A new Google Cloud account is at its most vulnerable in the first hour, before anything is running and before anyone has thought about who can log in or what it might cost. This guide covers the setup that is quick to do now and awkward to retrofit later, in the order that makes sense on Google Cloud Platform specifically.
Secure the top-level login first
Whatever the platform calls its highest-privilege identity, treat it as a break-glass credential rather than a working login. On Google Cloud the access model is Cloud IAM, organised around projects. The project is the unit of isolation, and getting the project structure right early saves a painful reorganisation later.
- Set a long, unique password and store it in a password manager.
- Turn on multi-factor authentication. This is the single highest-value action in this entire guide.
- Record the recovery details somewhere a second person can reach them.
- Create a separate working identity for daily use and leave the top-level one alone.
Compromised cloud accounts are usually mined for compute rather than data, which means the bill arrives before anyone notices the intrusion. Multi-factor authentication on the top-level identity is what stops that story from starting.
Set spending alerts before you deploy anything
Do this before the first resource exists, because afterwards you will be busy. On Google Cloud the tooling is Billing budgets and alerts, configured per billing account, with the option to alert on a percentage of a forecast rather than only on actual spend.
- Pick a monthly figure you would be unhappy to exceed.
- Alert at 50%, 80% and 100% of it.
- Send alerts to an address a person actually reads, not to the account’s own inbox.
Alerts do not stop spending. They turn a month-end shock into a Tuesday-afternoon question, which is the whole point. How cloud billing works covers what usually causes the spike.
Choose the region deliberately
The console will offer a default, and the default reflects where the provider is headquartered rather than where your users are. On Google Cloud you are choosing from a strong global footprint on Google’s own backbone; regional and multi-regional storage classes are a distinct choice that affects both cost and durability.
Decide on three things: latency to your users, any legal requirement about where data may live, and whether the services you need exist in that region. Region is one of the few cloud decisions that is genuinely painful to reverse — see cloud regions and IP location explained.
Create the first resource
On Google Cloud, Compute Engine for virtual machines, or Cloud Run if the workload is a container that can scale to zero. Two habits are worth forming immediately:
- Key-based authentication only. Add your SSH public key during creation rather than setting a password you will later have to rotate.
- Lock down the management ports. SSH and RDP should be reachable from your addresses, not from the whole internet. Automated scanners find a new public IP within minutes; that is the normal case, not the worst case.
What is particular to Google Cloud
The project boundary is stronger than the equivalent on other platforms, which makes per-project budgets and per-project iam unusually practical.
This matters more than it sounds. Most of the friction people hit on a new platform comes from carrying habits over from a different one, and the organising concepts are exactly where those habits do not transfer.
Where to go next
- Google Cloud pricing: what actually drives the bill
- Buy Google Cloud Account — the configurations currently in stock
- Your first hour with a new cloud account — the platform-agnostic version of this checklist
- Google Cloud documentation
Questions
Frequently asked
What is the first thing to do with a new Google Cloud account?
Secure the top-level login with multi-factor authentication, then set a spending alert. Both take a few minutes and both are far harder to care about once something is already running.
Where do I set spending alerts on Google Cloud?
Through Billing budgets and alerts, configured per billing account, with the option to alert on a percentage of a forecast rather than only on actual spend. Configure it before you deploy, and send the alerts to an address a person reads daily.
Can I change the region later?
Moving an existing workload between regions means moving its data, which costs both transfer fees and downtime. Choosing deliberately at the start is much cheaper than correcting it later.