generate content for personalized marketing campaigns](https://docs.cloud.google.com/architecture/genai-marketing-campaigns.md.txt): Use AI to generate personalized content for targeted marketing campaigns.
- [Generative AI use case: Generate personalized product recommendations](https://docs.cloud.google.com/architecture/genai-product-recommendations.md.txt): Use AI to generate personalized product recommendations for a retail application.
- [Generative AI use case: Generate podcasts from audio files](https://docs.cloud.google.com/architecture/genai-podcasts-from-commentary.md.txt): Use AI to generate podcasts based on audio input.
- [Generative AI use case: Generate solutions for customer-support questions](https://docs.cloud.google.com/architecture/genai-customer-support.md.txt): Use AI to generate responses to support questions from customers.
- [Generative AI with RAG](https://docs.cloud.google.com/architecture/rag-reference-architectures.md.txt): Provides a list of reference architectures to deploy generative AI applications with retrieval-augmented generation (RAG) in Google Cloud.
- [GraphRAG infrastructure for generative AI using Agent Platform and Spanner Graph](https://docs.cloud.google.com/architecture/gen-ai-graphrag-spanner.md.txt): Design infrastructure for a generative AI application with GraphRAG using Spanner Graph.
- [Guidelines for developing high-quality, predictive ML solutions](https://docs.cloud.google.com/architecture/guidelines-for-developing-high-quality-ml-solutions.md.txt): Collates some guidelines to help you assess, ensure, and control quality in machine learning (ML) solutions.
- [Harness CI/CD pipeline for RAG applications](https://docs.cloud.google.com/architecture/partners/harness-cicd-pipeline-for-rag-app.md.txt): Shows you how to implement a Harness CI/CD pipeline for a RAG-capable application in Google Cloud.
- [Implement agentic analytics workflows for distributed data](https://docs.cloud.google.com/architecture/agentic-ai-cross-cloud-analytics.md.txt): A high-level architecture for implementing cross-cloud analytics workflows that use AI agents.
- [Implement two-tower retrieval for large-scale candidate generation](https://docs.cloud.google.com/architecture/implement-two-tower-retrieval-large-scale-candidate-generation.md.txt): Learn how to implement an end-to-end two-tower candidate generation workflow with Vertex AI.
- [MLOps: Continuous delivery and automation pipelines in machine learning](https://docs.cloud.google.com/architecture/mlops-continuous-delivery-and-automation-pipelines-in-machine-learning.md.txt): Discusses techniques for implementing and automating continuous integration (CI), continuous delivery (CD), and continuous training (CT) for machine learning (ML) systems.
- [Model development and data labeling with Google Cloud and Labelbox](https://docs.cloud.google.com/architecture/partners/model-development-data-labeling-labelbox-google-cloud.md.txt): Provides guidance for building a standardized pipeline to help accelerate the development of ML models.
- [Multi-agent AI system in Google Cloud](https://docs.cloud.google.com/architecture/multiagent-ai-system.md.txt): Design robust multi-agent AI systems in Google Cloud.
- [Multi-tenant agentic AI system](https://docs.cloud.google.com/architecture/multi-tenant-agentic-ai-system.md.txt): Design a multi-tenant agentic AI system on Google Cloud.
- [Networking for AI inference model serving on all backends](https://docs.cloud.google.com/architecture/networking-for-ai-inference.md.txt): Guidance to help you create a unified frontend for multiple AI models that are hosted on-premises or by any provider, including third-party and Google Cloud.
- [Networking for AI inference model serving on GKE](https://docs.cloud.google.com/architecture/networking-for-ai-inference-gke.md.txt): Guidance to help you create a multiple-model inference service using GKE.
- [Optimize AI and ML workloads with Cloud Storage FUSE](https://docs.cloud.google.com/architecture/optimize-ai-ml-workloads-cloud-storage-fuse.md.txt): Use Cloud Storage FUSE to optimize the performance of AI and ML workloads.
- [Optimize AI and ML workloads with Google Cloud Managed Lustre](https://docs.cloud.google.com/architecture/optimize-ai-ml-workloads-managed-lustre.md.txt): Shows how to use Managed Lustre to optimize the performance of AI and ML workloads.
- [Private connectivity for RAG-capable generative AI applications](https://docs.cloud.google.com/architecture/private-connectivity-rag-capable-gen-ai.md.txt): Implement network infrastructure to help improve security for your RAG-capable applications.
- [RAG infrastructure for generative AI using Agent Platform and AlloyDB for PostgreSQL](https://docs.cloud.google.com/architecture/rag-capable-gen-ai-app-using-vertex-ai.md.txt): Design infrastructure to run a generative AI application with retrieval-augmented generation using AlloyDB as the vector store.
- [RAG infrastructure for generative AI using Agent Platform and Vector Search](https://docs.cloud.google.com/architecture/gen-ai-rag-vertex-ai-vector-search.md.txt): Design infrastructure for a generative AI application with retrieval-augmented generation (RAG) using the vector search capabilities of Gemini Enterprise Agent Platform.
- [RAG infrastructure for generative AI using Gemini Enterprise and Agent Platform](https://docs.cloud.google.com/architecture/rag-genai-gemini-enterprise-vertexai.md.txt): Design infrastructure for a generative AI application with retrieval-augmented generation (RAG) using Gemini Enterprise and Gemini Enterprise Agent Platform.
- [RAG infrastructure for generative AI using GKE and Cloud SQL](https://docs.cloud.google.com/architecture/rag-capable-gen-ai-app-using-gke.md.txt): Shows you how to design the infrastructure for a generative AI application with RAG using GKE.
- [Single-agent AI system using ADK and Cloud Run](https://docs.cloud.google.com/architecture/single-agent-ai-system-adk-cloud-run.md.txt): Shows you how to build a single-agent AI system by using ADK and Cloud Run with Gemini and MCP.
- [Well-Architected Framework: AI and ML perspective](https://docs.cloud.google.com/architecture/framework/perspectives/ai-ml/printable.md.txt): Provides principles and recommendations to help you design, build, and manage AI and ML workloads in Google Cloud that meet your operational, security, reliability, cost, and performance goals.

## <a id="application-development"></a>Application development

- [Architecture decision records overview](https://docs.cloud.google.com/architecture/architecture-decision-records.md.txt): Explains when and how to use architecture decision records (ADRs) to document and explain design choices for applications on Google Cloud.
- [Best practices for automatically provisioning and configuring edge and bare metal systems and servers](https://docs.cloud.google.com/architecture/connected-devices/best-practices-provisioning-configuring-bare-metal.md.txt): Describes best practices for automatically provisioning and configuring edge devices and bare metal systems and servers.
- [Best practices for running cost-optimized Kubernetes applications on GKE](https://docs.cloud.google.com/architecture/best-practices-for-running-cost-effective-kubernetes-applications-on-gke.md.txt): Discusses best practices for running cost-optimized applications on Google Kubernetes Engine (GKE).
- [CI/CD pipeline for developing and delivering containerized apps](https://docs.cloud.google.com/architecture/app-development-and-delivery-with-cloud-code-gcb-cd-and-gke.md.txt): Describes how to set up and use a development, continuous integration (CI), and continuous delivery (CD) system using an integrated set of Google Cloud tools.
- [Configure Active Directory for VMs to automatically join a domain](https://docs.cloud.google.com/architecture/configuring-active-directory-for-vms-to-automatically-join-the-domain.md.txt): Shows you how to configure Active Directory and Compute Engine so that Windows virtual machine (VM) instances can automatically join an Active Directory domain.
- [Connected device architectures on Google Cloud](https://docs.cloud.google.com/architecture/connected-devices.md.txt): An overview on a series of approaches for connected device IoT architectures on Google Cloud.
- [Cymbal Bank application architecture](https://docs.cloud.google.com/architecture/blueprints/enterprise-application-blueprint/cymbal-bank.md.txt): Describes a sample containerized application that incorporates best practices from a blueprint for an enterprise developer platform.
- [Delete the Cloud SDK Client Library](https://docs.cloud.google.com/architecture/application-development/cloud-client-api.md.txt): Delete the Cloud SDK Client Library Jump Start Solution.
- [Delete the Dynamic web application with Python and JavaScript](https://docs.cloud.google.com/architecture/application-development/dynamic-app-python.md.txt): Delete the Dynamic web application with Python and JavaScript Jump Start Solution.
- [Delete the Ecommerce platform with serverless computing](https://docs.cloud.google.com/architecture/application-development/ecommerce-serverless.md.txt): Delete the Ecommerce platform with serverless computing Jump Start Solution.
- [Delete the Three-tier web app](https://docs.cloud.google.com/architecture/application-development/three-tier-web-app.md.txt): Delete the three-tier web app.
- [Deploy an Active Directory forest on Compute Engine](https://docs.cloud.google.com/architecture/deploy-an-active-directory-forest-on-compute-engine.md.txt): Shows you how to deploy an Active Directory forest on Compute Engine in a way that follows the best practices.
- [Deploy an enterprise developer platform on Google Cloud](https://docs.cloud.google.com/architecture/blueprints/enterprise-application-blueprint.md.txt): Describes the enterprise application blueprint, which deploys an internal developer platform that provides managed software development and delivery.
- [Deploy the blueprint](https://docs.cloud.google.com/architecture/blueprints/enterprise-application-blueprint/deploy-blueprint.md.txt): Describes the steps to deploy a blueprint for an enterprise developer platform.
- [Deployment methodology](https://docs.cloud.google.com/architecture/blueprints/enterprise-application-blueprint/deployment-methodology.md.txt): Describes the automated systems and pipelines that are used to deploy a blueprint for an enterprise developer platform.
- [Develop and deploy containerized apps using a CI/CD pipeline](https://docs.cloud.google.com/architecture/app-development-and-delivery-with-cloud-code-gcb-cd-and-gke/deployment.md.txt): Describes how to design and deploy a system for continuous integration (CI) and continuous delivery (CD) by using an integrated set of Google Cloud services and tools.
- [DevOps capabilities](https://docs.cloud.google.com/architecture/devops.md.txt)
- [From edge to multi-cluster mesh: Deploy globally distributed applications through GKE Gateway and Cloud Service Mesh](https://docs.cloud.google.com/architecture/build-apps-using-gateway-and-cloud-service/deployment.md.txt): Shows how to deploy globally distributed applications that are exposed through Google Kubernetes Engine (GKE) Gateway and Cloud Service Mesh.
- [From edge to multi-cluster mesh: Globally distributed applications exposed through GKE Gateway and Cloud Service Mesh](https://docs.cloud.google.com/architecture/build-apps-using-gateway-and-cloud-service.md.txt): Describes exposing applications externally through Google Kubernetes Engine (GKE) Gateways running on multiple GKE clusters within a service mesh.
- [IoT platform product architecture on Google Cloud](https://docs.cloud.google.com/architecture/connected-devices/iot-platform-product-architecture.md.txt): Describes basic architectural considerations and recommendations for deploying an IoT platform product architecture on Google Cloud.
- [Manage costs and attributions for the developer platform](https://docs.cloud.google.com/architecture/blueprints/enterprise-application-blueprint/manage-costs-attributions.md.txt): Provide guidance to manage costs when using a blueprint for an enterprise developer platform.
- [Multi-regional deployment on Compute Engine](https://docs.cloud.google.com/architecture/multiregional-vms.md.txt): Provides a reference architecture for a multi-tier application that runs on Compute Engine VMs in multiple regions and describes the design factors to consider when you build a multi-regional architecture.
- [Reference architecture: Resource management with ServiceNow](https://docs.cloud.google.com/architecture/resource-management-with-servicenow.md.txt): Provides architectural recommendations to integrate Google Cloud assets into ServiceNow discovery tools.
- [Regional deployment on Compute Engine](https://docs.cloud.google.com/architecture/regional-deployment-compute-engine.md.txt): Learn how to architect a multi-tier application that runs on Compute Engine VMs in multiple zones within a Google Cloud region.
- [Select a managed container runtime environment](https://docs.cloud.google.com/architecture/select-managed-container-runtime-environment.md.txt): Learn about managed runtime environments and assess your requirements to choose between Cloud Run and GKE Autopilot.
- [Service architecture](https://docs.cloud.google.com/architecture/blueprints/enterprise-application-blueprint/service-architecture.md.txt): Describes the service architecture of a blueprint for an enterprise developer platform.
- [Set up Chrome Remote Desktop for Linux on Compute Engine](https://docs.cloud.google.com/architecture/chrome-desktop-remote-on-compute-engine.md.txt): Shows you how to set up the Chrome Remote Desktop service on a Debian Linux virtual machine (VM) instance on Compute Engine. Chrome Remote Desktop allows you to remotely access applications with a graphical user interface.
- [Set up Chrome Remote Desktop for Windows on Compute Engine](https://docs.cloud.google.com/architecture/chrome-desktop-remote-windows-compute-engine.md.txt): Shows you how to set up the Chrome Remote Desktop service on a Microsoft Windows virtual machine (VM) instance on Compute Engine. Chrome Remote Desktop allows you to remotely access applications with a graphical user interface.
- [Single-zone deployment on Compute Engine](https://docs.cloud.google.com/architecture/single-zone-deployment-compute-engine.md.txt): Provides a reference architecture for a multi-tier application that runs on Compute Engine VMs in a single-zone region and describes the design factors to consider when you build a single-zone architecture.
- [Standalone MQTT broker architecture on Google Cloud](https://docs.cloud.google.com/architecture/connected-devices/mqtt-broker-architecture.md.txt): Describes an architecture for deploying an MQTT broker (the core application in an MQTT deployment) on Google Cloud.
- [Website hosting](https://docs.cloud.google.com/architecture/web-serving-overview.md.txt): How to host a website on Google Cloud. Google Cloud provides a robust, flexible, reliable, and scalable platform for serving websites.

