Let’s talk
INSIGHTS / KNOWLEDGE, SHARED

Ideas for
your next move.

Practical thinking for teams building software, securing systems and operating modern infrastructure. Explore our engineering field notes.

500 insights · Page 13 of 42

IAP Service Accounts: Choose the Supported Token Flow — conceptual 3D-style vector showing Automation identity, Token flow choice, URL-scoped JWT, OAuth-client OIDC, IAP access policy, Protected web app.ENGINEERING JOURNAL ↗
Google Cloud Operations

IAP Service Accounts: Choose the Supported Token Flow

Authenticate automated calls to IAP-protected web resources by distinguishing service-account JWTs, OIDC client audiences, access policy, and backend responses.

Read field note ↗
Disabled CMEK Versions: Trace the Dependent Service — conceptual 3D-style vector showing Encrypted resource, Service agent, KMS permission, Key version state, Service recovery, Application check.ENGINEERING JOURNAL ↗
Google Cloud Operations

Disabled CMEK Versions: Trace the Dependent Service

Investigate CMEK access failures by checking the exact KMS key version, service-agent permissions, dependent resource state, and recovery after re-enablement.

Read field note ↗
Secret Manager Rotation: Build the Notification Consumer — conceptual 3D-style vector showing Rotation schedule, SECRET_ROTATE event, Rotation worker, Dependency credential, New secret version, Consumer adoption, Completion record.ENGINEERING JOURNAL ↗
Google Cloud Operations

Secret Manager Rotation: Build the Notification Consumer

Turn Secret Manager rotation notifications into a controlled credential workflow with deduplicated requests, dependency updates, staged adoption, and completion evidence.

Read field note ↗
Cloud SQL HA: Rehearse Application Reconnection — conceptual 3D-style vector showing Application pool, Failover event, Closed sessions, Same instance address, Replacement connections, Business reconciliation.ENGINEERING JOURNAL ↗
Google Cloud Operations

Cloud SQL HA: Rehearse Application Reconnection

Test Cloud SQL high availability with a controlled failover drill that checks invalidated connections, bounded retries, transaction uncertainty, and pool recovery.

Read field note ↗
Cloud SQL IAM Login: Let the Connector Refresh Tokens — conceptual 3D-style vector showing Application identity, Cloud SQL connector, Fresh access token, IAM database user, SQL privileges, Connection pool.ENGINEERING JOURNAL ↗
Google Cloud Operations

Cloud SQL IAM Login: Let the Connector Refresh Tokens

Configure PostgreSQL IAM database login with the correct connector identity, database user, SQL grants, and pool behavior when new connections need fresh tokens.

Read field note ↗
Pub/Sub Push OIDC: Trace the Token-Minting Chain — conceptual 3D-style vector showing Push subscription, Pub/Sub service agent, Push identity, OIDC audience, Receiver authorization, Handler.ENGINEERING JOURNAL ↗
Google Cloud Operations

Pub/Sub Push OIDC: Trace the Token-Minting Chain

Authenticate Pub/Sub push delivery by checking the configured service account, Pub/Sub token-minting permissions, token audience, and receiver authorization.

Read field note ↗
Pub/Sub Exactly-Once Delivery: Verify Region and Acks — conceptual 3D-style vector showing Subscriber fleet, Regional connection, Pull subscription, Processing result, Acknowledgment result, Publish duplicates.ENGINEERING JOURNAL ↗
Google Cloud Operations

Pub/Sub Exactly-Once Delivery: Verify Region and Acks

Use Pub/Sub exactly-once delivery with the supported subscriber mode, a deliberate regional connection, and acknowledgment results the application can observe.

Read field note ↗
Pub/Sub Dead-Letter Topics: Check the Forwarding Identity — conceptual 3D-style vector showing Source subscription, Pub/Sub service agent, Publish permission, Acknowledge permission, Dead-letter topic, Investigation subscription.ENGINEERING JOURNAL ↗
Google Cloud Operations

Pub/Sub Dead-Letter Topics: Check the Forwarding Identity

Configure Pub/Sub dead-letter forwarding with the correct service agent, topic and subscription permissions, and a separate consumer for investigation.

Read field note ↗
Pub/Sub Ordering: Find the Key Holding Work Back — conceptual 3D-style vector showing Regional publisher, Ordering key, Earlier message, Slow callback, Later same-key messages, Other keys.ENGINEERING JOURNAL ↗
Google Cloud Operations

Pub/Sub Ordering: Find the Key Holding Work Back

Troubleshoot ordered Pub/Sub subscriptions by checking publisher region, ordering-key design, callback duration, and the earlier message blocking progress.

Read field note ↗
Cloud Storage Rewrites: Protect a Migration from Races — conceptual 3D-style vector showing Source generation, Migration manifest, Rewrite token, Destination precondition, Verified copy, Consumer cutover.ENGINEERING JOURNAL ↗
Google Cloud Operations

Cloud Storage Rewrites: Protect a Migration from Races

Copy Cloud Storage objects with a migration manifest, generation preconditions, resumable rewrite progress, and verified destination acceptance before cutover.

Read field note ↗
Cloud Storage Retention: Distinguish Holds Before Release — conceptual 3D-style vector showing Delete request, Protection checks, Bucket retention, Temporary hold, Event-based hold, Allowed deletion.ENGINEERING JOURNAL ↗
Google Cloud Operations

Cloud Storage Retention: Distinguish Holds Before Release

Investigate protected Cloud Storage objects by separating bucket retention, temporary holds, event-based holds, and the consequences of a locked policy.

Read field note ↗
Cloud Storage Lifecycle: Account for Soft-Deleted Data — conceptual 3D-style vector showing Lifecycle conditions, Eligible object, Holds and retention, Delete action, Soft-deleted state, Permanent cleanup.ENGINEERING JOURNAL ↗
Google Cloud Operations

Cloud Storage Lifecycle: Account for Soft-Deleted Data

Explain why a Cloud Storage lifecycle delete can leave retained storage, then check object versioning, holds, soft delete, and storage-class charges.

Read field note ↗