I’m excited to share our first Cloud CISO Perspectives post of 2022. It’s already shaping up to be an eventful year for our industry and we’re only in month one. There’s a lot to recap in this post, including the U.S. government’s recent efforts to address critical security issues, like open source software security and zero trust architectures. We’ve also released new resources from our Google Cybersecurity Action Team like the Cloud Security Megatrends and the Boards of Directors whitepaper on cloud risk governance. 

Cloud Security Megatrends 

We’re often asked if the cloud is more secure than on-prem (and why) so we shared our answer in a recent blog post. At Google Cloud, security by design is our priority. We’ve long adopted zero-trust principles for our baseline security architectures and built a global network that relies on defense in depth layers to protect against configuration errors and attacks. But security is always evolving and that is why we also take advantage of the following megatrends:

1. Economy of scale: Decreasing the marginal cost of security raises the baseline level of security. 
2. Shared fate: A flywheel of increasing trust drives more transition to the cloud, which compels even higher security and even more skin-in-the-game from the cloud provider.
3. Healthy competition: The race by deep-pocketed cloud providers to create and implement leading security technologies is the tip of the spear of innovation. 
4. Cloud as the digital immune system: Every security update the cloud gives the customer is informed by some threat, vulnerability, or new attack technique often identified by someone else’s experience. Enterprise IT leaders use this accelerating feedback loop to get better protection.
5. Software-defined infrastructure: Cloud is software defined, so it can be dynamically configured without customers having to manage hardware placement or cope with administrative toil. From a security standpoint, that means specifying security policies as code, and continuously monitoring their effectiveness.
6. Increasing deployment velocity: Because of cloud’s vast scale, providers have had to automate software deployments and updates, usually with automated continuous integration/continuous deployment (CI/CD) systems. That same automation delivers security enhancements, resulting in more frequent security updates.
7. Simplicity: Cloud becomes an abstraction-generating machine for identifying, creating and deploying simpler default modes of operating securely and autonomically. 
8. Sovereignty meets sustainability: The cloud’s global scale and ability to operate in localized and distributed ways creates three pillars of sovereignty. This global scale can also be leveraged to improve energy efficiency.

If you’re an IT decision maker, pay attention to these megatrends that will continue to drive and reinforce cloud security and will outpace the security of on-prem infrastructure well into the future. 

U.S. Federal government cybersecurity momentum 

• Open source software security: Earlier this month, Google participated in the White House Summit on open source software security. The meeting came at a critical time for the industry following December’s Log4j vulnerabilities and was both a recognition of the challenge and an important first step towards addressing it. The open source software ecosystem is not homogenous, despite the fact that the industry often thinks of or treats it this way. Some of it, like Linux, is highly curated, while other critical software is supported through diffuse communities including technology companies and other stakeholders. There is also a long tail of many other critical projects driven by a dedicated community of maintainers around the world, including Googlers. In light of this reality, we welcomed the chance to share our recommendations to advance the future of open source software security. Some work we’ve done includes founding the Open Source Security Foundation, which has been instrumental already in making security improvements. We’ve also helped drive a number of key security initiatives within the open source community including security scorecards, the SLSA framework to improve the security and integrity of open source packages, and Secure Open Source Rewards to financially incentivize improvements to critical open source security projects.  
• OMB’s Federal zero trust strategy: The publication of the Office of Management and Budget’s zero trust architecture strategy marks an important step for the U.S. federal government’s efforts to modernize under Executive Order 14028. Google Cloud supports this approach, which recognizes the immense security benefits offered by modern computing architectures. For the past decade, Google has successfully applied zero trust principles through our BeyondCorp and BeyondProd frameworks for providing end-user access and securing our cloud workloads. And we’ve brought these best practices from our own journey to global governments and businesses of any size through solutions like BeyondCorp Enterprise and capabilities like Binary Authorization and Anthos Service Mesh, which are embedded in Anthos, our managed application platform. For Federal agencies embarking on this zero trust journey, the Google Cybersecurity Action Team will offer our expertise by conducting Zero Trust Foundations strategy workshops, which can help organizations in the public and private sectors develop actionable and achievable strategies and plans for zero trust implementation. 