## <a id="security-privacy-and-compliance"></a>Security, privacy, and compliance

- [Active Directory single sign-on](https://docs.cloud.google.com/architecture/identity/federating-gcp-with-active-directory-configuring-single-sign-on.md.txt): Shows how to set up single sign-on (SSO) between your Active Directory environment and your Cloud Identity or Google Workspace account by using Microsoft Active Directory Federation Services (AD FS) and SAML Federation.
- [Active Directory user account provisioning](https://docs.cloud.google.com/architecture/identity/federating-gcp-with-active-directory-synchronizing-user-accounts.md.txt): Shows how to set up user and group provisioning between Active Directory and your Cloud Identity or Google Workspace account by using Google Cloud Directory Sync (GCDS).
- [Architecture patterns](https://docs.cloud.google.com/architecture/hybrid-multicloud-secure-networking-patterns/architecture-patterns.md.txt): Discusses patterns that are designed based on the required communication models between applications residing in Google Cloud and in other environments.
- [Assess existing user accounts](https://docs.cloud.google.com/architecture/identity/assessing-existing-user-accounts.md.txt): Describes how to assess different types of existing user accounts when you&#39;re planning to manage identities across an organization.
- [Assess onboarding plans](https://docs.cloud.google.com/architecture/identity/assessing-onboarding-plans.md.txt): Provides guidance to onboard existing identities and new identities to Cloud Identity or Google Workspace.
- [Assess the impact of user account consolidation on federation](https://docs.cloud.google.com/architecture/identity/assessing-consolidation-impact-on-federation.md.txt): Describes how to assess the impact of user account consolidation on identity federation.
- [Automate malware scanning for files uploaded to Cloud Storage](https://docs.cloud.google.com/architecture/automate-malware-scanning-for-documents-uploaded-to-cloud-storage.md.txt): This document shows you how to build an event-driven pipeline that can help you automate the evaluation of files for malicious code.
- [Best practices for continuous access to Google Cloud](https://docs.cloud.google.com/architecture/security/best-practices-continuous-access-to-google-cloud.md.txt): Describes best practices for emergency access and IdP failover to ensure continuous access to Google Cloud.
- [Best practices for federating Google Cloud with an external identity provider](https://docs.cloud.google.com/architecture/identity/best-practices-for-federating.md.txt): Describes best practices for federating Google Cloud with an external identity provider.
- [Best practices for mitigating compromised OAuth tokens for Google Cloud CLI](https://docs.cloud.google.com/architecture/bps-for-mitigating-gcloud-oauth-tokens.md.txt): Describes how to mitigate the impact of an attacker compromising the OAuth tokens that are used by the gcloud CLI.
- [Best practices for planning accounts and organizations](https://docs.cloud.google.com/architecture/identity/best-practices-for-planning.md.txt): Provides guidance to determine the number of Cloud Identity or Google Workspace accounts, Google Cloud organizations, and billing accounts you need based on your security and organizational requirements.
- [Best practices for protecting against cryptocurrency mining attacks](https://docs.cloud.google.com/architecture/security/bps-for-protecting-against-crytocurrency-attacks.md.txt): Describes best practices for protecting against cryptocurrency mining attacks.
- [Best practices for running an IoT backend on Google Cloud](https://docs.cloud.google.com/architecture/connected-devices/bps-running-iot-backend-securely.md.txt): Describes best practices for running an IoT backend on Google Cloud.
- [Best practices for securing apps and resources by using context-aware access](https://docs.cloud.google.com/architecture/secure-apps-resources-using-context-aware-access/best-practices.md.txt): Describes best practices for using context-aware access to secure apps and resources.
- [Best practices for securing your applications and APIs using Apigee](https://docs.cloud.google.com/architecture/best-practices-securing-applications-and-apis-using-apigee.md.txt): Describes best practices that can help you to secure your applications and APIs using Apigee API management, Google Cloud Armor, reCAPTCHA Enterprise, and Cloud CDN.
- [Configure networks for FedRAMP and DoD in Google Cloud](https://docs.cloud.google.com/architecture/configure-networks-fedramp-dod-google-cloud.md.txt): Provides configuration guidance to help you to comply with design requirements for FedRAMP High and DoD IL2, IL4, and IL5 when you deploy Google Cloud networking policies.
- [De-identification and re-identification of PII in large-scale datasets using Sensitive Data Protection](https://docs.cloud.google.com/architecture/de-identification-re-identification-pii-using-cloud-dlp.md.txt): Discusses how to use Sensitive Data Protection to create an automated data transformation pipeline to de-identify sensitive data like personally identifiable information (PII).
- [Deploy a secured serverless architecture using Cloud Run functions](https://docs.cloud.google.com/architecture/blueprints/serverless-functions-blueprint.md.txt): Provides guidance on how to help protect serverless applications that use Cloud Functions (2nd gen) by layering additional controls onto your existing foundation.
- [Deploy a secured serverless architecture using Cloud Run](https://docs.cloud.google.com/architecture/blueprints/serverless-blueprint.md.txt): Provides guidance on how to help protect serverless applications that use Cloud Run by layering additional controls onto your existing foundation.
- [Deploy automated malware scanning for files uploaded to Cloud Storage](https://docs.cloud.google.com/architecture/automate-malware-scanning-for-documents-uploaded-to-cloud-storage/deployment.md.txt): Describes how to deploy an architecture for automated malware scanning of data in Cloud Storage.
- [Design considerations](https://docs.cloud.google.com/architecture/hybrid-multicloud-secure-networking-patterns/design-considerations.md.txt): Discusses some of the most common design considerations to analyze and take into account as part of your hybrid and multicloud networking design.
- [Design secure deployment pipelines](https://docs.cloud.google.com/architecture/design-secure-deployment-pipelines-bp.md.txt): Describes best practices for designing secure deployment pipelines based on your confidentiality, integrity, and availability requirements.
- [Evict consumer accounts](https://docs.cloud.google.com/architecture/identity/evicting-consumer-accounts.md.txt): Describes how to mitigate social engineering risks by removing (evicting) corporate email addresses from consumer accounts.
- [Example announcement](https://docs.cloud.google.com/architecture/identity/example-announcement.md.txt): Provides an example of an email to announce the migration of consumer accounts to managed accounts.
- [Federate Google Cloud with Active Directory](https://docs.cloud.google.com/architecture/identity/federating-gcp-with-active-directory-introduction.md.txt): Describes how you can configure Cloud Identity or Google Workspace to use Active Directory as IdP and authoritative source.
- [Federate Google Cloud with Microsoft Entra ID (formerly Azure AD)](https://docs.cloud.google.com/architecture/identity/federating-gcp-with-azure-active-directory.md.txt): Describes how to configure Cloud Identity or Google Workspace to use Microsoft Entra ID as the IdP and source for identities.
- [FortiGate architecture in Google Cloud](https://docs.cloud.google.com/architecture/partners/fortigate-architecture-in-cloud.md.txt): Describes the overall concepts around deploying a FortiGate Next Generation Firewall (NGFW) in Google Cloud.
- [Gated egress and gated ingress](https://docs.cloud.google.com/architecture/hybrid-multicloud-secure-networking-patterns/gated-egress-ingress.md.txt): Discusses scenarios that demand bidirectional usage of selected APIs between workloads that run in various environments.
- [Gated egress](https://docs.cloud.google.com/architecture/hybrid-multicloud-secure-networking-patterns/gated-egress.md.txt): Discusses how the gated egress pattern is based on exposing select APIs from various environments to workloads that are deployed in Google Cloud.
- [Gated ingress](https://docs.cloud.google.com/architecture/hybrid-multicloud-secure-networking-patterns/gated-ingress.md.txt): Discusses exposing select APIs of workloads running in Google Cloud to the private computing environment without exposing them to the public internet.
- [Gated patterns](https://docs.cloud.google.com/architecture/hybrid-multicloud-secure-networking-patterns/gated-patterns.md.txt): Discusses how gated patterns can be adapted to various applications with diverse requirements.
- [General best practices](https://docs.cloud.google.com/architecture/hybrid-multicloud-secure-networking-patterns/general-best-practices.md.txt): Discusses several common best practices that you can use for hybrid and multicloud architectures.
- [Handover patterns](https://docs.cloud.google.com/architecture/hybrid-multicloud-secure-networking-patterns/handover-pattern.md.txt): Discusses how to connect a private computing environment to projects in Google Cloud.
- [Hybrid and multicloud secure networking architecture patterns](https://docs.cloud.google.com/architecture/hybrid-multicloud-secure-networking-patterns.md.txt): Discusses several common secure network architecture patterns that you can use for hybrid and multicloud architectures.
- [Hybrid and multicloud secure networking architecture patterns](https://docs.cloud.google.com/architecture/hybrid-multicloud-secure-networking-patterns/one-page-view.md.txt): Describes common hybrid and multicloud architecture patterns, the scenarios that these patterns are best suited for, and best practices for using the paterns.
- [Identify and prioritize security risks with Wiz Security Graph and Google Cloud](https://docs.cloud.google.com/architecture/partners/id-prioritize-security-risks-with-wiz.md.txt): Describes how to identify and prioritize security risks in your cloud workloads with Wiz Security Graph and Google Cloud.
- [Import data into a secured BigQuery data warehouse](https://docs.cloud.google.com/architecture/blueprints/confidential-data-warehouse-blueprint.md.txt): Describes an architecture that you can use to help secure a data warehouse in a production environment, and provides best practices for data governance of a data warehouse in Google Cloud.
- [Keycloak single sign-on](https://docs.cloud.google.com/architecture/identity/keycloak-single-sign-on.md.txt): Shows how to set up single sign-on (SSO) between Keycloak and your Cloud Identity or Google Workspace account by using SAML federation.
- [Limiting scope of compliance for PCI environments in Google Cloud](https://docs.cloud.google.com/architecture/limiting-compliance-scope-pci-environments-google-cloud.md.txt): Describes best practices for architecting your cloud environment for Payment Card Industry (PCI) Security Standards Council compliance.
- [Mapping BeyondProd security principles to the blueprint](https://docs.cloud.google.com/architecture/blueprints/enterprise-application-blueprint/mapping-beyondprod-security-principles.md.txt): Provides the mapping between BeyondProd security principles and a blueprint for an enterprise developer platform.
- [Meshed pattern](https://docs.cloud.google.com/architecture/hybrid-multicloud-secure-networking-patterns/meshed-pattern.md.txt): Discusses a meshed pattern architecture that&#39;s based on establishing a hybrid network architecture that spans multiple computing environments.
- [Microsoft Entra ID (formerly Azure AD) B2B user provisioning and single sign-on](https://docs.cloud.google.com/architecture/identity/azure-ad-b2b-user-provisioning-and-sso.md.txt): Shows how to extend Microsoft Entra ID user provisioning and single sign-on to enable single sign-on (SSO) for Microsoft Entra ID B2B collaboration users.
- [Microsoft Entra ID (formerly Azure AD) user provisioning and single sign-on](https://docs.cloud.google.com/architecture/identity/federating-gcp-with-azure-ad-configuring-provisioning-and-single-sign-on.md.txt): Shows how to set up user provisioning and single sign-on (SSO) between a Microsoft Entra ID tenant and your Cloud Identity or Google Workspace account.
- [Microsoft My Apps portal integration](https://docs.cloud.google.com/architecture/identity/integrating-google-services-and-apps-with-azure-ad-portal.md.txt): Shows how to add Google services and Identity-Aware Proxy (IAP) web-secured web applications to the Microsoft My Apps portal and how to enable automatic sign-on for these applications.
- [Migrate consumer accounts](https://docs.cloud.google.com/architecture/identity/migrating-consumer-accounts.md.txt): Describes how to migrate consumer accounts to managed user accounts that are controlled by Cloud Identity or by Google Workspace.
- [Mirrored pattern](https://docs.cloud.google.com/architecture/hybrid-multicloud-secure-networking-patterns/mirrored-pattern.md.txt): Discusses replicating the design of a certain existing environment or environments to a new environment or environments.
- [Mitigate ransomware attacks using Google Cloud](https://docs.cloud.google.com/architecture/security/mitigating-ransomware-attacks.md.txt): Describes the ransomware attack sequence and how Google Cloud can help your organization mitigate the effects of ransomware attacks.
- [Network security for distributed applications in Cross-Cloud Network](https://docs.cloud.google.com/architecture/ccn-distributed-apps-design/security.md.txt): Describes how to design Cross-Cloud Network security for distributed applications.
- [Networking for secure intra-cloud access: Reference architectures](https://docs.cloud.google.com/architecture/network-secure-intra-cloud-access.md.txt): Describes security and network connectivity architectures for intra-cloud access.
- [Okta user provisioning and single sign-on](https://docs.cloud.google.com/architecture/identity/okta-provisioning-and-single-sign-on.md.txt): Shows how to set up user provisioning and single sign-on (SSO) between an Okta organization and your Cloud Identity or Google Workspace account.
- [Overview of consolidating accounts](https://docs.cloud.google.com/architecture/identity/overview-consolidating-accounts.md.txt): Describes how to consolidate existing consumer accounts so that you can manage and control user accounts.
- [Overview of Google identity management](https://docs.cloud.google.com/architecture/identity/overview-google-authentication.md.txt): Explains the domain model that Google services rely on for authentication and identity management.
- [Overview of identity and access management](https://docs.cloud.google.com/architecture/identity.md.txt): Explores the general practice of identity and access management (generally referred to as IAM) and the individuals who are subject to it, including corporate identities, customer identities, and service identities.
- [OWASP Top 10 2021 mitigation options on Google Cloud](https://docs.cloud.google.com/architecture/security/owasp-top-ten-mitigation.md.txt): Helps you identify Google Cloud products and mitigation strategies that can help you defend against common application-level attacks that are outlined in OWASP Top 10.
- [Patterns and practices for identity and access governance on Google Cloud](https://docs.cloud.google.com/architecture/patterns-practices-identity-access-governance-google-cloud.md.txt): Describes patterns and practices for identity and access governance on Google Cloud.
- [PCI Data Security Standard compliance](https://docs.cloud.google.com/architecture/pci-dss-compliance-in-gcp.md.txt): Shows how to implement the Payment Card Industry Data Security Standard (PCI DSS) for your business on Google Cloud.
- [PCI DSS compliance on GKE](https://docs.cloud.google.com/architecture/pci-dss-and-gke-guide.md.txt): Provides guidance to address the requirements of the Payment Card Industry Data Security Standard (PCI DSS) for Google Kubernetes Engine (GKE) applications.
- [Plan the onboarding process for your corporate identities](https://docs.cloud.google.com/architecture/identity/overview-assess-and-plan.md.txt): Provides guidance to assess requirements and develop a plan for onboarding corporate identities to Cloud Identity or Google Workspace.
- [Prepare your Google Workspace or Cloud Identity account](https://docs.cloud.google.com/architecture/identity/preparing-your-g-suite-or-cloud-identity-account.md.txt): Describes how to create a Cloud Identity or Google Workspace account and how to prepare the account for a production deployment.
- [Reconcile orphaned managed user accounts](https://docs.cloud.google.com/architecture/identity/reconciling-orphaned-managed-user-accounts.md.txt): Describes how to identify and reconcile orphaned user accounts.
- [Reference architectures](https://docs.cloud.google.com/architecture/identity/reference-architectures.md.txt): Provides architectures that you can use as references for managing corporate identities.
- [Remove Gmail from consumer accounts](https://docs.cloud.google.com/architecture/identity/removing-gmail-from-consumer-accounts.md.txt): Describes how to remove Gmail from an existing consumer account to enable the user account to be migrated to Cloud Identity or Google Workspace.
- [Sanitize Gmail accounts](https://docs.cloud.google.com/architecture/identity/sanitizing-gmail-accounts.md.txt): Describes how to sanitize existing Gmail accounts by deliberately removing any corporate email addresses from them.
- [Secure apps and resources by using context-aware access](https://docs.cloud.google.com/architecture/secure-apps-resources-using-context-aware-access.md.txt): Describes how you can enforce context-aware access for different types of apps and resources.
- [Secure data environments in Google Cloud](https://docs.cloud.google.com/architecture/secure-data-environments.md.txt): A high-level architecture to secure sensitive datasets against accidental exposure and malicious exfiltration.
- [Secure virtual private cloud networks with the Palo Alto VM-Series NGFW](https://docs.cloud.google.com/architecture/partners/palo-alto-networks-ngfw.md.txt): Describes the networking concepts that you need to understand to deploy Palo Alto Networks VM-Series next generation firewall (NGFW) in Google Cloud.
- [Security blueprint: PCI on GKE](https://docs.cloud.google.com/architecture/gke-pci-dss-blueprint.md.txt): Provides a Terraform-based blueprint for a Google Kubernetes Engine (GKE) environment that aligns with the Payment Card Industry Data Security Standard (PCI DSS).
- [Security log analytics in Google Cloud](https://docs.cloud.google.com/architecture/security-log-analytics.md.txt): Shows how to collect, export, and analyze logs from Google Cloud to help you audit usage and detect threats to your data and workloads. Use the included threat detection queries for BigQuery or Chronicle, or bring your own SIEM.
- [Single sign-on](https://docs.cloud.google.com/architecture/identity/single-sign-on.md.txt): Describes how to configure your Cloud Identity or Google Workspace account to use single sign-on (SSO).
- [Tokenizing sensitive cardholder data for PCI DSS](https://docs.cloud.google.com/architecture/tokenizing-sensitive-cardholder-data-for-pci-dss.md.txt): Shows how to set up an access-controlled credit and debit card tokenization service on Cloud Functions.
- [VMware Engine network security using centralized appliances](https://docs.cloud.google.com/architecture/gcve-advanced-network-security.md.txt): Provides guidance to design advanced network security for VMware Engine workloads to provide network protection features like DDoS mitigation, SSL offloading, NGFW, IPS/IDS, and DPI.
- [Well-Architected Framework: Security, privacy, and compliance pillar](https://docs.cloud.google.com/architecture/framework/security/printable.md.txt): Provides principles and recommendations to help you design, deploy, and operate Google Cloud workloads that meet your requirements for security, privacy, and compliance.

