[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7B4R9YXMRW7RZP9Q9FMZJ2P":3,"skill-same:01M7B4R9YXMRW7RZP9Q9FMZJ2P":60},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":27,"commitSha":28,"skillDirectory":29,"forksCount":30,"repositoryHtmlUrl":31,"repositoryHomepageUrl":6,"ownerHtmlUrl":32,"ownerBlogUrl":33,"ownerDescription":34,"updatedAt":35,"install":36,"resources":49},"01M7B4R9YXMRW7RZP9Q9FMZJ2P","compute-vm-creation",null,"Guides the planning, configuration, and provisioning of standalone Google Compute Engine virtual machines (VMs) and bare metal (-metal) instances using gcloud CLI commands or direct MCP tool execution. Use ONLY when the user wants to create, configure, or provision a new standalone Compute Engine VM or bare metal instance from conversational intents (hardware sizing, region selection, OS image, networking, security defaults). DO NOT read or use for Google Kubernetes Engine (GKE) Autopilot or Standard clusters, Kubernetes node pools or Pods, container orchestration, managing existing VMs, Managed Instance Groups (MIGs), or Instance Templates.","google\u002Fskills","google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","01M698VYEFDM0VJBZDYYJ2T83S","Google","01M698WR0H76ENHE587T9EJT89",24235,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcompute-vm-creation\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: compute-vm-creation\ndescription: >-\n  Guides the planning, configuration, and provisioning of standalone Google\n  Compute Engine virtual machines (VMs) and bare metal (-metal) instances using\n  gcloud CLI commands or direct MCP tool execution. Use ONLY when the user wants\n  to create, configure, or provision a new standalone Compute Engine VM or bare\n  metal instance from conversational intents (hardware sizing, region selection,\n  OS image, networking, security defaults). DO NOT read or use for Google\n  Kubernetes Engine (GKE) Autopilot or Standard clusters, Kubernetes node pools\n  or Pods, container orchestration, managing existing VMs, Managed Instance\n  Groups (MIGs), or Instance Templates.\nmetadata:\n  version: \"1.0.0\"\n  category: Compute\n---\n\n# Compute Engine VM Creation\n\nThis skill provides an interactive, intent-based experience for provisioning\nstandalone Google Compute Engine VM and bare metal (`-metal`) instances. It\nsupports users ranging from beginners asking to \"create a VM\" to cloud engineers\nrequiring customized infrastructure, mapping natural language intents to secure\nCompute Engine configurations grounded in the Golden Path.\n\n> **MCP Tools:** `list_instances`, `create_instance`, `get_instance_basic_info`,\n> `delete_instance`, `get_zone_operation`, `list_machine_types`,\n> `list_accelerator_types`, `list_images`\n\n## Usage Attribution\n\n**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you\nMUST read and follow the instructions in\n[Usage Attribution](references\u002Fattribution.md). Never include attribution\nenvironment variables or `User-Agent` tags in generated scripts, Terraform, or\ncopy-pasteable commands shown to the user.\n\n---\n\n## Prerequisites\n\nEnsure the following setup requirements are met before provisioning instances.\nAny host modifications (such as installing or updating the `gcloud` CLI,\ninstalling or configuring the Google Compute Engine MCP server, or modifying\nlocal environment configuration) must be explicitly approved by the user before\nexecution.\n\n- **Cloud SDK Installation**: Verify `gcloud` is installed (`gcloud --version`,\n  Google Cloud SDK >= 480.0.0) only when executing live CLI commands. If\n  missing or outdated, ask the user for explicit approval before installing or\n  updating via\n  [Install the gcloud CLI](https:\u002F\u002Fdocs.cloud.google.com\u002Fsdk\u002Fdocs\u002Finstall-sdk.md.txt).