> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Summary Understanding compute Persistant disk and firewall

> Overview of Google Cloud compute resources including Compute Engine VMs, persistent disks, VPC firewall rules, managed compute options, practical commands, and security and sizing best practices

Welcome back. This lesson summarizes the key concepts from the Compute section you need for practical use and certification. Read the short explanations below for each primary resource and use the quick commands and tables to reference typical operations.

* Compute Engine (VMs)
* Persistent Disk
* VPC Firewall Rules
* Other compute options (Cloud Run, Cloud Functions, GKE)

## Compute Engine (VM)

Compute Engine provides virtual machines (VMs) for running applications and services that require full OS control. Use Compute Engine for long-running servers, lift-and-shift migrations, custom OS requirements, and workloads needing specialized hardware (CPUs, large memory, GPUs).

Key points:

* Machine types: pick the right family for your workload — general-purpose, memory-optimized, compute-optimized, and GPU-optimized are common choices.
* Operating systems: use public OS images, marketplace images, or import/create custom images.
* Billing: Compute Engine charges per second, which reduces costs for short-lived instances.
* Use cases: persistent services, stateful applications, and workloads requiring direct VM access.

Machine type examples:

| Family | Best for | Example |
| - | - | - |
| General-purpose | Balanced CPU/memory for most workloads | `n1-standard-4`, `e2-medium` |
| Compute-optimized | CPU-bound workloads, high single-thread performance | `c2-standard-4` |
| Memory-optimized | In-memory databases, caches, analytics | `m1-megamem-96` |
| Accelerator/GPU | ML training, video processing | GPUs attached to `a2` or `p` series |

## Persistent Disk

Persistent disks provide durable block storage for Compute Engine instances. They persist independently of the VM lifecycle and can be used as boot disks or additional data disks.

Key points:

* Disk roles: boot disks and additional data disks.
* Disk types: choose standard HDD, SSD, or balanced options based on performance and cost.
* Attach/detach: disks can be moved between instances and remain available after instance deletion.
* Resize: you can enlarge a disk; after changing the block device size you typically grow the filesystem inside the VM.
* Snapshots: create point-in-time backups and use snapshots to create new disks.

Disk type comparison:

| Disk type | Performance profile | Use case |
| - | - | - |
| Standard HDD | Cost-effective, lower IOPS and throughput | Cold storage, infrequent access |
| SSD (pd-ssd) | High IOPS, low latency | Databases, high-performance workloads |
| Balanced (pd-balanced) | Midpoint between HDD and SSD | General-purpose production workloads |

When you resize a persistent disk, the block device is expanded immediately, but you normally must run a filesystem resize inside the VM (for example, `sudo resize2fs /dev/sdX` for ext4 or `sudo xfs_growfs /mountpoint` for XFS) to make the extra space available to the operating system.

Useful gcloud examples:

* Resize a persistent disk:

```bash theme={null}
gcloud compute disks resize DISK_NAME --size=NEW_SIZE_GB --zone=ZONE
```

* Create a snapshot:

```bash theme={null}
gcloud compute disks snapshot DISK_NAME --snapshot-names=SNAPSHOT_NAME --zone=ZONE
```

* Create a new disk from a snapshot:

```bash theme={null}
gcloud compute disks create NEW_DISK_NAME --source-snapshot=SNAPSHOT_NAME --zone=ZONE
```

## VPC Firewall Rules

VPC firewall rules control ingress and egress traffic to and from VM instances in a VPC network. Firewalls operate at the network level and use targets such as instance tags or service accounts.

Key points:

* Scope: rules are defined per VPC network and can Allow or Deny traffic.
* Targets: choose to target instances via network tags, service accounts, or all instances on the network.
* Stateful behavior: return traffic for an allowed connection is automatically permitted.
* Typical ports: open SSH (`tcp:22`) for management, and application ports such as `tcp:80` and `tcp:443` as needed.
* Priority: lower numeric priority values are evaluated first. If multiple rules match, the one with the highest precedence (lowest number) takes effect.

For secure access, restrict SSH to specific source IP ranges or use Identity-Aware Proxy (IAP) to avoid exposing management ports to the public internet whenever possible: [https://cloud.google.com/iap](https://cloud.google.com/iap)

Firewall rule example:

```bash theme={null}
gcloud compute firewall-rules create allow-ssh-from-office \
  --direction=INGRESS \
  --priority=1000 \
  --network=default \
  --action=ALLOW \
  --rules=tcp:22 \
  --source-ranges=203.0.113.0/24
```

## Other Compute Options (brief)

Consider managed or serverless compute platforms when they better match your architecture or operational model.

| Service | Model | Best for |
| - | - | - |
| Compute Engine | VM-based | Full OS control, stateful workloads |
| Cloud Run | Serverless containers | Stateless containerized web services, autoscaling |
| Cloud Functions | Event-driven FaaS | Lightweight event handlers, microtasks |
| GKE (Google Kubernetes Engine) | Managed Kubernetes | Container orchestration, complex deployments, microservices |

Choose based on trade-offs: operational overhead, scaling model, and stateful vs. stateless requirements.

## Practical tips and best practices

* Right-size VMs: pick machine types and disk sizes that match workload requirements to avoid overprovisioning and excess cost.
* Use snapshots and automated backups for persistent disks, and test restorations.
* Restrict management ports (SSH/RDP) to known IPs or use IAP and bastion hosts for improved security.
* Monitor disk IOPS and latency; choose SSD or balanced disks for I/O-sensitive apps.
* Prefer managed services (Cloud Run, Functions, or GKE) for faster deployments and reduced operational burden when appropriate.

## Useful references

* [Compute Engine documentation](https://cloud.google.com/compute/docs)
* [Persistent Disks](https://cloud.google.com/compute/docs/disks)
* [VPC firewall rules](https://cloud.google.com/vpc/docs/firewalls)
* [Cloud Run](https://cloud.google.com/run), [Cloud Functions](https://cloud.google.com/functions), [GKE](https://cloud.google.com/kubernetes-engine)

That’s it for this lesson — see you in the next one.

> **[Watch Video](https://learn.kodekloud.com/user/courses/gcp-cloud-digital-leader-certification/module/015fc866-5579-442a-80f8-f4e795b70c33/lesson/7d661e96-58a3-4b58-9d92-534b9685b44a)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.