## <a id="reliability-and-disaster-recovery"></a>Reliability and disaster recovery

- [Architecting disaster recovery for cloud infrastructure outages](https://docs.cloud.google.com/architecture/disaster-recovery.md.txt): Describes how Google Cloud is designed for resilience, discusses the process for architecting resilient workloads on Google Cloud, and provides product-specific disaster recovery (DR) guidance for zonal and regional outages.
- [Architecting disaster recovery for locality-restricted workloads](https://docs.cloud.google.com/architecture/architecting-disaster-recovery-for-locality-restricted-workloads.md.txt): Discusses how to architect disaster recovery (DR) for locality-restricted workloads.
- [Architectures for high availability of PostgreSQL clusters on Compute Engine](https://docs.cloud.google.com/architecture/architectures-high-availability-postgresql-clusters-compute-engine.md.txt): Several architectures that provide high availability (HA) for PostgreSQL deployments on Google Cloud.
- [Assess the reliability requirements for your cloud workloads](https://docs.cloud.google.com/architecture/infra-reliability-guide/requirements.md.txt): Provides guidelines to help you assess the reliability requirements of your cloud workloads.
- [Building blocks of reliability in Google Cloud](https://docs.cloud.google.com/architecture/infra-reliability-guide/building-blocks.md.txt): Introduces the building blocks of reliability in Google Cloud.
- [Business continuity hybrid and multicloud patterns](https://docs.cloud.google.com/architecture/hybrid-multicloud-patterns-and-practices/business-continuity-patterns.md.txt): Discusses how the business continuity pattern relies on a redundant deployment of applications across multiple computing environments.
- [Business continuity with CI/CD on Google Cloud](https://docs.cloud.google.com/architecture/business-continuity-with-cicd-on-google-cloud.md.txt): &#34;Learn about developing a business continuity plan (BCP) for the CI/CD process.&#34;
- [Delete the Load balanced managed VMs](https://docs.cloud.google.com/architecture/reliability/load-balanced-vms.md.txt): Delete Load balanced managed VMs Jump Start Solution.
- [Design reliable infrastructure for your workloads in Google Cloud](https://docs.cloud.google.com/architecture/infra-reliability-guide/design.md.txt): Provides architectural recommendations to design reliable infrastructure for your cloud workloads.
- [Disaster recovery building blocks](https://docs.cloud.google.com/architecture/dr-scenarios-building-blocks.md.txt): Discusses Google Cloud services and products that you can use as building blocks for your disaster recovery (DR) plan.
- [Disaster recovery planning guide](https://docs.cloud.google.com/architecture/dr-scenarios-planning-guide.md.txt): The first part of a series that discusses disaster recovery (DR) in Google Cloud. This part provides an overview of the DR planning process: what you need to know in order to design and implement a DR plan.
- [Disaster recovery scenarios for applications](https://docs.cloud.google.com/architecture/dr-scenarios-for-applications.md.txt): Explores common disaster recovery (DR) scenarios for applications.
- [Disaster recovery scenarios for data](https://docs.cloud.google.com/architecture/dr-scenarios-for-data.md.txt): Discusses disaster recovery (DR) scenarios for backing up and recovering data.
- [Disaster recovery use cases: locality-restricted data analytics applications](https://docs.cloud.google.com/architecture/dr-scenarios-locality-restricted-data-analytics.md.txt): Describes disaster recovery (DR) use cases for locality-restricted data analytics applications.
- [Google Cloud infrastructure reliability guide](https://docs.cloud.google.com/architecture/infra-reliability-guide.md.txt): Introduces the building blocks of reliability in Google Cloud, and provides architectural recommendations to design reliable infrastructure for your cloud workloads.
- [Manage and monitor your Google Cloud infrastructure](https://docs.cloud.google.com/architecture/infra-reliability-guide/manage-and-monitor.md.txt): Summarizes guidelines to manage and monitor your infrastructure resources for reliability.
- [Manage traffic and load for your workloads in Google Cloud](https://docs.cloud.google.com/architecture/infra-reliability-guide/traffic-load.md.txt): Describes traffic-management and load-management techniques that you can use to improve the reliability of your cloud workloads.
- [Migrate across Google Cloud regions: Design resilient single-region environments on Google Cloud](https://docs.cloud.google.com/architecture/migrate-across-regions/design-resilient-single-region-environments.md.txt): Design resilient, single-region environments on Google Cloud.
- [Patterns for scalable and resilient apps](https://docs.cloud.google.com/architecture/scalable-and-resilient-apps.md.txt): Introduces some patterns and practices for creating apps that are resilient and scalable, two essential goals of many modern architecture exercises.
- [Well-Architected Framework: Reliability pillar](https://docs.cloud.google.com/architecture/framework/reliability/printable.md.txt): Provides principles and recommendations to help you design, deploy, and manage reliable workloads in Google Cloud.

## <a id="data-and-analytics"></a>Data and analytics

- [Analytics hybrid and multicloud pattern](https://docs.cloud.google.com/architecture/hybrid-multicloud-patterns-and-practices/analytics-hybrid-multicloud-pattern.md.txt): Discusses that the objective of the analytics hybrid and multicloud pattern is to capitalize on the split between transactional and analytics workloads.
- [Architecture and functions in a data mesh](https://docs.cloud.google.com/architecture/data-mesh.md.txt): Describes the architecture and components of a data mesh that&#39;s deployed in Google Cloud.
- [Build data products in a data mesh](https://docs.cloud.google.com/architecture/build-data-products-data-mesh.md.txt): Describes design considerations for building data products in a data mesh.
- [Continuous data replication to BigQuery using Striim](https://docs.cloud.google.com/architecture/partners/continuous-data-replication-bigquery-striim.md.txt): Demonstrates how to migrate a MySQL database to BigQuery using Striim. Striim is a comprehensive streaming extract, transform, and load (ETL) platform.
- [Continuous data replication to Spanner using Striim](https://docs.cloud.google.com/architecture/partners/continuous-data-replication-cloud-spanner-striim.md.txt): How to migrate a MySQL database to Cloud Spanner using Striim.
- [Data management with Cohesity Helios and Google Cloud](https://docs.cloud.google.com/architecture/partners/using-cohesity-with-cloud-storage-for-enterprise-hybrid-data-protection.md.txt): How Cohesity works with Google Cloud Storage. Cohesity is a hyperconverged secondary storage system for consolidating backup, test/dev, file services, and analytic datasets onto a scalable data platform.
- [Delete the Analytics lakehouse](https://docs.cloud.google.com/architecture/big-data-analytics/analytics-lakehouse.md.txt): Delete Analytics lakehouse Jump Start Solution.
- [Delete the Data warehouse with BigQuery](https://docs.cloud.google.com/architecture/big-data-analytics/data-warehouse.md.txt): Delete Data warehouse with BigQuery Jump Start Solution.
- [Deploy an enterprise data management and analytics platform](https://docs.cloud.google.com/architecture/blueprints/deploy_enterprise_data_mesh.md.txt): Describes an enterprise-ready data mesh architecture that you can deploy to protect confidential data.
- [Deploy scalable BigQuery backup automation](https://docs.cloud.google.com/architecture/scalable-bigquery-backup-automation/deployment.md.txt): Build a solution to automate recurrent BigQuery backup operations at scale, with two backup methods: BigQuery snapshots and exports to Cloud Storage.
- [Design a self-service data platform for a data mesh](https://docs.cloud.google.com/architecture/design-self-service-data-platform-data-mesh.md.txt): Describes how to design a self-service data-mesh platform that domain teams can use to create and consume data products.
- [Device on Pub/Sub connection to Google Cloud](https://docs.cloud.google.com/architecture/connected-devices/device-pubsub-architecture.md.txt): Describes architectural considerations when you directly connect an IoT aggregation device or gateway to Pub/Sub.
- [Discover and consume data products in a data mesh](https://docs.cloud.google.com/architecture/discover-consume-data-products-data-mesh.md.txt): Discusses how domain teams can discover and consume data products in a data mesh.
- [Migrate to Google Cloud: Transfer your large datasets](https://docs.cloud.google.com/architecture/migration-to-google-cloud-transferring-your-large-datasets.md.txt): Provides guidance for transferring large datasets efficiently for workloads that you migrate to Google Cloud.
- [Scalable BigQuery backup automation](https://docs.cloud.google.com/architecture/scalable-bigquery-backup-automation.md.txt): Build a solution to automate recurrent BigQuery backup operations at scale, with two backup methods: BigQuery snapshots and exports to Cloud Storage.

