---
name: "Google Cloud"
description: Manage Google Cloud (Cloud Run, Storage, BigQuery, IAM, logs) and Drive files through the official `gcloud` CLI.
version: 1
situations: google cloud, gcp, cloud run, bigquery, gcs, drive
requires-secrets:
requires-packages:
requires-connector: google-cloud
---

# Google Cloud (`gcloud`)

Runs through Google's official CLI in your **bash** tool. The operator connected the account from 00's
skill store, with Drive file access included in the grant.

**Scope note:** this is Google *Cloud*, plus Drive files. Gmail, Docs, Sheets, and Calendar are not
part of what `gcloud` can reach — say so plainly if asked, rather than improvising.

## First, know who and where you are

```
gcloud auth list
gcloud config list
gcloud projects list
```

Almost every command is project-scoped. If the active project isn't the one the operator means, pass
`--project PROJECT_ID` explicitly rather than switching the machine-wide default out from under them.

## Read

```
gcloud run services list --project P
gcloud run services describe SERVICE --region REGION --project P
gcloud logging read 'resource.type="cloud_run_revision" severity>=ERROR' --limit 50 --project P --format json
gcloud storage ls gs://BUCKET
gcloud storage cat gs://BUCKET/path/file.json
bq query --use_legacy_sql=false 'SELECT count(*) FROM `P.dataset.table`'
gcloud iam service-accounts list --project P
```

Add `--format json` when you intend to parse; the default format is for humans and reflows.

## Drive

```
gcloud storage ls                       # Cloud Storage, NOT Drive
```

Drive access from the connected credential is via the Drive REST API with
`gcloud auth print-access-token`. Use it in the moment and never write the token to a file:

```
curl -s -H "Authorization: Bearer $(gcloud auth print-access-token)" \
  "https://www.googleapis.com/drive/v3/files?q=name+contains+'report'&fields=files(id,name,mimeType)"
```

## Write

```
gcloud run deploy SERVICE --image IMAGE --region REGION --project P
gcloud storage cp local.txt gs://BUCKET/path/
```

Deploys and IAM changes are outward-facing. Name the project, the service, and the region, and wait
for a yes.

## Never without being asked in this turn

`gcloud projects delete`, `gcloud run services delete`, `gcloud storage rm -r`, IAM policy bindings
(`add-iam-policy-binding` grants real access to real people), and anything against a project the
operator did not name.