Home labs & practical projects

Deploy a service with a dedicated workload identity

A project to do with your own tools, with guidance on what to create and capture.

Cloud sandbox Suggested time: 2–3 hoursYour own authorised environment

What you could create

A small Google Cloud service must read one test dataset without using a developer’s personal identity or project-wide permissions.

Example evidence format

Project evidence map (example)

Deployment configuration and identity mapScope and inputs

Positive and negative access test resultsDecisions and reasoning

Evidence record (example)

Evidence	What to capture
Deployment configuration and identity map	Show the inputs, scope and decisions behind this record. The service runs without a personal credential embedded in code.
Positive and negative access test results	Include the evidence supporting your conclusion. The unrelated resource remains inaccessible.

What you'll need

Cloud sandbox

Use a separate test project, a minimal service and synthetic data. Record billing settings and the exact operation the service needs.

Project record

Keep the working files for deployment configuration and identity map and record assumptions as you go.

Current reference material

Use the linked provider resources to verify the features, access terms and version relevant to your project.

Access & cost

A cloud account may incur charges. Check current service prices and quotas before creating resources; a budget alert is not a spending cap.

Use a separate learning account or subscription and synthetic data. Keep credentials and administrative endpoints private.

Suggested milestones

1
Plan and investigate
Create a dedicated service identity and a narrowly scoped access grant.
2
Develop your approach
Deploy the service and inspect operational logs.
3
Verify and explain
Test access to the intended dataset and denial of an unrelated resource.

Evidence worth keeping

Keep clear, organised evidence of your design and any testing you carry out.

1
Deployment configuration and identity map
Show the inputs, scope and decisions behind this record. The service runs without a personal credential embedded in code.
2
Positive and negative access test results
Include the evidence supporting your conclusion. The unrelated resource remains inaccessible.

Label design proposals and observed results clearly.

Explain your work

Use these prompts to reflect on your decisions and what you learned.

Which part of your deployment configuration and identity map needed the most judgement?
What observation or assumption changed your approach?
What would you improve, and what have you not verified?

Describe this as a personal project in your portfolio.

Useful resources

Use these resources to deepen your understanding and check key details.

Official certification objectives

Review the current provider requirements and relevant subject areas.

Google Cloud Skills Boost. ACE learning path

Check relevance, platform versions and current access terms.

Explore external learning resources

Find relevant providers and check features, access requirements and costs.

A useful starting point

Use a separate test project, a minimal service and synthetic data. Record billing settings and the exact operation the service needs.

What a good result looks like

The service runs without a personal credential embedded in code.
The unrelated resource remains inaccessible.
The deployment and cleanup procedure can be followed by another operator.

Finish the project

Remove the exercise resources, including retained storage, snapshots and public IPs. Check the billing view for anything still running.

Independent home-project guidance, not an official vendor lab or a claim of complete exam coverage. Use your own tools and label the work accurately.