## <a id="databases"></a>Databases

- [Apache Guacamole on GKE and Cloud SQL](https://docs.cloud.google.com/architecture/deploy-guacamole-gke.md.txt): Describes an architecture for hosting Apache Guacamole on Google Kubernetes Engine (GKE) and Cloud SQL. Apache Guacamole offers a fully browser-based way to access remote desktops through Remote Desktop Protocol (RDP).
- [Database migration: Concepts and principles (Part 1)](https://docs.cloud.google.com/architecture/database-migration-concepts-principles-part-1.md.txt): Introduces concepts, principles, terminology, and architecture of near-zero downtime database migration from on-premises or other cloud environments.
- [Database migration: Concepts and principles (Part 2)](https://docs.cloud.google.com/architecture/database-migration-concepts-principles-part-2.md.txt): Discusses how to set up and execute the database migration process, including failure scenarios.
- [Define the scope of your migration to Redis Enterprise Cloud](https://docs.cloud.google.com/architecture/partners/riot-live-migration-redis-enterprise-cloud/assessment.md.txt): Describes how to define the scope of a migration that uses RIOT Live Migration to migrate to fully managed Redis Enterprise Cloud in Google Cloud.
- [Deploy Apache Guacamole on GKE and Cloud SQL](https://docs.cloud.google.com/architecture/deploy-guacamole-gke/deployment.md.txt): Describes how to deploy Apache Guacamole on Google Kubernetes Engine (GKE) and Cloud SQL.
- [Deploy RIOT Live Migration to migrate to Redis Enterprise Cloud](https://docs.cloud.google.com/architecture/partners/riot-live-migration-redis-enterprise-cloud/deployment.md.txt): Describes how to deploy an architecture to migrate from Redis-compatible sources to fully managed Redis Enterprise Cloud in Google Cloud using RIOT Live Migration service.
- [Enterprise application on Compute Engine with Oracle Exadata](https://docs.cloud.google.com/architecture/enterprise-app-oracle-exadata-database-compute-engine.md.txt): Provides a reference architecture for an application that&#39;s hosted on Compute Engine VMs with connectivity to Oracle Cloud Infrastructure (OCI) Exadata databases in Google Cloud.
- [Enterprise application with Oracle Database on Compute Engine](https://docs.cloud.google.com/architecture/enterprise-app-oracle-database-compute-engine.md.txt): Provides a reference architecture to host an application that uses an Oracle database, deployed on Compute Engine VMs.
- [Global deployment with Compute Engine and Spanner](https://docs.cloud.google.com/architecture/global-deployment-compute-engine-spanner.md.txt): Learn how to architect a multi-tier application that runs on Compute Engine VMs and Spanner in a global topology on Google Cloud.
- [Microsoft SQL Server Always On availability group in Google Cloud](https://docs.cloud.google.com/architecture/sql-server-alwayson-availability-group-compute-engine.md.txt): Provides a reference architecture for deploying high-availability
(HA) Microsoft SQL Server databases in Google Cloud by using an Always On availability group.
- [Migrate from AWS to Google Cloud: Migrate from Amazon RDS and Amazon Aurora for MySQL to Cloud SQL for MySQL](https://docs.cloud.google.com/architecture/migrate-aws-rds-to-sql-mysql.md.txt): Describes how to design, implement, and validate a plan to migrate from Amazon Relational Database Service (RDS) or Aurora to Cloud SQL for MySQL.
- [Migrate from AWS to Google Cloud: Migrate from Amazon RDS and Amazon Aurora for PostgreSQL to Cloud SQL and AlloyDB for PostgreSQL](https://docs.cloud.google.com/architecture/migrate-aws-rds-aurora-to-postgresql.md.txt): Describes how to design, implement, and validate a plan to migrate from Amazon Relational Database Service (RDS) or Aurora to Cloud SQL for PostgreSQL or AlloyDB for PostgreSQL.
- [Migrate from AWS to Google Cloud: Migrate from Amazon RDS for SQL Server to Cloud SQL for SQL Server](https://docs.cloud.google.com/architecture/migrate-aws-rds-to-cloudsql-for-sqlserver.md.txt): Describes how to design, implement, and validate a plan to migrate from Amazon Relational Database Service (RDS) to Cloud SQL for SQL Server.
- [Multicloud database management: Architectures, use cases, and best practices](https://docs.cloud.google.com/architecture/multi-cloud-database-management.md.txt): Describes architectures, use cases, and best practices for multicloud database management.
- [Oracle E-Business Suite on Compute Engine with Oracle Exadata](https://docs.cloud.google.com/architecture/oracle-ebs-with-oci-exadata.md.txt): Shows how to build the infrastructure to run Oracle E-Business Suite applications with Oracle Cloud Infrastructure Exadata in Google Cloud.
- [Oracle E-Business Suite with Oracle Database on Compute Engine](https://docs.cloud.google.com/architecture/oracle-ebs-on-compute-engine-vm.md.txt): Shows how to build the infrastructure to run Oracle E-Business Suite applications with Oracle Database on Compute Engine VMs in Google Cloud.
- [Oracle PeopleSoft on Compute Engine with Oracle Exadata](https://docs.cloud.google.com/architecture/oracle-peoplesoft-with-oci-exadata.md.txt): Shows how to build the infrastructure to run Oracle PeopleSoft applications with Oracle Cloud Infrastructure Exadata in Google Cloud.
- [Use RIOT Live Migration to migrate to Redis Enterprise Cloud](https://docs.cloud.google.com/architecture/partners/riot-live-migration-redis-enterprise-cloud.md.txt): Describes an architecture to migrate from Redis-compatible sources to fully managed Redis Enterprise Cloud in Google Cloud using RIOT Live Migration service.

## <a id="migration"></a>Migration

- [Architect your workloads](https://docs.cloud.google.com/architecture/migrate-across-regions/architect-workloads.md.txt): Design resilient, single-region environments on Google Cloud.
- [Designing networks for migrating enterprise workloads: Architectural approaches](https://docs.cloud.google.com/architecture/network-architecture.md.txt): Provides an overview of networking and security architectures for enterprises that are migrating workloads to Google Cloud.
- [Log and monitor on-premises resources with BindPlane](https://docs.cloud.google.com/architecture/logging-and-monitoring-on-premises-resources-with-bindplane.md.txt): Describes considerations and design patterns for using Cloud Logging, Cloud Monitoring, and BindPlane to provide logging and monitoring services for on-premises resources.
- [Log on-premises resources with BindPlane](https://docs.cloud.google.com/architecture/logging-on-premises-resources-with-bindplane.md.txt): Describes how to use Cloud Logging and BindPlane to log on-premises resources.
- [Migrate across Google Cloud regions: Get started](https://docs.cloud.google.com/architecture/migrate-across-regions.md.txt): Start preparing your workloads and data for migration across Google Cloud regions.
- [Migrate across Google Cloud regions: Prepare data and batch workloads for migration across regions](https://docs.cloud.google.com/architecture/migrate-across-regions/prepare-data-and-batch-workloads.md.txt): Prepare data and batch workloads for migration across regions.
- [Migrate containers to Google Cloud: Migrate from Kubernetes to GKE](https://docs.cloud.google.com/architecture/migrating-containers-kubernetes-gke.md.txt): Describes how to design, implement, and validate a plan to migrate from Kubernetes to Google Kubernetes Engine (GKE).
- [Migrate from AWS to Google Cloud: Get started](https://docs.cloud.google.com/architecture/migration-from-aws-get-started.md.txt): Describes how to design, implement, and validate a plan to migrate from AWS to Google Cloud.
- [Migrate from AWS to Google Cloud: Migrate from Amazon EC2 to Compute Engine](https://docs.cloud.google.com/architecture/migrate-amazon-ec2-to-compute-engine.md.txt): Describes how to design, implement, and validate a plan to migrate from Amazon EC2 to Compute Engine.
- [Migrate from AWS to Google Cloud: Migrate from Amazon EKS to GKE](https://docs.cloud.google.com/architecture/migrate-amazon-eks-to-gke.md.txt): Design, implement, and validate a plan to migrate from Amazon EKS to Google Kubernetes Engine.
- [Migrate from AWS to Google Cloud: Migrate from Amazon S3 to Cloud Storage](https://docs.cloud.google.com/architecture/migrate-amazon-s3-to-cloud-storage.md.txt): Describes how to design, implement, and validate a plan to migrate from Amazon S3 to Cloud Storage.
- [Migrate from AWS to Google Cloud: Migrate from AWS Lambda to Cloud Run](https://docs.cloud.google.com/architecture/migrate-aws-lambda-to-cloudrun.md.txt): Describes how to design, implement, and validate a plan to migrate from AWS Lambda to Cloud Run.
- [Migrate from Azure to Google Cloud: Get started](https://docs.cloud.google.com/architecture/migration-from-azure-get-started.md.txt): Describes how to design, implement, and validate a plan to migrate from Azure to Google Cloud.
- [Migrate on-premises VMs to Google Cloud](https://docs.cloud.google.com/architecture/migrate-on-premises-vms.md.txt): Provides links to guides for migrating on-premises VM workloads to Google Cloud.
- [Migrate to a Google Cloud VMware Engine platform](https://docs.cloud.google.com/architecture/blueprints/vmware-engine-blueprint.md.txt): Describes the VMware Engine blueprint, which deploys a platform for VM workloads.
- [Migrate to Google Cloud: Assess and discover your workloads](https://docs.cloud.google.com/architecture/migration-to-gcp-assessing-and-discovering-your-workloads.md.txt): Describes the activities in the assessment phase of the process to migrate to Google Cloud.
- [Migrate to Google Cloud: Best practices for validating a migration plan](https://docs.cloud.google.com/architecture/migration-to-google-cloud-best-practices.md.txt): Describes how to design, implement, and validate a plan to migrate to Google Cloud.
- [Migrate to Google Cloud: Deploy your workloads](https://docs.cloud.google.com/architecture/migration-to-gcp-deploying-your-workloads.md.txt): Describes the activities in the deployment phase of the process to migrate to Google Cloud.
- [Migrate to Google Cloud: Get started](https://docs.cloud.google.com/architecture/migration-to-gcp-getting-started.md.txt): Helps you plan, design, and implement the process of migrating your application and infrastructure workloads to Google Cloud, including computing, database, and storage workloads.
- [Migrate to Google Cloud: Migrate from manual deployments to automated, containerized deployments](https://docs.cloud.google.com/architecture/migration-to-google-cloud-automated-containerized-deployments.md.txt): Describes how to plan and design a migration path from manual deployments to automated, containerized deployments in Google Cloud.
- [Migrate to Google Cloud: Minimize costs](https://docs.cloud.google.com/architecture/migration-to-google-cloud-minimize-costs.md.txt): Provide guidance to help you optimize the costs of workloads that you migrate to single-region and multi-region environments in Google Cloud.
- [Migrate to Google Cloud: Optimize your environment](https://docs.cloud.google.com/architecture/migration-to-google-cloud-optimizing-your-environment.md.txt): Provides guidance to help you continuously optimize the environment for a workload that you&#39;ve migrated to Google Cloud.
- [Migrate to Google Cloud: Plan and build your foundation](https://docs.cloud.google.com/architecture/migration-to-google-cloud-building-your-foundation.md.txt): Describes how to plan and build a foundation on Google Cloud.
- [Monitor on-premises resources with BindPlane](https://docs.cloud.google.com/architecture/monitoring-on-premises-resources-with-bindplane.md.txt): Describes how to use Cloud Monitoring and BindPlane to monitor on-premises resources.