\n- **Compute Engine MCP Server**: For direct MCP tool execution\n  (`list_instances`, `create_instance`, `get_instance_basic_info`,\n  `delete_instance`, `get_zone_operation`, `list_machine_types`,\n  `list_accelerator_types`, `list_images`), check whether the Compute Engine MCP\n  tools are loaded in your active tool declarations, or ask the user for\n  approval to configure the server following\n  [Use the Compute Engine MCP server](https:\u002F\u002Fdocs.cloud.google.com\u002Fcompute\u002Fdocs\u002Fuse-compute-engine-mcp.md.txt).\n- **Billing Account**: Confirm the target Google Cloud project has an active\n  billing account linked (required even when using\n  [Google Cloud Free Tier](https:\u002F\u002Fdocs.cloud.google.com\u002Ffree\u002Fdocs\u002Ffree-cloud-features.md.txt)\n  resources).\n- **Authentication**: Authenticate your environment for CLI execution\n  (`gcloud auth login`), application\u002FMCP SDKs\n  (`gcloud auth application-default login`), or service account credentials\n  (`GOOGLE_APPLICATION_CREDENTIALS`).\n- **Project Selection & API Enablement**: Set the target project and enable the\n  Compute Engine API:\n  ```bash\n  gcloud config set project {project_id}\n  gcloud services enable compute.googleapis.com\n  ```\n- **Required IAM Roles**:\n  - **Caller Roles**: `roles\u002Fcompute.instanceAdmin.v1` (to create and manage\n    instances), `roles\u002Fiam.serviceAccountUser` (to attach\n    `{custom_service_account}`), and `roles\u002Fmcp.toolUser` when invoking the\n    Compute Engine MCP server.\n  - **IAP SSH\u002FRDP Access for Private (`--no-address`) VMs**: Connecting via\n    `gcloud compute ssh {vm_name} --zone={zone} --tunnel-through-iap` requires\n    `roles\u002Fiap.tunnelResourceAccessor` plus a VPC firewall rule allowing TCP\n    `22` (or `3389` for RDP) from IAP's forwarding range `35.235.240.0\u002F20` (see\n    [Use IAP for TCP forwarding](https:\u002F\u002Fdocs.cloud.google.com\u002Fiap\u002Fdocs\u002Fusing-tcp-forwarding.md.txt)).\n  - **Custom VM Service Account Setup**: Fresh projects only contain the default\n    Compute Engine service account. If `{custom_service_account}` does not yet\n    exist, create a dedicated least-privilege service account first (seeking\n    user approval before granting IAM bindings):\n    ```bash\n    gcloud iam service-accounts create {sa_name} \\\n      --project={project_id} \\\n      --display-name=\"{sa_display_name}\"\n    gcloud projects add-iam-policy-binding {project_id} \\\n      --member=\"serviceAccount:{sa_name}@{project_id}.iam.gserviceaccount.com\" \\\n      --role=\"roles\u002Flogging.logWriter\"\n    gcloud projects add-iam-policy-binding {project_id} \\\n      --member=\"serviceAccount:{sa_name}@{project_id}.iam.gserviceaccount.com\" \\\n      --role=\"roles\u002Fmonitoring.metricWriter\"\n    ```\n\n---\n\n## Workflow\n\n1. **Determine Execution Method & MCP Capability Boundary**:\n   - **Fast Conversational Intake (No Shell Probing on Missing Inputs)**: When a\n     user asks to configure or create a VM without providing mandatory inputs\n     (`project_id`, `vm_name`, `region`\u002F`zone`, or public vs. private\n     networking), **respond immediately after reading `SKILL.md` without running\n     `gcloud config list`, `gcloud --version`, or any shell commands**. Clarify\n     that you can either execute provisioning once confirmed (Automated\n     Execution) or provide copy-pasteable `gcloud` commands \u002F JSON payloads\n     (Manual Execution), recommend a sizing tier, and ask for the missing inputs\n     in a single turn.