Google Cybersecurity Action Team Highlights 

Here are the latest updates, products, services and resources across our security teams this month: 

Security

• Democratizing security operations: We recently announced that Siemplify, a leading security orchestration, automation and response (SOAR) provider, is joining Google Cloud to help companies better manage their threat response. Providing a proven SOAR capability with Chronicle’s approach to security analytics is an important step forward in our vision to advance invisible security and democratize security operations for every organization.
• Security by design: The Highmark Health security team is using “secure-by-design” techniques to address the security, privacy, and compliance aspects of its Living Health solution with Google Cloud’s Professional Services Organization (PSO). Google has long advocated for and followed security by design principles, which is why we’re continuously building enhanced security, controls, resiliency and more into our cloud products and services. 
• Secure collaboration for hybrid work environments: The Google Workspace team shared its recommendations for businesses as they prepare for the future of work,  where the hybrid/flexible work model is becoming standard practice and a new approach to security is essential.
• Anthos Policy Controller CIS Benchmark enforcement: A big part of our shared fate philosophy is to build secure products and not just security products. A recent example of this in action is embedding CIS benchmark policy conformance in the Anthos Policy Controller. We believe the more we embed approaches like this into our products, the more application and infrastructure teams can intrinsically embed security at the start and reduce toil for the security team.
• DevOps for technology-driven organizations and startups: A key success factor for many security programs is the partnership and integration with development teams, and there are some great resources and lessons in our DORA research.
• Security by design with Chrome OS: ABN AMRO’s Asia-Pacific region team recently shared how they are using Chrome OS and CloudReady to work securely in the cloud, reduce total cost of ownership, and add flexibility for employees. This is a great example of secure by design principles in the use of Chromium.

Risk & Compliance

• Boards of Directors summary guide to cloud risk governance: The latest whitepaper from the Google Cybersecurity Action Team outlines how boards of directors can prioritize safe, secure, and compliant adoption processes for cloud technologies within their organizations.  
• TruSight Risk Assessment of Google Cloud: TruSight recently released a comprehensive
  risk assessment report on Google Cloud. Our Enterprise Trust team collaborated on this robust assessment of Google Cloud services to validate the design and implementation of controls. TruSight’s risk assessment of our security controls will help customers accelerate and complete their risk management due diligence.
• Data governance: Check out this new blog series on data governance where our teams explain the role of data governance, its importance, and the necessary processes to run an effective data governance program. Implementing data governance will help maximize value derived from business data, build user trust, and ensure compliance with required security measures.

Controls and Products

• Encrypting Data Fusion: To help meet the security, privacy and compliance requirements of customers in regulated industries like finance or public sector, we announced the general availability of Customer Managed Encryption Keys (CMEK) integration for Cloud Data Fusion, which enables encryption of both user data and metadata at rest with a key that customers can control through our Cloud Key Management Service (KMS). 

Don’t forget to sign-up for our newsletter if you’d like to have our Cloud CISO Perspectives post delivered every month to your inbox. We’ll be back next month with more updates and security-related news.

The ability to quickly introduce and evolve payment options for products or services is essential for businesses, as nearly 50% of consumers who can’t use a preferred payment method abandon their purchase. At the same time, gift cards, branded credit cards and rewards programs are critical tools that companies rely on to build more loyal and lasting customer relationships. With Highnote, companies have an all-in-one embedded platform to quickly create payment cards and wallets, offer innovative rewards programs and credit, and provide sustainable wage access. It is the first platform that allows enterprises to make card issuance an embedded capability of their product without creating an entirely new (and costly) organization.