## <a id="networking"></a>Networking

- [Best practices and reference architectures for VPC design](https://docs.cloud.google.com/architecture/best-practices-vpc-design.md.txt): This guide introduces best practices and typical enterprise architectures for the design of virtual private clouds (VPCs) with Google Cloud.
- [Cross-Cloud Network for distributed applications](https://docs.cloud.google.com/architecture/ccn-distributed-apps-design.md.txt): Describes how to design Cross-Cloud Network for distributed applications.
- [Cross-Cloud Network inter-VPC connectivity using Network Connectivity Center](https://docs.cloud.google.com/architecture/ccn-distributed-apps-design/ccn-ncc-vpn-ra.md.txt): Describes how to design the network segmentation structure and connectivity of Cross-Cloud Network with Network Connectivity Center.
- [Cross-Cloud Network inter-VPC connectivity using VPC Network Peering](https://docs.cloud.google.com/architecture/ccn-distributed-apps-design/ccn-vnp-vpn-ra.md.txt): Describes how to design the network segmentation structure and connectivity of Cross-Cloud Network for distributed applications.
- [Deploy Windows applications on managed Kubernetes](https://docs.cloud.google.com/architecture/manage-and-scale-windows-networking/deployment.md.txt): Describes how to deploy a reference architecture to manage and scale networking for Windows applications that run on managed Kubernetes.
- [From edge to mesh: Deploy service mesh applications through GKE Gateway](https://docs.cloud.google.com/architecture/exposing-service-mesh-apps-through-gke-ingress/deployment.md.txt): Shows how to combine Cloud Service Mesh with Cloud Load Balancing to expose applications in a service mesh to internet clients.
- [From edge to mesh: Expose service mesh applications through GKE Gateway](https://docs.cloud.google.com/architecture/exposing-service-mesh-apps-through-gke-ingress.md.txt): Combines Cloud Service Mesh with Cloud Load Balancing to expose applications in a service mesh to internet clients.
- [Hub-and-spoke network architecture](https://docs.cloud.google.com/architecture/deploy-hub-spoke-vpc-network-topology.md.txt): Discusses the architectural options for designing hub-and-spoke network topologies in Google Cloud.
- [Manage and scale networking for Windows applications that run on managed Kubernetes](https://docs.cloud.google.com/architecture/manage-and-scale-windows-networking.md.txt): Discusses how to manage networking for Windows applications that run on Google Kubernetes Engine using Cloud Service Mesh and Envoy gateways.
- [Multi-agent private networking patterns in Google Cloud](https://docs.cloud.google.com/architecture/multi-agent-private-networking-patterns.md.txt): Guidance to help you design private networking infrastructure that supports a publicly accessible, multi-agent, Gemini Enterprise app with private connections between agents, subagents, and tools.
- [Network segmentation and connectivity for distributed applications in Cross-Cloud Network](https://docs.cloud.google.com/architecture/ccn-distributed-apps-design/connectivity.md.txt): Describe how to design the network segmentation structure and connectivity of Cross-Cloud Network for distributed applications.
- [Networking for hybrid and multi-cloud workloads: Reference architectures](https://docs.cloud.google.com/architecture/network-hybrid-multicloud.md.txt): Discusses networking for a scenario where workloads run in more than one place, such as on-premises and the cloud, or in multiple cloud environments.
- [Networking for internet-facing application delivery: Reference architectures](https://docs.cloud.google.com/architecture/network-application-delivery.md.txt): Describes reference architectures to help you design networking and security for internet-facing application delivery.
- [Patterns for using floating IP addresses in Compute Engine](https://docs.cloud.google.com/architecture/patterns-for-floating-ip-addresses-in-compute-engine.md.txt): How to use floating IP address patterns when migrating applications to Compute Engine from an on-premises network.
- [Service networking for distributed applications in Cross-Cloud Network](https://docs.cloud.google.com/architecture/ccn-distributed-apps-design/service-networking.md.txt): Describes how to design Cross-Cloud Network service networking for distributed applications.
- [Use Google Cloud Armor, load balancing, and Cloud CDN to deploy programmable global front ends](https://docs.cloud.google.com/architecture/deploy-programmable-gfe-cloud-armor-lb-cdn.md.txt): Provides an architecture that uses a global front end which incorporates Google Cloud best practices to help scale, secure, and accelerate the delivery of your internet-facing applications.
- [VPC Network Peering Cross-Cloud Network with NVAs and regional affinity](https://docs.cloud.google.com/architecture/ccn-distributed-apps-design/ccn-nva-ra.md.txt): Describes how to include NVAs into a regional affinity CCN deployment.

## <a id="hybrid-multi-cloud-and-distributed-cloud"></a>Hybrid, multi-cloud, and distributed cloud

- [Architectural approaches to adopt a hybrid or multicloud architecture](https://docs.cloud.google.com/architecture/hybrid-multicloud-patterns/adopt.md.txt): Provides guidance on common proven approaches and considerations to migrate your workload to the cloud.
- [Authenticate workforce users in a hybrid environment](https://docs.cloud.google.com/architecture/authenticating-corporate-users-in-a-hybrid-environment.md.txt): How to extend your identity management solution to Google Cloud to enable your workforce to authenticate and consume services in a hybrid computing environment.
- [Build a hybrid render farm](https://docs.cloud.google.com/architecture/building-a-hybrid-render-farm.md.txt): Provides guidance on extending your existing, on-premises render farm to use compute resources on Google Cloud (Google Cloud).
- [Build hybrid and multicloud architectures using Google Cloud](https://docs.cloud.google.com/architecture/hybrid-multicloud-patterns.md.txt): Provides practical guidance on planning and architecting your hybrid and multi-cloud environments using Google Cloud.
- [Cloud bursting pattern](https://docs.cloud.google.com/architecture/hybrid-multicloud-patterns-and-practices/cloud-bursting-pattern.md.txt): Discusses how to manage bursty workloads with the cloud bursting architecture pattern.
- [Distributed architecture patterns](https://docs.cloud.google.com/architecture/hybrid-multicloud-patterns-and-practices/distributed-patterns.md.txt): Discusses how to avoid or overcome design constraints and how to take advantage of each computing environment in a distributed architecture.
- [Drivers, considerations, strategy, and approaches](https://docs.cloud.google.com/architecture/hybrid-multicloud-patterns/drivers.md.txt): Defines and discusses business objectives, drivers, and requirements, and how these factors can influence your design decisions.
- [Edge hybrid pattern](https://docs.cloud.google.com/architecture/hybrid-multicloud-patterns-and-practices/edge-hybrid-pattern.md.txt): Discusses how the edge hybrid pattern addresses connectivity challenges by running time- and business-critical workloads locally, at the edge of the network.
- [Environment hybrid pattern](https://docs.cloud.google.com/architecture/hybrid-multicloud-patterns-and-practices/environment-hybrid-pattern.md.txt): Discusses how to keep the production environment of a workload in the existing data center but use the public cloud for other, non-production environments.
- [Hybrid and multicloud architecture patterns](https://docs.cloud.google.com/architecture/hybrid-multicloud-patterns-and-practices.md.txt): Discusses common hybrid and multicloud architecture patterns, and describes the scenarios that these patterns are best suited for.
- [Hybrid and multicloud architecture patterns](https://docs.cloud.google.com/architecture/hybrid-multicloud-patterns-and-practices/one-page-view.md.txt): Discusses common hybrid and multicloud architecture patterns. It also describes the scenarios that these patterns are best suited for.
- [Hybrid and multicloud monitoring and logging patterns](https://docs.cloud.google.com/architecture/hybrid-and-multi-cloud-monitoring-and-logging-patterns.md.txt): Discusses monitoring and logging architectures for hybrid and multicloud deployments, and provides best practices for implementing them by using Google Cloud.
- [Other considerations](https://docs.cloud.google.com/architecture/hybrid-multicloud-patterns/other-considerations.md.txt): Highlights essential core design considerations that play a pivotal role in shaping your overall hybrid and multicloud architecture.
- [Partitioned multicloud pattern](https://docs.cloud.google.com/architecture/hybrid-multicloud-patterns-and-practices/partitioned-multicloud-pattern.md.txt): Discusses how the pattern combines multiple public cloud environments that are operated by different CSPs and the flexibility it offers.
- [Patterns for authenticating workforce users in a hybrid environment](https://docs.cloud.google.com/architecture/patterns-for-authenticating-corporate-users-in-a-hybrid-environment.md.txt): Discusses patterns for authenticating workforce users in a hybrid cloud environment.
- [Patterns for connecting other cloud service providers with Google Cloud](https://docs.cloud.google.com/architecture/patterns-for-connecting-other-csps-with-gcp.md.txt): Helps cloud architects and operations professionals decide how to connect Google Cloud with other cloud service providers (CSP) such as Amazon Web Services (AWS) and Microsoft Azure.
- [Patterns for using Active Directory in a hybrid environment](https://docs.cloud.google.com/architecture/patterns-for-using-active-directory-in-a-hybrid-environment.md.txt): Requirements to consider when you deploy Active Directory to Google Cloud and helps you choose the right architecture.
- [Plan a hybrid and multicloud strategy](https://docs.cloud.google.com/architecture/hybrid-multicloud-patterns/strategy.md.txt): Discusses how to plan your hybrid and multi-cloud strategy.
- [Tiered hybrid pattern](https://docs.cloud.google.com/architecture/hybrid-multicloud-patterns-and-practices/tiered-hybrid-pattern.md.txt): Discusses the opportunties and challenges that a tiered hybrid architecture pattern offers.

## <a id="financial-services"></a>Financial services

- [Well-Architected Framework: Financial services (FS) perspective](https://docs.cloud.google.com/architecture/framework/perspectives/fsi/printable.md.txt): Provides principles and recommendations to help you design, build, and manage financial services (FS) applications in Google Cloud that meet your operational, security, reliability, cost, and performance goals.

## <a id="monitoring-and-logging"></a>Monitoring and logging

- [Cloud Monitoring metric export](https://docs.cloud.google.com/architecture/monitoring-metric-export.md.txt): Describes a way to export Cloud Monitoring metrics for long-term analysis.
- [Deploy a job to import logs from Cloud Storage to Cloud Logging](https://docs.cloud.google.com/architecture/import-logs-from-storage-to-logging/deployment.md.txt): Learn how to import logs that were previously exported to Cloud Storage back to Cloud Logging.
- [Deploy log streaming from Google Cloud to Datadog](https://docs.cloud.google.com/architecture/partners/stream-cloud-logs-to-datadog/deployment.md.txt): Learn how to deploy a solution that sends log files to a Cloud Logging sink and then to Datadog.
- [Developer platform controls](https://docs.cloud.google.com/architecture/blueprints/enterprise-application-blueprint/developer-platform-controls.md.txt): Describes the security, networking, and reliability controls that are used in the blueprint for an enterprise developer platform.
- [Import logs from Cloud Storage to Cloud Logging](https://docs.cloud.google.com/architecture/import-logs-from-storage-to-logging.md.txt): Learn how to import logs that were previously exported to Cloud Storage back to Cloud Logging.
- [Logging and monitoring](https://docs.cloud.google.com/architecture/blueprints/enterprise-application-blueprint/logging-monitoring.md.txt): Describes how logging and monitoring work in a blueprint for an enterprise developer platform.
- [Operations for both the developer platform and applications](https://docs.cloud.google.com/architecture/blueprints/enterprise-application-blueprint/ops-developer-platform-applications.md.txt): Provides guidance to efficiently operate an enterprise developer platform and the deployed applications.
- [Stream logs from Google Cloud to Datadog](https://docs.cloud.google.com/architecture/partners/stream-cloud-logs-to-datadog.md.txt): Provides an architecture to send log event data from across your Google Cloud ecosystem to Datadog Log Management.
- [Stream logs from Google Cloud to Splunk](https://docs.cloud.google.com/architecture/stream-logs-from-google-cloud-to-splunk.md.txt): Create a production-ready, scalable, fault-tolerant, log export mechanism that streams logs and events from your resources in Google Cloud into Splunk.
- [Well-Architected Framework: Operational excellence pillar](https://docs.cloud.google.com/architecture/framework/operational-excellence/printable.md.txt): Provides principles and recommendations to help you manage and operate workloads efficiently in Google Cloud.

## <a id="storage"></a>Storage

- [Configuring SaaS data protection for Google Workspace data with Spin.AI](https://docs.cloud.google.com/architecture/partners/backing-up-workspace-data-with-spinone.md.txt): How to configure SpinOne - All-in-One SaaS Data Protection with Cloud Storage.
- [Design an optimal storage strategy for your cloud workload](https://docs.cloud.google.com/architecture/storage-advisor.md.txt): Provides guidance to help you design a storage strategy that&#39;s aligned with the requirements of your cloud workload.
- [Google Workspace Backup with Afi.ai](https://docs.cloud.google.com/architecture/partners/google-workspace-backup-with-afi-ai.md.txt): Describes how to set up an automated Google Workspace backup using Afi.ai.
- [Parallel file systems for HPC workloads](https://docs.cloud.google.com/architecture/parallel-file-systems-for-hpc.md.txt): Describes the storage options in Google Cloud for high performance computing (HPC) workloads, and provides guidance for when you should use parallel file systems like Managed Lustre for HPC workloads.