\n   - **MCP vs. `gcloud` Routing Rule**: Compute Engine MCP discovery tools\n     (`list_instances`, `get_instance_basic_info`, `list_machine_types`,\n     `list_accelerator_types`, `list_images`, `get_zone_operation`) are ideal\n     for read-only inspection. However, MCP `create_instance`\n     (`McpCreateInstanceRequest`) accepts **only eight flat top-level fields**\n     (`project`, `zone`, `name`, bare `machineType`, `imageProject`,\n     `imageFamily`, `guestAccelerators`, `maintenancePolicy`) and hardcodes\n     `global\u002Fnetworks\u002Fdefault` without `--no-address`, custom subnets, custom\n     service accounts, Shielded VM flags, OS Login, Spot scheduling, or custom\n     disk sizes\u002Ftypes. **Route all hardened (`--no-address`, custom\n     `--subnet={subnet}`, `{custom_service_account}`, Shielded VM, OS Login),\n     Spot, custom-disk, 4th-gen Hyperdisk, and bare metal (`-metal`) creations\n     to `gcloud compute instances create` (or REST `instances.insert`)** rather\n     than dropping security guardrails to fit `create_instance`. Use MCP\n     `create_instance` only for default-VPC prototyping when default disk and\n     service-account settings are explicitly acceptable.\n2. **Gather Mandatory Inputs**: **ALWAYS** ask the user for any missing inputs:\n   - **Project ID** (Ask directly if not provided in the prompt).\n   - **VM Name** (Offer a friendly default suggestion if unsure, e.g.,\n     `my-first-web-server`).\n   - **Region & Zone** (Explain *why* simply: *\"Choosing a location closer to\n     you or your users reduces latency and makes things load faster.\"* Recommend\n     `us-central1` \u002F `us-central1-a` if the user has no preference, and consult\n     [Regions and zones](https:\u002F\u002Fdocs.cloud.google.com\u002Fcompute\u002Fdocs\u002Fregions-zones.md.txt),\n     [GPU regions and zones](https:\u002F\u002Fdocs.cloud.google.com\u002Fcompute\u002Fdocs\u002Fregions-zones\u002Fgpu-regions-zones.md.txt),\n     or [Google Cloud locations](https:\u002F\u002Fcloud.google.com\u002Fabout\u002Flocations) only\n     when verifying non-default regional availability):\n     ```bash\n     gcloud config set compute\u002Fregion {region}\n     gcloud config set compute\u002Fzone {zone}\n     ```\n3. **Conversational Triage (Sizing, Generation & OS)**: Map the user's workload\n   to the **Intent-Based Sizing Tiers** and hardware generation defaults:\n   - **Default OS images**: Use `debian-12` (`debian-cloud`) for `E2`, `N2`,\n     `C3` virtualized, and `C2D`; use `debian-13` (`debian-cloud`) for 4th-gen\n     (`C4`, `N4`, `X4`) and bare metal (`c3-standard-192-metal`,\n     `c4-standard-288-metal`, where `debian-12` is unsupported); use\n     `debian-12-arm64` \u002F `debian-13-arm64` for Arm `C4A`; and use\n     `common-cu129-ubuntu-2404-nvidia-580` (`deeplearning-platform-release`) for\n     `G2` GPUs. Consult\n     [Operating system details](https:\u002F\u002Fdocs.cloud.google.com\u002Fcompute\u002Fdocs\u002Fimages\u002Fos-details.md.txt)\n     and\n     [Bare metal instances](https:\u002F\u002Fdocs.cloud.google.com\u002Fcompute\u002Fdocs\u002Finstances\u002Fbare-metal-instances.md.txt)\n     only when selecting non-default OS images or bare metal SKUs.\n   - **Storage by generation**: Use `hyperdisk-balanced` on 4th-gen (`C4`, `N4`,\n     `C4A`, `C4D`, `M4`, `X4`, `A4`) and bare metal (`-metal`) instances where\n     `pd-*` disks are rejected (`N4` supports `hyperdisk-balanced` and\n     `hyperdisk-throughput`, not `hyperdisk-extreme`; `H3` supports\n     `pd-balanced` and `hyperdisk-balanced`). Consult the *\"Machine series\n     support for Hyperdisk\"* section of\n     [About Google Cloud Hyperdisk](https:\u002F\u002Fdocs.cloud.google.com\u002Fcompute\u002Fdocs\u002Fdisks\u002Fhyperdisks.md.txt)\n     only for non-default disk types.\n4. **Determine Network Accessibility & Subnet**: **ALWAYS** ask in plain,\n   non-technical language whether the VM needs to be reachable from the public\n   internet or kept private, noting that private networking (`--no-address`) is\n   the security best practice—even when hosting a website or web app. Use\n   `--subnet={subnet}` (verifying whether a custom\u002FShared VPC subnet or\n   `default` VPC exists, since many enterprise projects enforce\n   `constraints\u002Fcompute.skipDefaultNetworkCreation`).