Skip to main content
Hello and welcome back. In this walkthrough we’ll provision a simple, production-like infrastructure stack in Google Cloud using only the gcloud CLI from Cloud Shell. The steps cover service account creation and IAM bindings, networking (VPC, subnet, firewall), and launching a Compute Engine VM that uses the service account. All commands shown are executed in Cloud Shell — replace the sample project kodekloud-gcp-training with your target project ID where needed.
A presentation slide reading "Hands-On - Create Complete Infrastructure Stack using gcloud cli" with a large teal curved shape on the right. The word "Demo" is shown in white inside the teal shape.
We will:
  • Create a service account.
  • Grant the service account necessary IAM roles.
  • Create a VPC, a subnet, and firewall rules.
  • Launch a Compute Engine instance using the service account (no external IP).
  • Verify resources and clean them up when finished.
You don’t need to memorize every gcloud flag. Learn the command structure and reference the gcloud CLI docs: https://cloud.google.com/sdk/gcloud/reference. Use this guide as a step-by-step reference for common infra tasks.

​
Prerequisites

Activate Cloud Shell and set the intended project (replace the project ID if different):

​
Quick resource summary

​
1. Create a service account

Create a service account named demo-sa with a display name and description:
Verify the service account (CLI or Cloud Console):
Sample output:

​
2. Grant IAM roles to the service account

Grant the permissions the VM needs to manage compute resources and access storage.
  • Grant Compute Instance Admin (VM lifecycle and instance operations):
  • Grant Storage Object Viewer (read-only access to Cloud Storage objects):
Note: If your project has policy bindings with conditions, gcloud may prompt to choose a condition (e.g., choose 2 for None unless you need a specific condition).

​
3. Create a VPC network

Create a custom-mode VPC named demo-vpc with regional BGP routing:
Example creation output includes the network name and mode. Instances on the new network require firewall rules to be reachable — we’ll add those next. Verify the network:

​
4. Create a subnet

Create a regional subnet demo-subnet in us-central1 with CIDR 10.0.1.0/24 and attach it to demo-vpc:
Verify the subnet:

​
5. Create firewall rules

Allow SSH (22), HTTP (80), and HTTPS (443) ingress from anywhere to instances on demo-vpc. Create one rule per port for clarity and minimal privileges. Allow SSH:
Allow HTTP:
Allow HTTPS:
List firewall rules for the VPC:

​
6. Create a Compute Engine instance

Create a VM named demo-vm in zone us-central1-a that uses the demo-sa service account and is attached to demo-subnet without an external IP (private-only instance):
Sample output:
Verify instance details (note the zone format us-central1-a):
You can also confirm using the Compute Engine page in the GCP Console.
Cleanup is important to avoid unexpected charges. Delete resources in reverse order of creation and confirm prompts. If you plan to keep resources, consider applying labels and budgets to manage costs.

​
7. Cleanup (delete resources)

When you’re finished, remove resources in reverse creation order. Answer Y to confirmation prompts. Delete the VM:
Delete firewall rules:
Delete the subnet:
Delete the VPC:
Delete the service account:
After these deletions the resources created in this demo should be removed and no longer show in the console.

​
Closing notes

This guide demonstrated how to provision a basic infrastructure stack using only gcloud CLI commands: creating a service account, assigning IAM roles, creating a custom VPC/subnet, adding firewall rules, and launching a private Compute Engine VM using the service account. For production environments, automate and parameterize these steps using scripts or infrastructure-as-code tools such as Terraform. Further reading and references: See you next time.

Watch Video