# Product-specific best practices guides

| Product | Line hints |
|---------|------------|
| [Best practices covering multiple products](#multiple-products) | Lines 31-34 |
| [AI Hypercomputer](#ai-hypercomputer) | Lines 35-38 |
| [AlloyDB](#alloydb) | Lines 39-45 |
| [Backup and Disaster Recovery (DR) Service](#backup-and-disaster-recovery-dr-service) | Lines 46-53 |
| [BigQuery](#bigquery) | Lines 54-68 |
| [Cloud Armor](#cloud-armor) | Lines 69-72 |
| [Cloud Load Balancing](#cloud-load-balancing) | Lines 73-76 |
| [Cloud Run](#cloud-run) | Lines 77-84 |
| [Cloud Service Mesh](#cloud-service-mesh) | Lines 85-94 |
| [Cloud SQL](#cloud-sql) | Lines 95-102 |
| [Cloud Storage](#cloud-storage) | Lines 103-108 |
| [Compute Engine](#compute-engine) | Lines 109-125 |
| [Gemini Enterprise Agent Platform](#gemini-enterprise-agent-platform) | Lines 126-132 |
| [Google Kubernetes Engine (GKE)](#google-kubernetes-engine-gke) | Lines 133-152 |
| [Identity and Access Management (IAM)](#identity-and-access-management-iam) | Lines 153-162 |
| [Managed Service for Apache Spark](#managed-service-for-apache-spark) | Lines 163-167 |
| [Memorystore](#memorystore) | Lines 168-176 |
| [Migration](#migration) | Lines 177-181 |
| [Network Connectivity](#network-connectivity) | Lines 182-187 |
| [Observability in Google Cloud](#observability-in-google-cloud) | Lines 188-196 |
| [Pub/Sub](#pub-sub) | Lines 197-202 |
| [Security Command Center](#security-command-center) | Lines 203-206 |
| [Security](#security) | Lines 207-216 |
| [Spanner](#spanner) | Lines 217-228 |
| [Vertex AI](#vertex-ai) | Lines 229-232 |

## <a id="multiple-products"></a>Best practices covering multiple products

- https://docs.cloud.google.com/workload-manager/docs/reference/best-practices-general.md.txt

## <a id="ai-hypercomputer"></a>AI Hypercomputer

- https://docs.cloud.google.com/ai-hypercomputer/docs/networking-best-practices.md.txt

## <a id="alloydb"></a>AlloyDB

- https://docs.cloud.google.com/alloydb/docs/ai/best-practices-tuning-scann.md.txt
- https://docs.cloud.google.com/alloydb/docs/auth-proxy/best-practices.md.txt
- https://docs.cloud.google.com/alloydb/docs/import-export-best-practices.md.txt
- https://docs.cloud.google.com/alloydb/docs/security-best-practices.md.txt

## <a id="backup-and-disaster-recovery-dr-service"></a>Backup and Disaster Recovery (DR) Service

- https://docs.cloud.google.com/backup-disaster-recovery/docs/concepts/backup-plan-policy-best-practices.md.txt
- https://docs.cloud.google.com/backup-disaster-recovery/docs/concepts/best-practices-cyber-resilience.md.txt
- https://docs.cloud.google.com/backup-disaster-recovery/docs/concepts/best-practices-ransomware.md.txt
- https://docs.cloud.google.com/backup-disaster-recovery/docs/concepts/policy-specific-best-practices.md.txt
- https://docs.cloud.google.com/backup-disaster-recovery/docs/create-plan/schedule-best-practices-at-a-glance.md.txt

## <a id="bigquery"></a>BigQuery

- https://docs.cloud.google.com/bigquery/docs/best-practices-costs.md.txt
- https://docs.cloud.google.com/bigquery/docs/best-practices-for-multi-tenant-workloads-on-bigquery.md.txt
- https://docs.cloud.google.com/bigquery/docs/best-practices-performance-compute.md.txt
- https://docs.cloud.google.com/bigquery/docs/best-practices-performance-functions.md.txt
- https://docs.cloud.google.com/bigquery/docs/best-practices-performance-nested.md.txt
- https://docs.cloud.google.com/bigquery/docs/best-practices-performance-overview.md.txt
- https://docs.cloud.google.com/bigquery/docs/best-practices-policy-tags.md.txt
- https://docs.cloud.google.com/bigquery/docs/best-practices-row-level-security.md.txt
- https://docs.cloud.google.com/bigquery/docs/best-practices-spatial-analysis.md.txt
- https://docs.cloud.google.com/bigquery/docs/best-practices-storage.md.txt
- https://docs.cloud.google.com/bigquery/docs/graph-query-best-practices.md.txt
- https://docs.cloud.google.com/bigquery/docs/write-api-best-practices.md.txt

## <a id="cloud-armor"></a>Cloud Armor

- https://docs.cloud.google.com/armor/docs/best-practices.md.txt

## <a id="cloud-load-balancing"></a>Cloud Load Balancing

- https://docs.cloud.google.com/load-balancing/docs/https/http-load-balancing-best-practices.md.txt

## <a id="cloud-run"></a>Cloud Run

- https://docs.cloud.google.com/run/docs/configuring/jobs/gpu-best-practices.md.txt
- https://docs.cloud.google.com/run/docs/configuring/networking-best-practices.md.txt
- https://docs.cloud.google.com/run/docs/configuring/services/gpu-best-practices.md.txt
- https://docs.cloud.google.com/run/docs/configuring/workerpools/gpu-best-practices.md.txt
- https://docs.cloud.google.com/run/docs/tips/functions-best-practices.md.txt

## <a id="cloud-service-mesh"></a>Cloud Service Mesh

- https://docs.cloud.google.com/service-mesh/docs/canonical-service-best-practices.md.txt
- https://docs.cloud.google.com/service-mesh/docs/istio-apis/security/best-practices.md.txt
- https://docs.cloud.google.com/service-mesh/docs/istio-apis/security/egress-gateways-best-practices.md.txt
- https://docs.cloud.google.com/service-mesh/docs/operate-and-maintain/scalability-best-practices.md.txt
- https://docs.cloud.google.com/service-mesh/docs/security/anthos-service-mesh-security-best-practices.md.txt
- https://docs.cloud.google.com/service-mesh/docs/security/best-practices.md.txt
- https://docs.cloud.google.com/service-mesh/docs/security/egress-gateways-best-practices.md.txt

## <a id="cloud-sql"></a>Cloud SQL

- https://docs.cloud.google.com/sql/docs/best-practices.md.txt
- https://docs.cloud.google.com/sql/docs/mysql/best-practices.md.txt
- https://docs.cloud.google.com/sql/docs/postgres/best-practices.md.txt
- https://docs.cloud.google.com/sql/docs/postgres/manage-memory-usage-best-practices.md.txt
- https://docs.cloud.google.com/sql/docs/sqlserver/best-practices.md.txt

## <a id="cloud-storage"></a>Cloud Storage

- https://docs.cloud.google.com/storage/docs/best-practices-media-workload.md.txt
- https://docs.cloud.google.com/storage/docs/best-practices.md.txt
- https://docs.cloud.google.com/storage/docs/hns-buckets-best-practices.md.txt

## <a id="compute-engine"></a>Compute Engine

- https://docs.cloud.google.com/compute/docs/api/best-practices.md.txt
- https://docs.cloud.google.com/compute/docs/connect/ssh-best-practices/auditing.md.txt
- https://docs.cloud.google.com/compute/docs/connect/ssh-best-practices/credentials.md.txt
- https://docs.cloud.google.com/compute/docs/connect/ssh-best-practices.md.txt
- https://docs.cloud.google.com/compute/docs/connect/ssh-best-practices/login-access.md.txt
- https://docs.cloud.google.com/compute/docs/connect/ssh-best-practices/network-access.md.txt
- https://docs.cloud.google.com/compute/docs/disks/snapshot-best-practices.md.txt
- https://docs.cloud.google.com/compute/docs/images/image-families-best-practices.md.txt
- https://docs.cloud.google.com/compute/docs/images/image-management-best-practices.md.txt
- https://docs.cloud.google.com/compute/docs/instances/best-practices-shared-reservations.md.txt
- https://docs.cloud.google.com/compute/docs/instances/sql-server/best-practices.md.txt
- https://docs.cloud.google.com/compute/docs/instances/windows/best-practices.md.txt
- https://docs.cloud.google.com/compute/docs/instances/windows/windows-best-practices.md.txt
- https://docs.cloud.google.com/compute/docs/nodes/sole-tenant-best-practices.md.txt

## <a id="gemini-enterprise-agent-platform"></a>Gemini Enterprise Agent Platform

- https://docs.cloud.google.com/gemini-enterprise-agent-platform/govern/policies/best-practices.md.txt
- https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/capabilities/gemini-image-generation-best-practices.md.txt
- https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/live-api/best-practices.md.txt
- https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/video/best-practice.md.txt

## <a id="google-kubernetes-engine-gke"></a>Google Kubernetes Engine (GKE)

- https://docs.cloud.google.com/kubernetes-engine/docs/best-practices/batch-platform-on-gke.md.txt
- https://docs.cloud.google.com/kubernetes-engine/docs/best-practices/enterprise-multitenancy.md.txt
- https://docs.cloud.google.com/kubernetes-engine/docs/best-practices.md.txt
- https://docs.cloud.google.com/kubernetes-engine/docs/best-practices/machine-learning/inference/autoscaling-tpu.md.txt
- https://docs.cloud.google.com/kubernetes-engine/docs/best-practices/machine-learning/inference/autoscaling.md.txt
- https://docs.cloud.google.com/kubernetes-engine/docs/best-practices/machine-learning/inference/batch-inference.md.txt
- https://docs.cloud.google.com/kubernetes-engine/docs/best-practices/machine-learning/inference.md.txt
- https://docs.cloud.google.com/kubernetes-engine/docs/best-practices/machine-learning/inference/llm-optimization.md.txt
- https://docs.cloud.google.com/kubernetes-engine/docs/best-practices/networking.md.txt
- https://docs.cloud.google.com/kubernetes-engine/docs/best-practices/optimize-ai-utilization.md.txt
- https://docs.cloud.google.com/kubernetes-engine/docs/best-practices/rbac.md.txt
- https://docs.cloud.google.com/kubernetes-engine/docs/best-practices/run-hpc.md.txt
- https://docs.cloud.google.com/kubernetes-engine/docs/best-practices/scalability.md.txt
- https://docs.cloud.google.com/kubernetes-engine/docs/best-practices/upgrading-clusters.md.txt
- https://docs.cloud.google.com/kubernetes-engine/docs/concepts/best-practices-continuous-integration-delivery-kubernetes.md.txt
- https://docs.cloud.google.com/kubernetes-engine/security/ai-security-best-practices.md.txt
- https://docs.cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster.md.txt

## <a id="identity-and-access-management-iam"></a>Identity and Access Management (IAM)

- https://docs.cloud.google.com/iam/docs/best-practices-for-managing-service-account-keys.md.txt
- https://docs.cloud.google.com/iam/docs/best-practices-for-using-service-accounts-in-deployment-pipelines.md.txt
- https://docs.cloud.google.com/iam/docs/best-practices-for-using-workload-identity-federation.md.txt
- https://docs.cloud.google.com/iam/docs/best-practices-service-accounts.md.txt
- https://docs.cloud.google.com/iam/docs/best-practices-workforce-identity-federation.md.txt
- https://docs.cloud.google.com/iam/docs/groups-best-practices.md.txt
- https://docs.cloud.google.com/iam/docs/pam-best-practices.md.txt

## <a id="managed-service-for-apache-spark"></a>Managed Service for Apache Spark

- https://docs.cloud.google.com/managed-spark/docs/concepts/security-best-practices.md.txt
- https://docs.cloud.google.com/managed-spark/docs/guides/best-practices.md.txt

## <a id="memorystore"></a>Memorystore

- https://docs.cloud.google.com/memorystore/docs/cluster/general-best-practices.md.txt
- https://docs.cloud.google.com/memorystore/docs/memcached/best-practices.md.txt
- https://docs.cloud.google.com/memorystore/docs/memcached/memory-management-best-practices.md.txt
- https://docs.cloud.google.com/memorystore/docs/redis/general-best-practices.md.txt
- https://docs.cloud.google.com/memorystore/docs/redis/memory-management-best-practices.md.txt
- https://docs.cloud.google.com/memorystore/docs/valkey/general-best-practices.md.txt

## <a id="migration"></a>Migration

- https://docs.cloud.google.com/migrate/containers/docs/planning-best-practices.md.txt
- https://docs.cloud.google.com/migrate/virtual-machines/docs/5.0/discover/migrating-vms-migrate-for-compute-engine-best-practices.md.txt

## <a id="network-connectivity"></a>Network Connectivity

- https://docs.cloud.google.com/network-connectivity/docs/interconnect/concepts/best-practices.md.txt
- https://docs.cloud.google.com/network-connectivity/docs/router/concepts/best-practices.md.txt
- https://docs.cloud.google.com/network-connectivity/docs/vpn/concepts/best-practices.md.txt

## <a id="observability-in-google-cloud"></a>Observability in Google Cloud

- https://docs.cloud.google.com/stackdriver/docs/managed-prometheus/best-practices/config.md.txt
- https://docs.cloud.google.com/stackdriver/docs/managed-prometheus/best-practices/ingest-and-query.md.txt
- https://docs.cloud.google.com/stackdriver/docs/managed-prometheus/best-practices/multi-tenant.md.txt
- https://docs.cloud.google.com/stackdriver/docs/managed-prometheus/best-practices/rule-alert-mgd.md.txt
- https://docs.cloud.google.com/stackdriver/docs/managed-prometheus/best-practices/rule-alert-self.md.txt
- https://docs.cloud.google.com/stackdriver/docs/managed-prometheus/best-practices/unusual-configs.md.txt

## <a id="pub-sub"></a>Pub/Sub

- https://docs.cloud.google.com/pubsub/docs/metrics-autoscaling-best-practices.md.txt
- https://docs.cloud.google.com/pubsub/docs/publish-best-practices.md.txt
- https://docs.cloud.google.com/pubsub/docs/subscribe-best-practices.md.txt

## <a id="security-command-center"></a>Security Command Center

- https://docs.cloud.google.com/security-command-center/docs/cryptomining-detection-best-practices.md.txt