Creating an exciting fintech future with Google Cloud

When thinking about building the industry’s first end-to-end embedded finance platform, we quickly realized Highnote would only be successful if it enabled companies to truly innovate and quickly roll out new programs. To do so, the platform would have to be built on scalable infrastructure capable of securely delivering services with speed and reliability while offering easy access to actionable Big Data analytics.

Working closely with the team at the Google for Startups Cloud Program, we successfully implemented Google Cloud as a versatile, future-proof foundation of our platform—and built Highnote from the ground up in just one year. Highnote’s GraphQL-based API platform reinvents the card issuance process. Utilizing the developer-friendly Highnote platform, product and engineering teams at digital enterprises of all sizes can easily and efficiently embed virtual and physical payment cards (commercial and consumer prepaid, debit, credit, and charge), ledger, and wallet capabilities into their existing products. This creates compelling value while growing revenue and building a unique and differentiated brand.

We leverage Cloud Spanner, BigQuery, and Google Kubernetes Engine (GKE) to create a unified and highly secure PCI DSS-compliant platform with GraphQL APIs that provide rapid and flexible money transfers. This gives us a reliable platform to deliver and test customer experiences, respond to outcomes, and make better business decisions. Powered by Google Cloud, our data models and application domains are architected to support configurations and customizations that unlock a diverse set of new use cases across industries, including retail, travel, logistics, healthcare, and sustainable wage access programs.

We are especially proud to highlight our enablement of sustainable wage access, as this program helps the 50% of Americans living paycheck to paycheck. Embedding this program within payroll systems provides a viable alternative to payday lenders who often charge exorbitant fees and interest rates. In real world terms, this means Highnote helps people access earned wages before payday at no cost.

The other customer we just went live with was Tillful, and their Tillful card helps small businesses build their business credit. This program will help new and emerging businesses as well as underrepresented owners of small businesses by making the credit ecosystem accessible. Highnote’s platform is designed to support multiple use cases across many industries. For example, we also help the trucking and logistics companies to develop fleet and fuel cards, and spend management companies who are looking to uplevel offerings.

Delivering high-performance transactions with Cloud Spanner

Building one of the world’s most modern card platforms would not have been possible without Cloud Spanner. We needed a solution that would keep our massive petabyte databases from buckling and more securely deliver data anywhere in the U.S. Cloud Spanner does all this and more, as it routinely connects purchases from millions of customers to tens of thousands of vendors. We also wanted to reduce overhead by 80% by eliminating manual sharding, partitioning, and optimization of data. These processes are automatic with Cloud Spanner so we can operate at maximum efficiency.

We specifically selected Cloud Spanner as our distributed SQL database management and storage solution because of its outstanding availability, zero plan maintenance downtime, security certifications, and the highest consistency guarantees of any scale-out database. We continue to optimally scale without any downtime or compromises to the integrity or security of our data. This is key for us because we can address unexpected spikes, long-term growth, and new services without costly rearchitecting.

Highnote is designed to perform over billions of transactions on Cloud Spanner, and the average latency of less than 250 ms is a testament to the robustness of Google Cloud services.

Enabling actionable customer insights at scale

BigQuery is another key Google Cloud solution that we rely on to deliver deep insights and visibility for our customers on a highly secure and scalable platform. When building Highnote, we knew we needed a cost-effective solution that excelled at data analytics. This is particularly critical for accurately measuring the performance—whether profitability or efficacy—of any program or card.

Using BigQuery, we successfully run analytics at scale with as much as a 34% lower three-year TCO than cloud data warehouse alternatives. Over the past year, BigQuery has enabled our customers to unlock data-rich capabilities with a ledger that tracks money in real time and serves up complete debit and credit entries for every event across their accounts. Companies also access real time balances for revenue, fees, customer accounts, and available funds management without complicated spreadsheets.

To quickly and efficiently roll out Highnote to our customers, we needed a simple way to automatically deploy, scale, and manage Kubernetes. When selecting a Kubernetes management tool, our top priorities were rapidly spinning up and securely scaling across multiple sites. As part of Google Cloud’s expansive ecosystem, Google Kubernetes Engine (GKE) was the top choice due to seamless and automatic Kubernetes scaling and management.

We quickly got off the ground with single-click clusters and scaled up by using the high-availability control plane—including multi-zonal and regional clusters—to easily accommodate multiple active-active regions (which other solutions cannot do). As an embedded finance platform, stringent security protocols were obviously a key consideration for us. GKE is secure by default and runs routine vulnerability scans of container images and data encryption. Further security assistance was provided by Google Cloud partners 66degrees and DoiT International to help us rapidly validate VPC PCI compliance and ensure the uninterrupted performance of thousands of transactions per second.

Winning in fintech with Google for Startups

Building the industry’s first end-to-end embedded finance platform would have been extremely challenging without the extensive Google Cloud support. By working closely with our Startups team and Google partners, we had access to Google Cloud services to more easily validate VPC PCI compliance and address most issues before we exited stealth. Their responsiveness is incredible and stands out compared to support services we’ve seen from other technology providers.

Our participation in the Google for Startups Cloud program has been instrumental to our success. With Google Cloud, we are making embedded payments accessible to our customers without a big budget price tag. By doing so, we help unleash the creativity of emerging enterprises by enabling them to innovate with payment services and rewards programs to reach new markets and customers. If companies can dream, we can enable them to realize it on Highnote. Our platform really is that flexible. We’re excited where we can go and grow with Google Cloud.

If you want to learn more about how Google Cloud can help your startup, visit our page here to get more information about our program, and sign up for our communications to get a look at our community activities, digital events, special offers, and more.

Google Cloud and Synopsys Inc are partnering to help semiconductor companies drive Electronic Design Automation (EDA) innovation in the cloud to accelerate time to market, and lower costs across the entire semiconductor product life cycle. Synopsys is the industry’s largest provider of EDA technology used in the design and verification of integrated circuits, or semiconductor chips. Bringing Synopsys technology onto Google Cloud enables customers to benefit from scalable cloud bursting and complementary licensing models to help them quickly deploy and scale Synopsys’ EDA tools. Semiconductor companies can significantly accelerate chip design and production, increase designer productivity, and empower innovation in power-performance-area optimization.

Google Cloud Platform has enabled high performance computing workloads, such as those used by today’s semiconductor chip designers, to deliver exceptionally fast results and reduce prototyping from years to months. Google Cloud’s HPC services have delivered highly scalable solutions across multiple industries – from scientific research to autonomous vehicle testing and simulation.

EDA software is a large consumer of high performance computing capacity in the cloud. With the release of Synopsys Cloud bring-your-own-cloud (BYOC) solution on Google Cloud, chip designers can now scale their Google Cloud infrastructure with Synopsys’s leading EDA tools under the flexible FlexEDA pay-per-use model and access unlimited EDA software license availability on-demand by the hour or minute.

The Synopsys Cloud BYOC deployment architecture on Google Cloud is enabled through their unique cloud metering service which uses Google Cloud regional MIGs (Managed Instance Groups) for autoscaling and multi-zone deployment. This enables the service to scale up to meet customer workload demands and scale down to optimize costs. Secrets used by Synopsys Cloud are securely stored in Google Secret Manager and usage data is encrypted using Google Cloud key management, providing customers with a highly secure design environment.

Synopsys Cloud also leverages Google Cloud’s Ops Agent and Operations Suite Dashboards are used to show metric data, alerting policies, and log entries, providing customers with detailed analytics visibility to make better chip design project lifecycle management decisions. The Synopsys Cloud BYOC solution has been validated with EDA workloads scaling out to thousands of cores on Google Cloud, using Google Filestore network file storage during validation to provide the highest throughput performance.

Vikram Bhatia, Head, Synopsys Cloud Product Management, Synopsys said, “With the release of Synopsys Cloud BYOC solution on Google Cloud, we are transforming the way our mutual semiconductor customers can design the chips of the future. Google Cloud has been leading the innovation wave for semiconductors in the cloud and we are excited about being an early adopter in leveraging those innovations for our unique EDA offerings on the cloud.” Customers can evaluate a full featured Synopsys Cloud BYOC environment on Google Cloud for free by signing up at: synopsys.com/cloud.

