Compute Engine

GCP Fundamentals

Chapter 3 · Compute Engine

AWS Fundamentals Chapter 3 covered EC2; Azure Fundamentals Chapter 3 covered Azure VMs' own real B-series credit model and IMDS story. Compute Engine, Google's own real virtual machine service, was announced 28 June 2012 at Google I/O in limited preview, reaching general availability by December 2013 — and it brings its own genuinely distinctive real pricing and security mechanisms.

Real Machine Families

Family	Real Tuned For
E2	Cost-effective, light workloads
N2 / N2D	General purpose, consistently high performance (Intel/AMD)
C2 / C3	Compute optimized — HPC, compute-bound workloads
M2 / M3	Memory optimized — large in-memory databases
A2 / A3	GPU-accelerated — ML training and inference (NVIDIA A100/H100)
T2A	ARM-based (Ampere Altra), cost-effective, scale-out

A Real, Genuinely Distinctive Feature: Automatic Sustained Use Discounts

Zero Enrollment, Zero Commitment

Unlike AWS's own Reserved Instances or Azure's own Reserved VM Instances — both requiring an explicit 1- or 3-year purchase decision — GCP's Sustained Use Discount (SUD) is real, entirely automatic: the more of a calendar month an eligible instance runs, the bigger the real discount, calculated and applied with zero enrollment or manual configuration at all. Real documented tiers: 0% for the first quarter of the month, rising in real steps to a maximum 30% net discount for resources that run the full month.

A Real, Easy-to-Miss Eligibility Gap

Not every machine family qualifies for the maximum real discount — and one real, genuinely important exception stands out: E2, the very family recommended above for cost-effective workloads, is not eligible for sustained use discounts at all. N1/M1/M2 real instances can reach a 30% discount; N2/N2D/C2 top out at 20%; E2 (and GPU/accelerator families) get none. E2's own lower baseline price doesn't stack with a real SUD the way an N2 instance's own price can.

Committed Use Discounts

Real Committed Use Discounts (CUDs) work more like AWS's or Azure's own reserved pricing — a real, upfront resource-based commitment for a defined term, in exchange for a larger discount than SUDs alone provide. CUDs and SUDs can be combined for the same instance.

Spot VMs

GCP's own real Spot VMs offer discounts of up to 91% off on-demand pricing — genuinely in the same real range as AWS Spot and Azure Spot VMs (both up to ~90%).

A Real, More Abrupt Default

GCP's own real default preemption notice is 0 seconds — an instance can be reclaimed with no advance warning at all unless you explicitly configure up to 120 seconds of notice. This is a genuinely more abrupt real default than the warning period AWS and Azure Spot instances typically provide, and worth designing around explicitly for any workload that needs even a brief graceful-shutdown window.

A Real, Genuinely Different Firewall Model

Network-Level Definition, Per-Instance Enforcement

Neither AWS's per-instance security groups nor Azure's NSGs quite match GCP's own real model: firewall rules are defined at the VPC network level, not attached to any individual instance directly — but enforcement still happens per-instance, via real targeting mechanisms: network tags (a label applied to matching instances) or service accounts (targeting instances using a specific identity). A rule with no target applies to every instance in the network by default.

GCP firewall rules are real and stateful — an allowed connection's own reply traffic is automatically permitted back, the same real behavior as AWS security groups and Azure NSGs. The platform enforces a real, implicit default-deny for inbound traffic, though GCP's own default network ships with pre-populated permissive rules (SSH, RDP, ICMP, internal traffic) that a production environment should review and tighten.

OS Login: IAM-Integrated SSH Access

Where AWS and Azure rely on a real SSH key pair generated at instance launch, GCP offers a genuinely more integrated real alternative: OS Login ties SSH access directly to IAM (Chapter 2) rather than a static credential. Real, critical difference: OS Login performs a permission check on every single login attempt — revoking access immediately the moment an IAM role is changed or removed, unlike a traditional metadata-based SSH key, which keeps working regardless of any later IAM change until someone manually removes it.

The Same Real Theme, One Level Deeper

This is genuinely the same real "avoid static, long-lived credentials" principle Chapter 2's own service-account-key warning taught — applied here specifically to SSH access instead of API credentials.

EC2 vs. Azure VM vs. Compute Engine

Property	AWS EC2	Azure VM	GCP Compute Engine
Real launch	2006	June 2012	Announced June 2012, GA Dec 2013
Discount for steady use	Reserved Instances (explicit purchase)	Reserved VM Instances (explicit purchase)	Sustained Use Discounts — real, automatic, zero enrollment
Real Spot/preemptible discount	Up to ~90%	Up to 90%	Up to 91%
Firewall model	Per-instance security group + subnet NACL	One stateful NSG (subnet or NIC)	Network-level rules, per-instance enforcement via tags/service accounts
SSH access model	Static key pair	Static key pair (typically)	OS Login — real, per-login IAM permission check

Hands-On Exercises

Exercise 1

A team picks E2 machines for a workload specifically because they expect to also benefit from Sustained Use Discounts once the instances run continuously all month. Explain, in your own words, why this expectation is incorrect.

📄 View solution

Exercise 2

A workload needs at least a few seconds to save state gracefully before shutting down, and the team is deploying it on GCP Spot VMs using the real default configuration. Explain, in your own words, why this default is a genuine risk here, and what real, specific change would fix it.

📄 View solution

Exercise 3

An employee's IAM permissions are revoked immediately after they leave a team, but the team is unsure whether this genuinely blocks their SSH access to production instances right away. Explain, in your own words, why the answer depends on whether OS Login or traditional metadata-based SSH keys are being used.

📄 View solution

Chapter 3 Quick Reference

Compute Engine — announced June 2012, GA by December 2013
Machine families — E2 (economical, no SUD), N2/N2D (general purpose), C2/C3 (compute), M2/M3 (memory), A2/A3 (GPU), T2A (ARM)
Sustained Use Discounts — real, automatic, zero-enrollment, up to 30% (N1/M1/M2) or 20% (N2/N2D/C2); E2 not eligible
Spot VMs — up to 91% off; real 0-second default eviction notice (configurable up to 120 seconds)
Real firewall model: rules defined at the network level, enforced per-instance via network tags or service accounts — genuinely unlike AWS/Azure
OS Login — real IAM-integrated SSH, checked on every login attempt; immediate revocation, unlike static SSH keys