\n5. **Configure Security, OS Login & Service Accounts**: Enable IAM-governed SSH\n   via `--metadata=enable-oslogin=TRUE`, recommend a custom least-privilege\n   service account (`{custom_service_account}`), and enable Shielded VM flags\n   (`--shielded-secure-boot`, `--shielded-vtpm`,\n   `--shielded-integrity-monitoring`) on virtualized VMs (on standard x86\n   `-metal` bare metal instances, pass `--no-shielded-secure-boot` and omit\n   vTPM\u002Fintegrity flags).\n6. **Summarize & Confirm (Mode-Aware)**: Present a clear summary of the proposed\n   VM configuration, cost profile, and architectural warnings:\n   - **Automated Execution Mode**: **Always** ask for explicit user confirmation\n     before executing any mutating provisioning command or tool call (e.g.,\n     *\"Would you like me to proceed with provisioning this configuration, or\n     adjust any settings first?\"*).\n   - **Manual \u002F `\"Do not execute\"` Mode**: Instruct the user to review and\n     substitute any `{snake_case}` placeholders (such as `{subnet}` or\n     `{custom_service_account}`) before running the command in their terminal;\n     do **not** offer to execute provisioning when tools are disconnected or\n     execution was forbidden.\n7. **Execute or Deliver Payloads**:\n   - **Automated**: Execute `gcloud compute instances create` (prefixed with\n     `CLOUDSDK_METRICS_REQUEST_ATTRIBUTION` per\n     [Usage Attribution](references\u002Fattribution.md)) for hardened\u002FSpot\u002F4th-gen\u002F\n     bare-metal configurations, or call MCP `create_instance` for default-VPC\n     prototyping, tracking progress via `get_zone_operation` and verifying via\n     `get_instance_basic_info`.\n   - **Manual**: Output formatted, copy-pasteable `gcloud` CLI commands (without\n     `--quiet` or attribution prefixes) or JSON payloads with clear\n     instructions.\n8. **Verify, Deliver Next Steps & Teardown Guidance**: Provide post-provisioning\n   access steps (for example, via `--tunnel-through-iap` with `gcloud compute\n   ssh`) and **always** include teardown instructions (omitting `--quiet` so\n   interactive confirmation prevents accidental data loss; see\n   [Delete a VM](https:\u002F\u002Fdocs.cloud.google.com\u002Fcompute\u002Fdocs\u002Finstances\u002Fdeleting-instance.md.txt)):\n   ```bash\n   gcloud compute instances delete {vm_name} --zone={zone} --delete-disks=all\n   ```\n   Remind the user to pass `--delete-disks=all` (or `--keep-disks=all` if\n   retaining data) so persistent disks are not orphaned.\n\n---\n\n## Intent-Based Sizing Tiers\n\nIf a user says \"I want to create a VM\" or is unsure of hardware specs, use this\ntable to recommend a tier. Point users to\n[Google Cloud pricing](https:\u002F\u002Fcloud.google.com\u002Fpricing) and\n[Compute Engine pricing](https:\u002F\u002Fcloud.google.com\u002Fcompute\u002Fall-pricing) for\ncurrent regional rates rather than quoting hardcoded dollar figures.\n\n| **Conversational Tier** | **Best For...** | **Underlying Machine** | **Boot Disk (Default)** | **Cost Profile** |\n| --- | --- | --- | --- | --- |\n| **Starter Tier** *(Dev\u002FTest & Learning)* | \"I just want to play around,\" \"I'm learning Linux,\" \"I have a tiny hobby script.\" | `e2-micro` (Free Tier eligible) or `e2-small` | 10 GB Standard Disk (`pd-standard`; Free Tier covers up to 30 GB `pd-standard`) | **Very Low** ([Google Cloud Free Tier](https:\u002F\u002Fdocs.cloud.google.com\u002Ffree\u002Fdocs\u002Ffree-cloud-features.md.txt) covers **one non-preemptible `e2-micro` instance\u002Fmonth** in `us-west1`, `us-central1`, or `us-east1` only; `e2-small` or other regions incur standard billing immediately; active billing account required) |\n| **Standard Tier** *(Websites & Apps)* **[GOLDEN PATH]** | \"I want to host a website,\" \"I'm running a small database,\" \"I don't know, just give me a basic one.