A cloud engineer needs to deploy a secure web server workload using the Google Cloud CLI (`gcloud`). The architecture requires a dedicated custom-mode Virtual Private Cloud (VPC) network, a custom subnet in the `us-central1` region, an ingress firewall rule allowing HTTP traffic to instances with the network tag `web-server`, and a Compute Engine virtual machine instance provisioned inside the custom subnet. What is the correct sequence of operational steps to deploy this infrastructure from scratch?
- 1Execute `gcloud compute networks create` with `--subnet-mode=custom` to create the VPC network.
- 2Execute `gcloud compute networks subnets create` specifying the network name, region, and IP range.
- 3Execute `gcloud compute firewall-rules create` specifying the network, target tag `web-server`, and allowed port 80.
- 4Execute `gcloud compute instances create` specifying the custom subnet and adding `--tags=web-server`.
Answer
The correct sequence starts by creating the custom-mode VPC network, followed by creating the custom subnet in the target region, then creating the ingress firewall rule with target network tags, and finally provisioning the Compute Engine instance attached to the subnet with the matching network tag.
Google Cloud resource hierarchy and dependency constraints dictate that a parent custom VPC network must be created first (`--subnet-mode=custom`). Next, regional subnets must be defined within the network. Ingress firewall rules targeting specific network tags can then be associated with the network. Finally, Compute Engine instances are launched inside the provisioned subnet with matching network tags applied.
Step-by-Step Solution
Key Concept
Google Cloud infrastructure deployment order and resource dependencies for custom VPC networks, subnets, firewall rules, and tagged Compute Engine VMs.