## <a id="security"></a>Security

- https://docs.cloud.google.com/docs/security/security-best-practices-catalog/agents-applications.md.txt
- https://docs.cloud.google.com/docs/security/security-best-practices-catalog/data-management.md.txt
- https://docs.cloud.google.com/docs/security/security-best-practices-catalog.md.txt
- https://docs.cloud.google.com/docs/security/security-best-practices-catalog/infrastructure.md.txt
- https://docs.cloud.google.com/docs/security/security-best-practices-catalog/recommended-iam-groups.md.txt
- https://docs.cloud.google.com/docs/security/security-best-practices-catalog/secure-enterprise-foundations.md.txt
- https://docs.cloud.google.com/docs/security/security-best-practices-catalog/tools-inference.md.txt

## <a id="spanner"></a>Spanner

- https://docs.cloud.google.com/spanner/docs/best-practices-gaming-database.md.txt
- https://docs.cloud.google.com/spanner/docs/dml-best-practices.md.txt
- https://docs.cloud.google.com/spanner/docs/graph/algorithm-best-practices.md.txt
- https://docs.cloud.google.com/spanner/docs/graph/best-practices-designing-schema.md.txt
- https://docs.cloud.google.com/spanner/docs/graph/best-practices-tuning-queries.md.txt
- https://docs.cloud.google.com/spanner/docs/schema-updates-best-practices.md.txt
- https://docs.cloud.google.com/spanner/docs/sql-best-practices.md.txt
- https://docs.cloud.google.com/spanner/docs/vector-index-best-practices.md.txt
- https://docs.cloud.google.com/spanner/docs/vector-search-best-practices.md.txt

## <a id="vertex-ai"></a>Vertex AI

- https://docs.cloud.google.com/vertex-ai/docs/featurestore/best-practices.md.txt

# Decision-making guides

| Topic | Document | Description |
| :---- | :---- | :---- |
| Agentic AI: Architecture | https://docs.cloud.google.com/architecture/choose-agentic-ai-architecture-components.md.txt | Provides architectural guidance for selecting the optimal building blocks and services on Google Cloud to power your agentic AI applications. |
| Agentic AI: Design pattern | https://docs.cloud.google.com/architecture/choose-design-pattern-agentic-ai-system.md.txt | Helps you analyze your workload and select the best design pattern (single-agent, multi-agent, etc.) for constructing your generative AI system. |
| AlloyDB Omni: Deployment environment | https://docs.cloud.google.com/alloydb/omni/docs/choose-deployment.md.txt | Provides guidance on choosing the best target environment (single container, Kubernetes, or serverless) for deploying AlloyDB Omni. |
| AlloyDB: Connectivity | https://docs.cloud.google.com/alloydb/docs/choose-alloydb-connectivity.md.txt | Compares AlloyDB connectivity methods, including AlloyDB Auth Proxy, Private Service Connect (PSC), and direct VPC peering, to help you select the appropriate method. |
| AlloyDB: Machine types | https://docs.cloud.google.com/alloydb/docs/choose-machine-type.md.txt | Explains how to select the appropriate machine type for your AlloyDB primary and read instances based on vCPUs, memory, and performance. |
| AlloyDB: Vector index | https://docs.cloud.google.com/alloydb/docs/ai/choose-index-strategy.md.txt | Compares Approximate Nearest Neighbors (ANN) and K-Nearest Neighbors (KNN) indexing strategies to help you choose the appropriate model for vector search. |
| App Engine: Environment | https://docs.cloud.google.com/appengine/docs/the-appengine-environments.md.txt | Compares the App Engine Standard and Flexible environments, helping you select the appropriate environment based on language support, scaling speed, and customization requirements. |
| App Hub: Setup model | https://docs.cloud.google.com/app-hub/docs/set-up-app-hub.md.txt | Helps you select the best approach (single-project, multi-project, or organization-level) for setting up and configuring App Hub. |
| Application hosting | https://cloud.google.com/hosting-options | Compares application hosting (compute) options: Compute Engine, GKE, Cloud Run, App Engine |
| BigQuery: ETL vs. ELT | https://docs.cloud.google.com/bigquery/docs/load-transform-export-intro.md.txt | Describes the data integration approaches to load and transform data in BigQuery using the extract, load, and transform (ELT) or the extract, transform, load (ETL) processes. |
| BigQuery: Natural language processing function | https://docs.cloud.google.com/bigquery/docs/choose-ml-text-function.md.txt | Compares the capabilities of BigQuery ML text functions, such as AI.GENERATE\_TEXT, ML.TRANSLATE, and ML.UNDERSTAND\_TEXT, to help you choose between them. |
| BigQuery: Text generation function | https://docs.cloud.google.com/bigquery/docs/choose-text-generation-function.md.txt | Compares the different text generation options in BigQuery ML (such as using Gemini models vs. other LLMs) to select the appropriate fit. |
| Bigtable: SSD vs HDD | https://docs.cloud.google.com/bigtable/docs/choosing-ssd-hdd.md.txt | Compares the performance, cost, and use cases of SSD versus HDD storage to help you select the best disk layout for your Cloud Bigtable instances. |
| CDN products: Cloud CDN vs. Media CDN | https://docs.cloud.google.com/cdn/docs/choose-cdn-product.md.txt | Helps you select the best CDN product (Cloud CDN vs. Media CDN) based on your content delivery requirements and architecture. |
| Cloud Run: When to use | https://docs.cloud.google.com/run/docs/fit-for-run.md.txt | Provides a checklist and technical assessment guide to determine if your containerized application is well-suited for deployment on Cloud Run. |
| Cloud SQL for MySQL: Editions | https://docs.cloud.google.com/sql/docs/mysql/choose-edition.md.txt | Provides guidance on choosing between Enterprise and Enterprise Plus editions for Cloud SQL for MySQL. |
| Cloud SQL for MySQL: Machine series | https://docs.cloud.google.com/sql/docs/mysql/machine-series-overview.md.txt | Guides you in choosing the optimal machine family and series (general-purpose, memory-optimized, etc.) for your Cloud SQL for MySQL instances. |
| Cloud SQL for MySQL: Storage | https://docs.cloud.google.com/sql/docs/mysql/storage-options-overview.md.txt | Helps you select the best storage options (SSD vs. HDD, automatic storage increase) for Cloud SQL for MySQL databases based on IOPS and throughput needs. |
| Cloud SQL for MySQL: Region availability | https://docs.cloud.google.com/sql/docs/mysql/region-availability-overview.md.txt | Provides information on regional availability and feature support across Google Cloud regions for Cloud SQL for MySQL. |
| Cloud SQL for PostgreSQL: Editions | https://docs.cloud.google.com/sql/docs/postgres/choose-edition.md.txt | Provides guidance on choosing between Enterprise and Enterprise Plus editions for Cloud SQL for PostgreSQL. |
| Cloud SQL for PostgreSQL: Machine series | https://docs.cloud.google.com/sql/docs/postgres/machine-series-overview.md.txt | Guides you in choosing the optimal machine family and series (general-purpose, memory-optimized, etc.) for your Cloud SQL for PostgreSQL instances. |
| Cloud SQL for PostgreSQL: Region availability | https://docs.cloud.google.com/sql/docs/postgres/region-availability-overview.md.txt | Provides information on regional availability and feature support across Google Cloud regions for Cloud SQL for PostgreSQL. |
| Cloud SQL for PostgreSQL: Storage | https://docs.cloud.google.com/sql/docs/postgres/storage-options-overview.md.txt | Helps you select the best storage options (SSD vs. HDD, automatic storage increase) for Cloud SQL for PostgreSQL databases based on IOPS and throughput needs. |
| Cloud SQL for SQL Server: Editions | https://docs.cloud.google.com/sql/docs/sqlserver/choose-edition.md.txt | Provides guidance on choosing between Enterprise and Enterprise Plus editions for Cloud SQL for SQL Server. |
| Cloud SQL for SQL Server: Machine series | https://docs.cloud.google.com/sql/docs/sqlserver/machine-series-overview.md.txt | Guides you in choosing the optimal machine family and series (general-purpose, memory-optimized, etc.) for your Cloud SQL for SQL Server instances. |
| Cloud SQL for SQL Server: Region availability | https://docs.cloud.google.com/sql/docs/sqlserver/region-availability-overview.md.txt | Provides information on regional availability and feature support across Google Cloud regions for Cloud SQL for SQL Server. |
| Cloud SQL for SQL Server: Storage | https://docs.cloud.google.com/sql/docs/sqlserver/storage-options-overview.md.txt | Helps you select the best storage options (SSD vs. HDD, automatic storage increase) for Cloud SQL for SQL Server databases based on IOPS and throughput needs. |
| Cloud Storage: Bucket location | https://docs.cloud.google.com/storage/docs/locations.md.txt | Provides guidance to help you choose appropriate locations for Cloud Storage buckets. |
| Compute Engine: Migration path | https://docs.cloud.google.com/compute/docs/import.md.txt | Helps you evaluate and select the best migration strategy and toolset for migrating your virtual machine workloads into Compute Engine. |
| Compute Engine: Reservation type | https://docs.cloud.google.com/compute/docs/instances/choose-reservation-type.md.txt | Describes reservation types to help you decide how to reserve compute capacity for Compute Engine instances based on your workload needs. |
| Compute Engine: VM deployment strategy | https://docs.cloud.google.com/compute/docs/choose-compute-deployment-option.md.txt | Helps you select an appropriate VM deployment strategy on Compute Engine based on workload resilience, scalability, and cost requirements. |
| Compute Engine: Region selection | https://docs.cloud.google.com/solutions/best-practices-compute-engine-region-selection.md.txt | Describes the criteria that you should consider when you choose Google Cloud regions for your Compute Engine resources |
| Container runtimes | https://docs.cloud.google.com/architecture/select-managed-container-runtime-environment.md.txt | A selection guide comparing managed container options (GKE Autopilot vs. Cloud Run vs. App Engine Flexible) based on organizational and technical factors. |
| Container runtimes: GKE vs. Cloud Run | https://docs.cloud.google.com/kubernetes-engine/docs/concepts/gke-and-cloud-run.md.txt | Provides a comparison of GKE and Cloud Run and their advantages, and helps you find out if a single-platform or hybrid strategy will work for you. |
| Eventarc: Advanced vs. Standard | https://docs.cloud.google.com/eventarc/standard/docs/choose-product-edition.md.txt | Compares the features, scalability, and event-routing models of Eventarc Standard and Eventarc Advanced to help you choose the appropriate edition. |
| Firestore: Native mode vs. Datastore mode | https://docs.cloud.google.com/datastore/docs/firestore-or-datastore.md.txt | Detailed guide comparing Firestore in Native mode versus Datastore mode, including features, scaling limits, and target use cases. |
| Gemini Enterprise Agent Platform: Serverless training method | https://docs.cloud.google.com/vertex-ai/docs/training/custom-training-methods.md.txt | Helps you compare custom training options in Agent Platform, such as custom jobs, hyperparameter tuning jobs, and training pipelines. |
| Gemini Enterprise Agent Platform: Training method | https://docs.cloud.google.com/vertex-ai/docs/start/training-methods.md.txt | Guides you in selecting the appropriate model training approach in Agent Platform, comparing AutoML, custom training, and BigQuery ML. |
| Gemini Enterprise Agent Platform: Vector database for RAG Engine | https://docs.cloud.google.com/gemini-enterprise-agent-platform/build/rag-engine/vector-db-choices.md.txt | Describes and compare the vector database options that are supported on Agent Platform RAG Engine. |
| GKE: Cluster mode | https://docs.cloud.google.com/kubernetes-engine/docs/concepts/choose-cluster-mode.md.txt | Compares GKE Autopilot and Standard modes to help you decide which level of operational control and management is best for your cluster. |
| GKE: Multi-cluster load balancing API | https://docs.cloud.google.com/kubernetes-engine/docs/concepts/choose-mc-lb-api.md.txt | Compares Multi-Cluster Gateway versus Multi-Cluster Ingress to help you choose the correct multi-cluster load balancing approach for GKE. |
| GKE: Predefined ComputeClasses for Autopilot Pods | https://docs.cloud.google.com/kubernetes-engine/docs/how-to/autopilot-compute-classes.md.txt | Explains GKE Autopilot ComputeClasses (Balanced, Scale-Out, Performance) to help you choose the appropriate hardware profile for your containers. |
| Google Cloud Observability: Instrumentation strategy | https://docs.cloud.google.com/stackdriver/docs/instrumentation/choose-approach.md.txt | Guides you through the process of choosing a telemetry instrumentation strategy (such as OpenTelemetry vs. legacy agents) for Google Cloud Observability. |
| Load balancing | https://docs.cloud.google.com/load-balancing/docs/choosing-load-balancer.md.txt | Helps you choose the appropriate Google Cloud load balancer based on client location, protocol, and proxy requirements. |
| Looker: Hosting | https://docs.cloud.google.com/looker/docs/choosing-hosting-option.md.txt | Provides a comprehensive guide to selecting the optimal hosting model (Looker-hosted vs. customer-hosted) based on your requirements |
| Model inference on GKE: Load balancing strategy | https://docs.cloud.google.com/kubernetes-engine/docs/concepts/machine-learning/choose-lb-strategy.md.txt | Provides guidance on load balancing strategies for AI/ML inference workloads on Google Kubernetes Engine. |
| Network Connectivity | https://docs.cloud.google.com/network-connectivity/docs/how-to/choose-product.md.txt | Provides guidance to help you choose appropriate hybrid connectivity options: Cloud Interconnect, Cloud VPN, and Network Connectivity Center. |
| Pub/Sub vs. Cloud Managed Service for Apache Kafka | https://docs.cloud.google.com/pubsub/docs/choose-pubsub-kafka.md.txt | Compares serverless global Pub/Sub versus Google Cloud's Managed Service for Apache Kafka. |
| Pub/Sub vs. Cloud Tasks | https://docs.cloud.google.com/pubsub/docs/choosing-pubsub-or-cloud-tasks.md.txt | Describes the fundamental differences (implicit vs. explicit invocation) between Pub/Sub and Cloud Tasks. |
| Pub/Sub vs. Pub/Sub Lite | https://docs.cloud.google.com/pubsub/docs/choosing-pubsub-or-lite.md.txt | Helps you choose between standard Pub/Sub and Pub/Sub Lite based on budget, operations, and scale requirements. |
| Secret Manager: Replication policy | https://docs.cloud.google.com/secret-manager/docs/choosing-replication.md.txt | Compares automatic replication versus user-managed replication policies in Secret Manager to help you decide how to secure and distribute secrets. |
| Security Command Center: Security sources | https://docs.cloud.google.com/security-command-center/docs/concepts-security-sources.md.txt | Guides you on choosing and configuring security sources (built-in, Google-provided, and third-party) to integrate with Security Command Center. |
| Storage for AI and ML | https://docs.cloud.google.com/ai-hypercomputer/docs/storage.md.txt | Introduces and compares storage services in Google Cloud that can best help you optimize GPU or TPU performance and provides recommendations on the ideal service for specific AI and ML use cases. |
| Storage strategy | https://docs.cloud.google.com/architecture/storage-advisor.md.txt | Helps you understand and choose appropriate storage services for any workload. |
| VPC: Private access | https://docs.cloud.google.com/vpc/docs/private-access-options.md.txt | Compares different private access options on Google Cloud VPC, such as Private Google Access, Private Service Connect, and serverless VPC access. |
| Workflows vs. Application Integration | https://docs.cloud.google.com/workflows/docs/choose-app-integ-or-workflows.md.txt | Compares the capabilities and ideal scenarios for Google Cloud Workflows and Application Integration to help you choose the appropriate orchestration service. |
| Workflows vs. Managed Airflow for service orchestration | https://docs.cloud.google.com/workflows/docs/choose-orchestration.md.txt | Compares Workflows versus Managed Service for Apache Airflow (Cloud Composer) based on latency, scaling models, and language (YAML vs. Python). |

---
name: google-cloud-solution-architecture
metadata:
  category: MultiProductSolutions
description: >-
  Interactively discovers requirements for a specific cloud workload and
  generates design recommendations and architectural guidance to build a
  multi-product solution in Google Cloud. Use this skill to generate holistic,
  end-to-end design recommendations and architectural guidance for complex,
  multi-product workloads on Google Cloud for specific use cases. Don't use this
  skill when other specialized skills (e.g., product-specific or
  google-cloud-recipe-*) directly address the user's workload or use case.
---

# Google Cloud solution-architecture workflow

## Overview of the workflow

The workflow consists of the following phases:

*   **Phase 1: Requirements discovery**. Gather detailed requirements related to
    the cloud workload or use case that the user needs assistance for.
*   **Phase 2: Solution architecture**. Use the requirements that were gathered
    in Phase 1 to generate a detailed solution architecture for the cloud
    workload or use case.
*   **Phase 3: Solution validation**. Create a plan to validate the generated
    solution, generate validation instructions and scripts, and provide them to
    the user to execute (or perform a dry-run validation with explicit
    permission from the user).
*   **Phase 4: Solution packing and presentation**. Consolidate the generated
    content and present the solution.

**Important notes about the workflow**:

*   **Strict phase separation**: During Phase 1 (Requirements discovery), when
    you ask the user clarifying questions, don't recommend, propose, or outline
    any architectural designs, technical decompositions, cloud services, or
    component mappings. Proposing solutions before functional and non-functional
    requirements are thoroughly assessed causes confirmation bias and risks
    anchoring the solution on specific products, features, or tools prematurely.

*   **Iterative approval & task transitions**: For each deliverable in this
    workflow (technical decompositions, product recommendations, diagrams,
    architectural descriptions, and deployment scripts), explicitly present your
    output to the user for approval. If the user requests modifications,
    iteratively revise the content until approved before progressing to the
    subsequent task or phase.

*   **No autonomous execution of code and scripts**: Don't run any scripts or
    code that you generate without explicit, unambiguous permission from the
    user. Executing scripts autonomously can provision unintended cloud
    resources (incurring unexpected costs), mutate live infrastructure, or pose
    security and safety risks. Always offer the option for the user to execute
    the commands manually.

*   **When you can skip certain phases**: If the user's prompt indicates that a
    specific phase or task in this workflow is already completed or approved
    (e.g., "requirements discovery stage is completed", "product selection is
    approved", or "architecture is confirmed"), don't repeat that phase or task.
    Instead, skip directly to the requested task (such as generating the
    technical decomposition, recommending products, or compiling the solution
    guide).

## Phase 1: Requirements discovery

1.  Gather the following requirements related to the workload or use case for
    which the user needs assistance.

    **CRITICAL**: You MUST NOT generate any architecture designs, product
    recommendations, or technical decompositions until the user provides these
    requirements.

    *   **Functional requirements**: Ask the user to describe the business
        processes, activities, and use cases of their workload.
    *   **Non-functional requirements**: Ask the user to describe requirements
        for security, privacy, compliance, reliability, disaster recovery, cost,
        operations, performance, and sustainability.
        *   **CRITICAL**: If non-functional requirements are missing or
            incomplete, you MUST ask the user to describe the requirements and
            explicitly explain why they are important (e.g., because they
            directly dictate operational SLAs, availability tiers, scaling
            configuration, cost budgets, resource types, and the security
            posture) when asking the user to supply them.
    *   **Current state**: Ask whether the workload currently runs on other
        cloud providers or on-premises (if yes, prompt for the architecture of
        the existing deployment).
    *   **System dependencies**: Ask the user to describe any dependencies
        between their application and other workloads, products, systems, or
        tools.

2.  Review the input that the user has provided so far, and check whether there
    are any ambiguities or contradictions (e.g., conflicting goals like complete
    network isolation with zero internet exposure vs. real-time ingestion from
    public APIs).

    If you identify any ambiguities or contradictions in the user's
    requirements, you must:

    *   Clearly describe the ambiguities and contradictions.
    *   Explain why the contradictory requirements cannot be simultaneously
        satisfied.
    *   Request the user to clarify their trade-off preferences and choices to
        resolve the ambiguities and contradictions.
        *   If the user delegates the choice to you (e.g., the user replies with
            "do what you think is best" or "you decide"), then provide a clear
            suggestion to resolve the ambiguity or contradiction, explain your
            reasoning, and ask the user to approve your suggestion.

    **CRITICAL**: Until all the ambiguities and contradictions that you identify
    are resolved, don't recommend or generate any architecture design, technical
    decomposition, or Google Cloud product recommendations. Ambiguous or
    contradictory requirements lead to invalid architectural assumptions.

3.  Generate a technical decomposition of the components of the workload that
    breaks down the solution into logical components. Present it to the user and
    obtain approval before proceeding to Phase 2.

    **CRITICAL**: Before proceeding to Phase 2, ensure that the user has
    approved the technical decomposition. Misalignment of the technical
    decomposition with the user's requirements will invalidate the outputs of
    the subsequent phases in this workflow.

## Phase 2: Solution architecture

Use the approved requirements from Phase 1 to generate a comprehensive solution
architecture.

### Ground all generated content

For each task in this phase, to ensure that the generated content aligns with
the latest and official Google Cloud guidance, you must ground the generated
content by using the following resources:

*   Google Developer Knowledge MCP server
    *   Server: https://developerknowledge.googleapis.com/mcp
    *   Tools:
    *   `developerknowledge:search_documents`
    *   `developerknowledge:get_documents`
    *   `developerknowledge:answer_query`
*   Relevant skills from https://github.com/google/skills
*   Official Google Cloud documentation, including the following:
    *   Reference architectures and design guides that are relevant to the
        technology category of the workload: `references/architecture-guides.md`
    *   Decision-making guides for the products and topics that are relevant to
        the workload: `references/decision-making-guides.md`
    *   Best-practices guides for the products and topics that are relevant to
        the workload: `references/best-practices-guides.md`

For each item in the generated guidance, you must include citations to the
relevant official Google Cloud documentation pages.

### Task 2.1: Identify Google Cloud products and features required for the workload.

1.  Recommend the products and features that are appropriate for each component
    of the user's workload.

    **CRITICAL**:

    *   Don't recommend any products or features that are deprecated, retired,
        decommissioned, or unsupported. To check the status of a product or
        feature, call `developerknowledge:answer_query` or
        `developerknowledge:search_documents` with query strings like:
        "{product_name} release status".
    *   If multiple products or features can be used for a component of the
        workload, then do the following:
        *   Recommend the most appropriate product or feature. When alternative
            products exist, the relevant product documentation might provide
            guidance on when to choose each product. Follow that guidance.
        *   Mention the available alternative products or features.
        *   Explain the pros and cons of each alternative product or feature.

2.  Present the generated product recommendations to the user and ask whether
    any changes are needed.

    **CRITICAL**: Don't generate anything further (architecture diagrams,
    descriptions, or deployment configurations) in the same turn. Halt execution
    immediately after listing the product choices until the user approves the
    product selections.

3.  After the user approves the product selections, proceed to Task 2.2.

### Task 2.2: Generate an architecture diagram.

1.  Generate an architecture diagram in Mermaid format:
    https://github.com/mermaid-js/mermaid.
2.  Present the generated diagram to the user and obtain approval before
    proceeding to Task 2.3.

### Task 2.3: Generate an architecture description.

1.  Generate a description that explains the purpose of each component, the
    relationships between the components, and the task flow or data flow.
2.  Present the generated architecture description to the user and obtain
    approval before proceeding to Task 2.4.

### Task 2.4: Generate design recommendations.

1.  Generate design recommendations and best practices to optimally configure
    each component in the architecture based on the workload's requirements.
    **Important**:

    *   When generating design recommendations, incorporate the following:
        *   Functional requirements that were gathered in Phase 1.
        *   Non-functional requirements that were gathered in Phase 1.
    *   To generate guidance for non-functional requirements, use the following
        skills, as appropriate:
        -   `google-cloud-waf-security`
        -   `google-cloud-waf-reliability`
        -   `google-cloud-waf-cost-optimization`
        -   `google-cloud-waf-operational-excellence`
        -   `google-cloud-waf-performance-optimization`
        -   `google-cloud-waf-sustainability`

    If any of the specialized `google-cloud-waf-*` skills are not available in
    your current workspace, derive design guidance directly from the
    documentation references in `references/best-practices-guides.md`.

2.  Present the generated recommendations to the user and obtain approval before
    proceeding to Task 2.5.

### Task 2.5: Generate deployment guidance.

1.  Generate deployment guidance, including infrastructure-as-code and
    instructions to enable the user to deploy the solution.
2.  Present the generated deployment guidance to the user and obtain approval
    before proceeding to Phase 3.

## Phase 3: Solution validation

### Task 3.1: Pre-deployment validation

1.  Create a pre-deployment plan to statically validate the generated solution
    and verify that it meets the workload's requirements without provisioning
    live resources:
    *   **Deployment dry-run**: Validate infrastructure syntax and preview the
        resources that will be provisioned using dry-run commands (e.g.,
        `terraform plan` or (where supported) `gcloud ... --dry-run`).
    *   **Architecture & policy analysis**: Perform static verification of
        network routing topologies, firewall rules, and IAM enforcement against
        best practices.
2.  Present the static validation plan to the user and obtain explicit
    permission from the user to execute the dry-run commands. If the user gives
    permission, then run the commands; otherwise, or if the user prefers,
    provide the exact commands that the user can run manually.
3.  Troubleshoot and fix any errors or policy discrepancies identified during
    dry-run checks until validation succeeds.
4.  Proceed to Task 3.2

### Task 3.2: Runtime validation (Post-deployment)

1.  Ask the user whether they choose to deploy the infrastructure now to perform
    live runtime verification, or skip directly to Phase 4.
2.  **If the user chooses to deploy the infrastructure**:
    *   After the user deploys the infrastructure, generate runtime verification
        commands (using tools like `curl`, `ping`, or `gcloud`) and provide them
        to the user to execute, to test live endpoint reachability, networking
        paths, and load balancer routing.
    *   Troubleshoot any deployment or runtime routing issues until checks pass.
3.  Proceed to Phase 4.

## Phase 4: Solution packaging and presentation

Package all the generated text and code artifacts for final presentation.

1.  Consolidate the text artifacts that were generated in Phase 2 and Phase 3
    into a single Markdown file named `solution-architecture-guide.md`, based on
    the template in `assets/output-template.md`.
2.  Request the user's permission to write the code files in the user's
    workspace.
3.  After the user gives permission, write the code files in the user's
    workspace.