gcloud CLI Cheatsheet: IAM, Cloud Run and GCS Reference

# install (macOS — Homebrew cask)
brew install --cask gcloud-cli

# install (Linux — bundled tarball)
curl -O https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-cli-linux-x86_64.tar.gz
tar -xf google-cloud-cli-linux-x86_64.tar.gz && ./google-cloud-sdk/install.sh

# verify
gcloud --version            # Google Cloud SDK 503+

# login: human (browser)
gcloud auth login
gcloud config set project my-project
gcloud config set compute/region us-central1
gcloud config set compute/zone   us-central1-a

# login: workload (service account JSON — CI, local emulation)
gcloud auth activate-service-account --key-file=key.json

# login: Application Default Credentials (libraries read these)
gcloud auth application-default login

# named configurations (multi-project)
gcloud config configurations create dev
gcloud config configurations activate dev   # like AWS profiles
gcloud config configurations list

# --filter is server-side; --format is client-side projection.

# running VMs, sorted by name, projected to a table
gcloud compute instances list \
  --filter="status=RUNNING AND labels.env=prod" \
  --sort-by=name \
  --format="table(name, zone.basename(), machineType.basename(), status, networkInterfaces[0].networkIP)"

# IDs only — feed straight into xargs
gcloud compute instances list --filter="labels.env=stale" \
  --format="value(name)" \
  | xargs -I{} gcloud compute instances delete {} --quiet

# JSON of a single resource
gcloud run services describe my-svc --region us-central1 --format=json | jq .

# CSV export
gcloud projects list --format="csv(projectId,name,projectNumber)" > projects.csv

# grant a role at the project level
gcloud projects add-iam-policy-binding my-project \
  --member="serviceAccount:ci@my-project.iam.gserviceaccount.com" \
  --role="roles/run.admin" \
  --condition=None

# revoke
gcloud projects remove-iam-policy-binding my-project \
  --member="serviceAccount:ci@my-project.iam.gserviceaccount.com" \
  --role="roles/run.admin"

# resource-scoped binding (bucket)
gcloud storage buckets add-iam-policy-binding gs://my-bucket \
  --member="user:alice@example.com" \
  --role="roles/storage.objectViewer"

# who can do what — flatten the policy for grep-ability
gcloud projects get-iam-policy my-project \
  --flatten="bindings[].members" \
  --format="table(bindings.role, bindings.members)" \
  --filter="bindings.members:alice@example.com"

# live tail (follow) — like aws logs tail
gcloud logging tail "resource.type=cloud_run_revision AND severity>=ERROR" --buffer-window=1s

# one-shot, last 1h, last 100 entries
gcloud logging read \
  'resource.type="cloud_run_revision"
   AND resource.labels.service_name="my-svc"
   AND severity>=WARNING
   AND timestamp>="2026-05-19T00:00:00Z"' \
  --limit=100 --format=json | jq '.[].textPayload'

# filter by trace, follow a request across services
gcloud logging read \
  "trace=\"projects/$PROJECT/traces/abc123\"" \
  --format="table(timestamp, resource.labels.service_name, textPayload)"

# create a log-based metric (alertable)
gcloud logging metrics create error-rate \
  --description="ERROR-level Cloud Run logs" \
  --log-filter='resource.type="cloud_run_revision" AND severity>=ERROR'

# end-to-end: build + deploy a container to Cloud Run, wire up a secret
PROJECT=my-project
REGION=us-central1
SVC=hello

# 1) buildpacks: source → image, no Dockerfile needed
gcloud builds submit --pack image=us-docker.pkg.dev/$PROJECT/app/$SVC:v1

# 2) create a secret and let the service read it
echo -n "s3cr3t" | gcloud secrets create api-key --data-file=-
gcloud secrets add-iam-policy-binding api-key \
  --member="serviceAccount:$PROJECT-compute@developer.gserviceaccount.com" \
  --role="roles/secretmanager.secretAccessor"

# 3) deploy: public, autoscaling, secret mounted as env var
gcloud run deploy $SVC \
  --image=us-docker.pkg.dev/$PROJECT/app/$SVC:v1 \
  --region=$REGION \
  --allow-unauthenticated \
  --memory=512Mi --cpu=1 --max-instances=10 \
  --set-secrets=API_KEY=api-key:latest

# 4) tail logs
gcloud run services logs tail $SVC --region=$REGION