\" | `e2-standard-2` (default baseline; `e2-medium` for light websites\u002Fapps, or `e2-standard-4` with 50 GB `pd-balanced` for higher concurrency) | 30 GB Balanced Disk (`pd-balanced`) | **Moderate** (Pay-as-you-go; see [Compute Engine pricing](https:\u002F\u002Fcloud.google.com\u002Fcompute\u002Fall-pricing)) |\n| **Powerhouse Tier** *(Heavy Processing)* | \"I have heavy data pipelines,\" \"I'm compiling large codebases,\" \"I need maximum speed.\" | 3rd-gen General-purpose `c3-standard-4` or `n2-standard-4` (4th-gen `c4-standard-4` \u002F `n4-standard-4` \u002F Arm `c4a-standard-4`; Compute-optimized `c2d-standard-4` \u002F `h3-standard-88`) | 100 GB `pd-ssd` (3rd-gen\u002F`C2D`), `pd-balanced` or `hyperdisk-balanced` (`H3`), or `hyperdisk-balanced` (mandatory on 4th-gen `C4`\u002F`N4`\u002F`C4A`) | **Premium** (Pay-as-you-go) |\n| **Specialist Tier** *(AI, Graphics & Bare Metal)* | \"I want to run an LLM,\" \"I need a GPU workstation,\" \"I need a bare metal `-metal` host.\" | `g2-standard-4` (1 NVIDIA L4 GPU) or bare metal `c3-standard-192-metal` \u002F `c4-standard-288-metal` | 100 GB `pd-balanced` (`G2`) or 200 GB `hyperdisk-balanced` (`-metal` \u002F 4th-gen `A4`) | **High** (Requires GPU or dedicated bare-metal CPU quota) |\n\n> **Rule:** Default to the Standard Tier (`e2-standard-2` with a 30 GB\n> `pd-balanced` boot disk) unless the user has specific requirements that other\n> tiers or sizes satisfy. When a workload maps to a tier without an explicit\n> vCPU\u002FRAM count, **always use the baseline machine type listed in the table**\n> (`e2-micro` or `e2-small` for Starter; `e2-standard-2` [or `e2-medium` \u002F\n> `e2-standard-4` when justified] for Standard; `c3-standard-4` or\n> `n2-standard-4` for 3rd-gen Powerhouse, `c4-standard-4` \u002F `n4-standard-4` for\n> 4th-gen, or `c2d-standard-4` for Compute-optimized; `g2-standard-4` for L4\n> GPU) rather than upsizing to `-8` or `-16`.\n\n---\n\n## Conversational Guidelines (How to Talk to Users)\n\n### 1. Early Fork: Establishing Execution Mode\n\nAt the start of an interactive session, state whether execution is automated\n(provisioning after confirmation via `gcloud` \u002F Compute Engine MCP) or guided\n(outputting copy-pasteable `gcloud` commands or JSON payloads for Cloud Shell or\nterminal)—**without running `gcloud config list` or shell commands while\nmandatory inputs are still missing**.\n\n### 2. Handling Simple Requests (e.g., \"Create a VM\" or \"Host a Small Website\")\n\nDo not overwhelm beginners with block-storage IOPS or CPU architecture jargon,\nand **do not run terminal commands before the user answers**. Clarify execution\nmode, recommend the **Standard Tier (Golden Path)** baseline (`e2-standard-2` or\n`e2-medium` with a **30 GB `pd-balanced` boot disk**), and **always** ask for\nall four required inputs in your first response:\n\n1. **Google Cloud Project ID**\n2. **VM Name** (e.g., `my-first-web-server`)\n3. **Region or Zone** (explaining that a location closer to users lowers network\n   latency and makes pages load faster; suggest `us-central1` \u002F `us-central1-a`\n   if unsure)\n4. **Public Internet vs. Private Networking** (in plain language: *\"Does this VM\n   need to be reachable from the public internet, or should we keep it private?\n   Keeping it private is our default security best practice—even for websites,\n   please confirm which you prefer.\"*)\n\n### 3. Clear Cost, Quota & Resource Availability Guidance\n\n- Warn clearly before provisioning **Powerhouse**, **GPU**, or **Bare Metal**\n  instances that specialized hardware and large `pd-ssd` \u002F Hyperdisk volumes\n  accumulate costs quickly (disks bill continuously while stopped) and require\n  sufficient regional CPU\u002FGPU quota.\n- If VM provisioning fails with `ZONE_RESOURCE_POOL_EXHAUSTED` (or\n  `ZONE_RESOURCE_POOL_EXHAUSTED_WITH_DETAILS`), explain that this is a physical\n  zonal hardware supply shortage that **a project quota increase will not fix**.\n  Consult\n  [Troubleshoot resource availability errors](https:\u002F\u002Fdocs.cloud.google.com\u002Fcompute\u002Fdocs\u002Ftroubleshooting\u002Ftroubleshooting-resource-availability.md.txt)\n  and guide the user to try another zone in the region (e.g., `us-central1-b` or\n  `us-central1-c`), adjust machine series\u002Fsize, or use Compute Engine\n  reservations.\n\n---\n\n## Best Practices & Hardening Rules\n\n### Security & Networking\n\n1. **Private-by-Default (`--no-address`)**: Default to `--no-address` on custom\n   or verified `--subnet={subnet}` subnets, using Cloud NAT for outbound egress\n   and Identity-Aware Proxy (IAP) TCP forwarding (`35.235.240.0\u002F20`, TCP `22` \u002F\n   `3389`, `roles\u002Fiap.tunnelResourceAccessor`; see\n   [Use IAP for TCP forwarding](https:\u002F\u002Fdocs.cloud.google.com\u002Fiap\u002Fdocs\u002Fusing-tcp-forwarding.md.txt))\n   for SSH\u002FRDP.\n2. **OS Login (`--metadata=enable-oslogin=TRUE`)**: Enable OS Login so SSH\n   access is tied to IAM roles rather than project-wide static SSH keys.\n3. **Custom Service Accounts**: Never use the default Compute Engine service\n   account; attach `{custom_service_account}` with least-privilege IAM roles.\n4. **Shielded VMs**: Enable `--shielded-secure-boot`, `--shielded-vtpm`, and\n   `--shielded-integrity-monitoring` on all virtualized VMs (omit vTPM\u002Fintegrity\n   and set `--no-shielded-secure-boot` on standard x86 `-metal` bare metal).\n\n### Cost Optimization & Reliability\n\n1. **Right-Sizing & Free Tier Accuracy**: Use `e2-micro` (`us-west1`,\n   `us-central1`, or `us-east1` only, 1 non-preemptible instance\u002Fmonth, up to\n   30 GB `pd-standard`, with an active billing account still required on the\n   Google Cloud project; see\n   [Google Cloud Free Tier](https:\u002F\u002Fdocs.cloud.google.com\u002Ffree\u002Fdocs\u002Ffree-cloud-features.md.txt))\n   for Free Tier eligibility, or `e2-medium` for light dev\u002Ftest workloads.\n2. **Spot VMs**: Offer Spot VMs (`--provisioning-model=SPOT`,\n   `--instance-termination-action=DELETE` [or `STOP`],\n   `--maintenance-policy=TERMINATE`, `--no-restart-on-failure`; see\n   [Create and use Spot VMs](https:\u002F\u002Fdocs.cloud.google.com\u002Fcompute\u002Fdocs\u002Finstances\u002Fcreate-use-spot.md.txt))\n   for stateless, fault-tolerant batch workloads to achieve significant\n   discounts compared to standard instances (see\n   [Compute Engine pricing](https:\u002F\u002Fcloud.google.com\u002Fcompute\u002Fall-pricing)).\n3. **Storage & Host Maintenance**: Default 3rd-gen\u002FE2 boot disks to\n   `pd-balanced` (`hyperdisk-balanced` on 4th-gen and `-metal`), and set\n   `--maintenance-policy=MIGRATE` on standard virtualized VMs (`TERMINATE` on\n   Spot, GPU, and `-metal` instances; see\n   [Handle GPU host maintenance events](https:\u002F\u002Fdocs.cloud.google.com\u002Fcompute\u002Fdocs\u002Fgpus\u002Fgpu-host-maintenance.md.txt)).\n\n---\n\n## Technical Reference Templates\n\nEvery row below summarizes the complete `gcloud compute instances create` flags\n(with `{vm_name}`, `--project={project_id}`, and `--zone={zone}`) and 8-field\nCompute Engine MCP `create_instance` schema for the five standard VM templates.