Google Cloud Glossary

Google Cloud Glossary

The terms that come up in migration, data platform, AI and security work, defined in plain English and linked to how we actually use them.

If something here is wrong or missing, tell us and we will fix it.

A · B · C · D · E · F · G · I · J · L · M · N · O · P · R · S · T · U · V · W

A

Apigee

Google Cloud’s API management platform. Sits in front of your APIs and handles authentication, rate limiting, quota, versioning and the developer portal, so those concerns live in one place rather than being reimplemented in every service.

API

An Application Programming Interface: the contract one piece of software exposes so another can call it. In cloud work the interesting part is usually not the API itself but who is allowed to call it and what happens when it changes.

Artifact Registry

Where your container images and language packages live on Google Cloud. Replaced Container Registry. Worth setting up properly early, because it is the thing Binary Authorization checks against before letting a workload run.

AutoML

Vertex AI’s tooling for training a model without writing the training loop. Useful for tabular prediction and image classification when the problem is standard and the data is clean. Not a substitute for a data scientist when it is not.

B

BigQuery

Google Cloud’s serverless data warehouse, and usually the centre of gravity of any data platform we build. Storage and compute are billed separately, so you can keep years of history cheaply and only pay for the queries you run. See our Data & Analytics practice.

BigQuery ML

Training and running models in SQL, inside BigQuery, against data that is already there. Handles forecasting (ARIMA_PLUS), classification and boosted trees. The value is not the algorithms, it is not having to move the data to use them.

BigLake

Lets BigQuery query data sitting in Cloud Storage or another cloud as if it were a native table, with one set of access controls across both. The usual reason to reach for it is a lake you cannot migrate yet.

Binary Authorization

A deploy-time gate: only container images that have been signed by the right party can run on GKE or Cloud Run. The control that stops an unreviewed image reaching production.

C

Cloud Armor

Google Cloud’s WAF and DDoS protection, applied at the load balancer. Handles the volumetric attacks and the common injection patterns before traffic reaches your application.

Cloud Build

Managed CI/CD. Builds containers, runs tests, and deploys. Often paired with Terraform so infrastructure and application changes go through the same pipeline.

Cloud Composer

Managed Apache Airflow. Where we put pipelines with real dependencies: a DAG that waits on three source systems, backfills a date range, and reruns one failed task without redoing the other forty. See ELT and ETL.

Cloud Run

Serverless containers. You hand it an image, it scales from zero to thousands of instances and back, and you pay for the time it is actually serving. Our default for stateless workloads. See Infrastructure.

Cloud SQL

Managed PostgreSQL, MySQL and SQL Server. The path of least resistance when migrating an existing relational database that does not need to scale horizontally.

Cloud Storage

Object storage. Buckets, not filesystems. Storage classes let you move older objects to colder tiers automatically, which is usually the easiest cost saving available on a migrated estate.

CMEK

Customer-Managed Encryption Keys. Google holds the ciphertext, you hold the key material in Cloud KMS and can revoke it. The difference between data being encrypted and you being able to prove who can decrypt it. Standard on regulated work, see Financial Services and Healthcare.

Compute Engine

Virtual machines. Still the right answer for workloads that cannot be containerised, licensed software, and anything that needs a GPU for a long stretch.

D

Dataflow

Managed Apache Beam, for streaming and batch pipelines in one programming model. Where we build sub-second work like fraud scoring or real-time inventory, because the same code handles the backfill. See ELT and ETL.

Dataform

SQL transformation and modelling inside BigQuery, with version control, dependency graphs and tests. Google’s managed equivalent of dbt.

Dataplex

Data governance across your lakes and warehouses: cataloguing, lineage, quality rules and profiling. The thing that catches a column quietly going null before finance notices.

Dataproc

Managed Spark and Hadoop. Mostly relevant when migrating an existing Spark estate you are not ready to rewrite.

Datastream

Change data capture from Oracle, MySQL, PostgreSQL and SQL Server into BigQuery, with a few minutes of lag and no pipeline code to maintain. For a lot of “we need fresher data” requests, this is the whole answer.

Document AI

Extracts structured fields from unstructured documents: invoices, forms, contracts, clinical notes. Pairs with a human review step rather than replacing one.

E

ELT and ETL

Two orderings of the same job. ETL transforms data before loading it; ELT loads the raw data first and transforms it inside the warehouse. We build ELT by default, because keeping the raw record means you can rebuild history when a business rule changes. Full explanation on our ELT and ETL page.

Eventarc

Routes events between Google Cloud services. The glue that lets a file landing in a bucket trigger a Cloud Run service without either knowing about the other.

F

Firebase

Google’s app development platform: Firestore, authentication, hosting, push notifications and analytics. How we get a mobile MVP in front of users quickly. See App Development.

Firestore

A serverless document database with offline sync built in, which is why it suits mobile and field applications where the device is not always connected.

FinOps

The practice of treating cloud spend as an engineering concern rather than a finance one: attribution, forecasting, and making the team that creates the cost the team that sees it. Underpins our AWS and Snowflake cost guarantees.

G

Gemini

Google’s family of multimodal models, reasoning over text, images, audio and video. Available through Vertex AI with enterprise data residency and no training on your inputs.

Gemini Enterprise

Gemini applied to a company’s own corpus: conversational customer experience and enterprise search grounded against BigQuery, Looker and Workspace rather than the open web. See Gemini Enterprise for CX.

GKE

Google Kubernetes Engine. Managed Kubernetes, for workloads that genuinely need orchestration: stateful services, complex networking, or a platform team that already runs Kubernetes. If you do not need that, Cloud Run is less to operate.

Google SecOps

Google’s SIEM and SOAR platform, formerly Chronicle. Getting logs in is easy; getting them parsed, normalised and actually detecting something is the work. See Google SecOps implementation.

Google Workspace

Gmail, Drive, Docs and the admin console behind them. Usually where the data actually lives, which is why a Workspace security review often finds more exposure than a cloud review does.

I

IAM

Identity and Access Management: who can do what to which resource. The single largest source of findings in every security review we run, usually because permissions accumulate and nobody has authority to take them away.

Identity-Aware Proxy

Puts an authentication and authorisation check in front of an application, so access depends on who the user is rather than what network they are on. The practical starting point for zero trust.

Infrastructure as Code

Defining infrastructure in files that are reviewed, versioned and applied by a pipeline, rather than clicked into a console. Makes the environment reproducible and turns “is this control switched on” into a question you answer with a diff. See Cloud Foundations.

J

JSON

The text format most APIs exchange data in. In BigQuery it is also a column type, which is handy for semi-structured payloads you do not want to flatten up front.

L

Landing Zone

The baseline Google Cloud environment everything else is built on: organisation hierarchy, projects, networking, identity, logging and guardrails. Getting it right early is cheap; retrofitting it later is not. See Cloud Foundations.

Looker

Google Cloud’s BI platform. Its distinguishing feature is LookML, a modelling layer that defines each metric once so two dashboards cannot quietly disagree. See our Looker practice.

LookML

The modelling language behind Looker. Where a metric like “active customer” is defined once, version controlled, and reused everywhere instead of being rewritten per dashboard.

M

MCP

Model Context Protocol. An open standard for exposing tools and data to AI agents, so an agent can call your catalogue or your ticketing system through a documented interface rather than a bespoke integration. Increasingly how agent fleets are wired up.

Memorystore

Managed Redis and Memcached. Caching and session state, mostly.

N

NLP

Natural Language Processing. Extracting meaning from text: entities, sentiment, classification. Worth separating from generative AI, since a lot of language problems are better solved by a small classifier than a large model.

O

Organization Policy

Constraints applied across an organisation or folder that individual projects cannot override. How you stop a resource being created in the wrong region, or a bucket being made public, regardless of who holds the permission.

P

Private Service Connect

Lets you reach Google or third-party services over private addressing instead of the public internet. Often the control that makes a security architecture acceptable to a regulator.

Pub/Sub

Managed messaging. Publishers write, subscribers read, and the two scale independently. The backbone of most real-time work we build, including streaming inventory and fraud pipelines.

R

RAG

Retrieval-Augmented Generation. Fetching relevant documents and passing them to a model at query time, so answers are grounded in your content rather than the model’s memory. Almost always the right first architecture for enterprise AI search.

S

Secret Manager

Where credentials and API keys belong, rather than in environment variables or a repository. Versioned, access controlled and audited.

Service Account

A non-human identity that a workload runs as. Service account sprawl, and keys that were issued years ago and never rotated, are a standing finding in security reviews.

SLO and SLI

A Service Level Indicator is what you measure; a Service Level Objective is the target you hold it to. Together they turn reliability from opinion into a number, and they decide when a team stops shipping features and fixes the platform. See Site Reliability Engineering.

Spanner

A relational database that scales horizontally while keeping strong consistency. Expensive, and worth it when the alternative is sharding an application by hand.

T

Terraform

The infrastructure-as-code tool we build landing zones in. Everything we deliver is Terraform you own, so the environment can be rebuilt without us.

U

UX

User Experience. In platform work it usually means the developer experience: how long it takes a new engineer to ship a change safely, which is a better predictor of delivery speed than any architecture diagram.

V

Vertex AI

Google Cloud’s machine learning platform: training, tuning, deployment, evaluation and the model garden, including Gemini. Where production AI runs, with data staying inside the region you nominate. See AI & Machine Learning.

VPC

Virtual Private Cloud, the software-defined network your resources sit in. Subnets, routes, firewall rules and peering.

VPC Service Controls

A perimeter around Google Cloud services that data cannot be copied out of, even by someone holding valid credentials. The control that separates “encrypted” from “cannot be exfiltrated”, and a standard part of regulated builds.

W

Wiz

A cloud security posture platform. It shows you everything, which is both the point and the problem: the work is tuning it until the noise drops and then clearing the toxic combinations. We are an Elite Wiz Partner. See Wiz deployment and remediation.

Workload Identity Federation

Lets a workload outside Google Cloud assume a Google identity without a long-lived service account key. The standard way to remove the last static credentials from a CI pipeline.