The summary.
ALMOST EVERYTHING IS SCOPED TO A PROJECT
Get the project structure wrong and unwinding it is painful. Separate projects per application and per environment.
Create projects under an organisation — one created under a personal account belongs to that person and is lost with them.
NEVER CREATE AND DISTRIBUTE SERVICE ACCOUNT KEYS
Use identities attached to the resource, or workload identity federation. A leaked long-lived key grants everything that account can do until someone notices.
AVOID BASIC ROLES, ASSIGN TO GROUPS, AT THE NARROWEST SCOPE
Owner and editor grant far more than almost any task requires.
AN API CALL FAILING WITH A PERMISSION ERROR FREQUENTLY MEANS THE API IS NOT ENABLED
Enable it on the specific project.
ALWAYS RESTRICT API KEYS
By API and by origin. An unrestricted key can be used by anyone who finds it, at your cost.
RETRY QUOTA ERRORS WITH INCREASING, RANDOMISED DELAY
And alert before a limit is reached, rather than discovering it as an outage.
SET BUDGETS AND ALERTS BEFORE BUILDING ANYTHING
Billing is consumption-based and in foreign currency.