“Combined with GCP’s unique platform services for AI, security, and shared storage, the Synopsys Cloud BYOC solution creates a compelling package for semiconductor designers who will create the next generation of chips for the world’s insatiable needs” says Simon Floyd, Industry Director, Manufacturing & Transportation, Google Cloud.

Google Cloud provides everything you need, including free Google Cloud credits to get you up and running. Click here to learn more about Semiconductors on Google Cloud.

Many of the world’s leading companies run on SAP—and deploying it on Google Cloud extends the benefits of SAP even further. Migrating your current SAP S/4HANA deployment to Google Cloud—whether it resides on your company’s on-premises servers or another cloud service—provides your organization with a flexible virtualized architecture that lets you scale your environment to match your workloads, so you pay only for the compute and storage capacity you need at any given moment. Google Cloud includes built-in features, such as Compute Engine live migration and automatic restart, that minimize downtime for infrastructure maintenance. And it allows you to integrate your SAP data with multiple data sources and process it using Google Cloud technology such as BigQuery to drive data analytics.

SAP server-side architecture consists of two layers: the SAP HANA database, and the Netweaver application layer. In this blog post, we’ll look at the options and steps for moving the database layer to Google Cloud as a lift and shift or rehost, a straightforward approach that entails moving your current SAP environment unchanged onto Google Cloud.

Deploying an SAP HANA system on Google Cloud

Google Cloud offers SAP-certified virtual machines (VMs) optimized for SAP products, including SAP HANA and SAP HANA Enterprise Cloud, as well as dedicated servers for SAP HANA for environments greater than 12TB. (For a complete list of VM and hardware options, visit the Certified and Supported SAP HANA Hardware Directory.)

Before proceeding with a rehost migration to Google Cloud, your current (source) environment and Google Cloud (target) environments should meet these specifications:

Prerequisites:  

• The configuration of the Google Cloud environment (i.e., VM  resources, SSD storage capacity) should be identical to that of the source environment. If the underlying hardware is different, however, you must use Option 2 for your migration, detailed below.
• Both environments should be running the same operating system (SUSE or RHEL Linux).
• The HANA version, instance number, and system ID (SID) should be identical.

• Schema names must remain the same.
• Establishing the network connection between the on-premises environment and Google Cloud will be required in this phase to support rehost of the SAP application.you can use Cloud VPN or Dedicated Interconnect. Learn more about Dedicated Interconnect and Cloud VPN.

Note: Depending on your internet connection and bandwidth requirements, we recommend using a Dedicated Interconnect over Cloud VPN for production environments. 

We offer a number of automated processes to accelerate your cloud journey. To deploy the SAP HANA system on Google Cloud, you can use the Google Cloud Deployment manager or Terraform and Ansible scripts available on GitHub with configuration file templates to define your installation. For more details, see the Google Cloud SAP HANA Planning Guide.

Note: To deploy SAP HANA on Google Cloud machine types that are certified by SAP for production, please review the Certification for SAP HANA on Google Cloud page. 

Moving an SAP HANA Database to Google Cloud

There are two different options you can use to rehost your SAP HANA database to Google Cloud, and each has pros and cons that you should consider when deciding on your approach.

Option 1: Asynchronous replication uses SAP’s built-in replication tool to provide continuous data replication from the source system (also known as the primary system) to the destination or secondary system—in this case residing on Google Cloud. It’s best for mission-critical applications for which minimum downtime is a high priority, and for large databases. In addition, the high level of automation means that the process requires less manual intervention. Here’s where you can learn more on HANA Asynchronous Replication.

Option 2: Backup and restore relies on SAP’s backup utility to create an image of the database that is then transferred to Google Cloud, where it is restored in the new environment. Downtime for this method varies by database size, so large databases may require more downtime via this method vs. asynchronous replication. It also involves more manual tasks. However, it requires fewer resources to perform, making it an attractive option for less urgent use cases. Here’s where you can learn more on SAP HANA database Backup and restore.

How to migrate the SAP HANA database to Google Cloud using Asynchronous Replication

1. Create and configure Dedicated Interconnect or Cloud VPN between the current environment and Google Cloud.
2. Set up SAP HANA asynchronous replication. You can configure system replication using SAP HANA Cockpit, SAP HANA Studio, or hdbnsutil. See Setting Up SAP HANA System Replication in the SAP HANA Administration Guide.
3. Be sure to use the same instance number and HANA SID in the template as the primary instance.
4. Configure the Google Cloud instance as the secondary node for using HANA Asynchronous replication.
5. Perform data validation once full data replication is completed to the SAP HANA database in Google Cloud. To learn more: HANA System Replication overview.  
6. Perform an SAP HANA takeover on your standby database. This switches your active system from the current primary system onto the secondary system on Google Cloud. Once the takeover command runs, the system on Google Cloud becomes the new primary system.To learn more: HANA Takeover. 

How to migrate the SAP HANA database to Google Cloud using Backup and Restore

1. Create a full backup of your SAP HANA database in your current environment.
2. Create a new storage bucket in your Google Cloud environment. Visit Creating Storage Buckets in the Google Cloud Storage documentation. 
3. Download and install gsutil onto the source environment and run it to upload the HANA backup to the Google Cloud storage bucket. To install gsutil utility on any computer or server, visit Install gsutil in the Google Cloud Storage documentation.
   Note: You can run parallel multi thread/multi processing in gsutil to copy large files more quickly.
4. Recover the HANA database on Google Cloud using SAP’s RECOVER DATABASE statement. See RECOVER DATABASE Statement (Backup and Recovery) in the SAP HANA SQL Reference Guide for SAP HANA Platform.

Note: BackInt agent is an integrated SAP interface tool used for HANA database on Google Cloud.Backint agent for SAP HANA can be used to store and retrieve backups directly from Google Cloud Storage. It is supported and certified by SAP on Google Cloud. To learn more:  SAP HANA Backint Agent on Google Cloud. 

In summary, we recommend using Asynchronous Replication (Option 1) for mission-critical applications that require the lowest downtime window. For all other applications, we recommend Backup and Restore (Option 2), as this approach requires fewer resources. It’s also a great way to implement the backup and restore functionality on Google Cloud.

A rehost migration is the most straightforward path to getting your SAP on HANA system up and running on Google Cloud. And the sooner you migrate, the sooner you can take advantage of the many benefits Google Cloud brings to your SAP solution. For more information on the different migration options please review: SAP on Google Cloud: Migration strategies. 

Learn more about deploying SAP on Google Cloud. Technical resources can be found here.

Where should you run your workload? It depends…Choosing the right infrastructure options to run your application is critical, both for the success of your application and for the team that is managing and developing it. This post breaks down some of the most important factors that you need to consider when deciding where you should run your stuff!

What are these services?

• Compute Engine – Virtual machines. You reserve a configuration of CPU, memory, disk, and GPUs, and decide what OS and additional software to run.
• Kubernetes Engine – Managed Kubernetes clusters. Kubernetes is an open-source system for automating deployment, scaling, and management of containerized applications. You create a cluster and configure which containers to run; Kubernetes keeps them running and manages scaling, updates and connectivity.
• Cloud Run – A fully managed serverless platform that runs individual containers. You give code or a container to Cloud Run, and it hosts and auto scales as needed to respond to web and other events.
• App Engine – A fully managed serverless platform for complete web applications. App Engine handles the networking, application scaling, and database scaling. You write a web application in one of the supported languages, deploy to App Engine, and it handles scaling, updating versions, and so on. 
• Cloud Functions – Event-driven serverless functions. You write individual function code and Cloud Functions calls your function when events happen (for example, HTTP, Pub/Sub, and Cloud Storage changes, among others). 

