Compute Engine Best Practices

This lesson brings together the key best practices for running production workloads on Compute Engine. Following these guidelines will help you build secure, reliable, cost-efficient, and well-managed VM-based architectures on Google Cloud.

---

Security Best Practices

Use Least-Privilege Service Accounts

Every VM is associated with a service account. Never use the default Compute Engine service account in production — it has overly broad permissions. Create dedicated service accounts with only the IAM roles your application needs:

# Create a dedicated service account
gcloud iam service-accounts create app-sa \
  --display-name="Application Service Account"

# Grant only the required roles
gcloud projects add-iam-policy-binding my-project \
  --member=serviceAccount:app-sa@my-project.iam.gserviceaccount.com \
  --role=roles/storage.objectViewer

# Use it when creating a VM
gcloud compute instances create app-server \
  --zone=europe-west2-a \
  --machine-type=e2-standard-2 \
  --service-account=app-sa@my-project.iam.gserviceaccount.com \
  --scopes=cloud-platform \
  --image-family=debian-12 \
  --image-project=debian-cloud

Avoid External IP Addresses

Do not assign external (public) IP addresses to VMs unless absolutely necessary. Instead: