Cloud Storage

GCP Fundamentals

Chapter 4 · Cloud Storage

AWS Fundamentals Chapter 4 covered S3's real, fixed 11-nines durability. Azure Fundamentals Chapter 4 covered Azure Blob Storage's own real choice of durability level, and a genuine 2023 SAS-token leak case study. GCP's own real Cloud Storage borrows the AWS-style "one fixed durability figure" approach — but delivers a genuinely distinctive real twist on how its coldest tier actually behaves.

Real Storage Classes

Class	Real Min. Duration	Real Availability SLA	Use Case
Standard	None	99.9%–99.95%	Frequently accessed ("hot") data
Nearline	30 days	99.0%–99.9%	Accessed roughly once a month or less
Coldline	90 days	99.0%–99.9%	Accessed at most once a quarter
Archive	365 days	99.0%–99.9%	Accessed less than once a year, incl. disaster recovery

A Real, Genuinely Distinctive Feature: Uniform Millisecond Retrieval

Every Tier Retrieves in Milliseconds — Even Archive

Neither AWS Fundamentals Chapter 4's own Glacier tiers (real retrieval times measured in hours) nor Azure Fundamentals Chapter 4's own Archive tier (up to 15 real hours to rehydrate) match GCP's real behavior here: even GCP's coldest class, Archive, is real, genuinely available for retrieval "within milliseconds, not hours or days." Every one of GCP's four storage classes differs in cost, minimum storage duration, and retrieval fees — but not in real access speed, unlike the AWS and Azure models this course's own two sibling chapters covered.

Real, Uniform Durability

All four GCP storage classes share the same real, documented durability figure: 99.999999999% annual durability — 11 nines, identical to S3's own real figure, and applied uniformly across every class rather than varying by a real, chosen redundancy configuration the way Azure Blob Storage's own LRS/ZRS/GRS choice does.

Public Access Prevention

GCP's own real, direct equivalent of S3's Block Public Access is Public Access Prevention: enforced at the bucket level or, per Chapter 1's own real Organization hierarchy, across an entire Organization via policy constraint. Once enforced, any request relying on the real allUsers or allAuthenticatedUsers principals fails outright (HTTP 401/403) — existing public permissions are overridden, not deleted, meaning enforcement doesn't require hunting down and manually removing every individual public grant first.

Signed URLs

GCP's own real equivalent of AWS pre-signed URLs and Azure SAS tokens is the Signed URL — a real, time-limited credential embedded directly in a URL, granting temporary access to a specific resource without the requester needing standing IAM credentials at all.

A Real, Platform-Enforced Safety Ceiling

Azure Fundamentals Chapter 4's own 2023 case study involved a SAS token real, effectively permanent expiration (valid until 2051) with no platform-level ceiling stopping it. GCP's own real Signed URLs cannot make that same mistake at the platform level: the maximum real expiration is capped at 604,800 seconds — exactly 7 days — enforced by GCP itself, not merely a best-practice recommendation. A real, common practical pattern uses a much shorter window still, often 15 minutes, for actual uploads and downloads.

S3 vs. Blob Storage vs. Cloud Storage

Property	AWS S3	Azure Blob Storage	GCP Cloud Storage
Durability	Fixed, 11 nines	Chosen — 11/12/16 nines	Fixed, 11 nines (uniform across classes)
Coldest-tier retrieval	Hours (Glacier)	Up to 15 hours (Archive)	Milliseconds (Archive) — real, genuinely distinctive
Public-exposure guard	Block Public Access	Block Public Access	Public Access Prevention
Scoped temporary access	Pre-signed URLs	SAS tokens (no platform-enforced max)	Signed URLs, real 7-day platform-enforced max

Hands-On Exercises

Exercise 1

A team moves rarely-accessed compliance records to GCP's Archive class, then worries their disaster-recovery plan needs data restorable within minutes if ever required. Explain, in your own words, why GCP's own real Archive class behavior addresses this concern in a way AWS Glacier and Azure's own Archive tier genuinely couldn't.

📄 View solution

Exercise 2

A developer tries to create a Signed URL intended to remain valid for 30 days, to avoid regenerating it repeatedly. Explain, in your own words, why this specific request cannot succeed on GCP, and what real, structural protection this provides compared to Azure's own SAS token model.

📄 View solution

Exercise 3

A bucket has several existing public IAM grants when Public Access Prevention is enforced on it. Explain, in your own words, whether those existing grants need to be manually deleted first for the enforcement to actually take effect, and why.

📄 View solution

Chapter 4 Quick Reference

Storage classes — Standard (no min.), Nearline (30 days), Coldline (90 days), Archive (365 days)
Real, genuinely distinctive: every class retrieves in milliseconds — even Archive — unlike AWS Glacier or Azure Archive
Durability — real, fixed 11 nines across every class, applied uniformly
Public Access Prevention — GCP's real Block-Public-Access equivalent, enforceable at bucket or Organization level
Signed URLs — real, time-limited access; platform-enforced 7-day (604,800-second) maximum expiration, unlike Azure's own unbounded SAS tokens