What level of abstraction do you need?

• If you need more control over the underlying infrastructure (for example, the operating system, disk images, CPU, RAM, and disk) then it makes sense to use Compute Engine. This is a typical path for legacy application migrations and existing systems that require a specific OS. 
• Containers provide a way to virtualize an OS so that multiple workloads can run on a single OS instance. They are fast and lightweight, and they provide portability. If your applications are containerized then you have two  main options. 
  • You can use Google Kubernetes Engine, or GKE, which gives you full control over the container down to the nodes with specific OS, CPU, GPU, disk, memory, and networking. GKE also offers Autopilot, when you need the flexibility and control but have limited ops and engineering support. 
  • If, on the other hand, you are just looking to run your application in containers without having to worry about scaling the infrastructure, then Cloud Run is the best option. You can just write your application code, package it into a container, and deploy it.  
• If you just want to code up your HTTP-based application and leave the scalability and deployment of the app to Google Cloud then App Engine — a serverless, fully-managed option that is designed for hosting and running web applications — is a good option for you. 
• If your code is a function and just performs an action based on an event/trigger, then deploying it with Cloud Functions makes sense. 

What is your use case? 

• Use Compute Engine if you are migrating a legacy application with specific licensing, OS, kernel, or networking requirements. Examples: Windows-based applications, genomics processing, SAP HANA.
• Use GKE if your application needs a specific OS or network protocols beyond HTTP/s. When you use GKE, you are using Kubernetes, which makes it easy to deploy and expand into hybrid and multi-cloud environments. Anthos is a platform specifically designed for hybrid and multi-cloud deployments. It provides single-pane-of-glass visibility across all clusters from infrastructure through to application performance and topology. Example: Microservices-based applications. 
• Use Cloud Run if you just need to deploy a containerized application in a programming language of your choice with HTTP/s and websocket support. Examples: websites, APIs, data processing apps, webhooks.
• Use App Engine if you want to deploy and host a web based application (HTTP/s) in a serverless platform. Examples: web applications, mobile app backends
• Use Cloud Functions if your code is a function and just performs an action based on an event/trigger from Pub/Sub or Cloud Storage. Example: Kick off a video transcoding function as soon as a video is saved in your Cloud Storage bucket.

Need portability with open source? 

If your requirement is based on portability and open-source support take a look at GKE, Cloud Run, and Cloud Functions. They are all based on open-source frameworks that help you avoid vendor lock-in and give you the freedom to expand your infrastructure into hybrid and multi-cloud environments.  GKE clusters are powered by the Kubernetes open-source cluster management system, which provides the mechanisms through which you interact with your cluster. Cloud Run for Anthos is powered by Knative, an open-source project that supports serverless workloads on Kubernetes. Cloud Functions use an open-source FaaS (function as a service) framework to run functions across multiple environments. 

What are your team dynamics like?

If you have a small team of developers and you want their attention focused on the code, then a serverless option such as Cloud Run or App Engine is  a good choice because you won’t have to have a team managing the infrastructure, scale, and operations. If you have bigger teams, along with your own tools and processes, then Compute Engine or GKE makes more sense because it enables you to define your own process for CI/CD, security, scale, and operations. 

What type of billing model do you prefer? 

Compute Engine and GKE billing models are based on resources, which means you pay for the instances you have provisioned, independent of usage. You can also take advantage of sustained and committed use discounts. 

Cloud Run, App Engine, and Cloud Functions are billed per request, which means you pay as you go. 

Conclusion

It’s important to consider all the relevant factors that play a role in picking appropriate compute options for your application. Remember that no decision is necessarily final; you can always move from one option to another.

To explore these points in more detail, please take a look at the “Where Should I Run My Stuff?” video.

For more #GCPSketchnote, follow the GitHub repo &  thecloudgirl.dev. For similar cloud content follow us on Twitter at @pvergadia and @briandorsey