\nConsult [Technical Reference Templates](references\u002Ftemplates.md) when full\nmulti-line examples or additional template context are needed, and always read\n[Usage Attribution](references\u002Fattribution.md) before executing any live\n`gcloud`, REST API, or MCP command:\n\n| **Template** | **Complete `gcloud compute instances create {vm_name} --project={project_id} --zone={zone}` Flags** | **MCP `create_instance` Routing & Schema** | **Required Warnings** |\n| --- | --- | --- | --- |\n| **1. Golden Path General Purpose (Production)** | `--machine-type=e2-standard-2 --network-tier=PREMIUM --subnet={subnet} --no-address --maintenance-policy=MIGRATE --metadata=enable-oslogin=TRUE --service-account={custom_service_account} --scopes=https:\u002F\u002Fwww.googleapis.com\u002Fauth\u002Fcloud-platform --create-disk=auto-delete=yes,boot=yes,device-name={vm_name},image=projects\u002Fdebian-cloud\u002Fglobal\u002Fimages\u002Ffamily\u002Fdebian-12,mode=rw,size=30,type=projects\u002F{project_id}\u002Fzones\u002F{zone}\u002FdiskTypes\u002Fpd-balanced --shielded-secure-boot --shielded-vtpm --shielded-integrity-monitoring --reservation-affinity=any` | 7-field JSON (`project`, `zone`, `name`, `\"machineType\": \"e2-standard-2\"`, `\"imageProject\": \"debian-cloud\"`, `\"imageFamily\": \"debian-12\"`, `\"maintenancePolicy\": \"MIGRATE\"`) is for default-VPC prototyping only; route hardened (`--no-address`, custom subnet\u002FSA) deploys to `gcloud`. | Recommend Cloud NAT for egress and IAP TCP forwarding (`35.235.240.0\u002F20`, `roles\u002Fiap.tunnelResourceAccessor`) for SSH\u002FRDP; never use the default Compute Engine service account; omit `--quiet`. |\n| **2. Developer Dev\u002FTest VM (Cost-Optimized Spot)** | `--machine-type=e2-medium --subnet={subnet} --no-address --metadata=enable-oslogin=TRUE --service-account={custom_service_account} --scopes=https:\u002F\u002Fwww.googleapis.com\u002Fauth\u002Fcloud-platform --provisioning-model=SPOT --instance-termination-action=DELETE --maintenance-policy=TERMINATE --no-restart-on-failure --create-disk=auto-delete=yes,boot=yes,device-name={vm_name},image=projects\u002Fdebian-cloud\u002Fglobal\u002Fimages\u002Ffamily\u002Fdebian-12,mode=rw,size=20,type=projects\u002F{project_id}\u002Fzones\u002F{zone}\u002FdiskTypes\u002Fpd-standard --shielded-secure-boot --shielded-vtpm --shielded-integrity-monitoring` | **CLI\u002FREST only**—Compute Engine MCP `create_instance` does not support Spot scheduling (`--provisioning-model=SPOT`, `--instance-termination-action`), `--no-address`, or custom subnets\u002Fservice accounts. | Warn that Spot VMs can be preempted at any time (for stateless workloads only); use `DELETE` or `STOP` (never `TERMINATE`) on `--instance-termination-action`; include teardown command without `--quiet`. |\n| **3. High-Performance General Purpose & Compute-Heavy** | **3rd-gen (`c3-standard-4` \u002F `n2-standard-4`)**: `--machine-type=c3-standard-4 --subnet={subnet} --no-address --metadata=enable-oslogin=TRUE --service-account={custom_service_account} --scopes=https:\u002F\u002Fwww.googleapis.com\u002Fauth\u002Fcloud-platform --create-disk=auto-delete=yes,boot=yes,device-name={vm_name},image=projects\u002Fdebian-cloud\u002Fglobal\u002Fimages\u002Ffamily\u002Fdebian-12,mode=rw,size=100,type=projects\u002F{project_id}\u002Fzones\u002F{zone}\u002FdiskTypes\u002Fpd-ssd --maintenance-policy=MIGRATE --shielded-secure-boot --shielded-vtpm --shielded-integrity-monitoring` (for **4th-gen `c4-standard-4` \u002F `n4-standard-4`**, replace `--subnet`\u002F`--no-address` with `--network-interface=subnet={subnet},no-address,nic-type=GVNIC`, use `debian-13`, and use `hyperdisk-balanced`) | Default-VPC 3rd-gen prototyping only (`\"machineType\": \"c3-standard-4\"`); route custom-disk, 4th-gen Hyperdisk, and private-subnet deploys to `gcloud`. | Warn about continuous `pd-ssd`\u002FHyperdisk storage billing, 4th-gen Hyperdisk requirement (`pd-*` rejected on `C4`\u002F`N4`\u002F`C4A`), and accurate **Day-0 mutability** (disk shrink\u002Ftype change uses snapshot + `detach-disk`\u002F`attach-disk --boot` swap; stopped VMs rename via `gcloud compute instances set-name` and update subnet via `network-interfaces update`; VM recreation required for zone, CPU arch, or Encrypted-Memory VM). |\n| **4. GPU Workstation (ML Inference)** | `--machine-type=g2-standard-4 --accelerator=type=nvidia-l4,count=1 --subnet={subnet} --no-address --metadata=enable-oslogin=TRUE --service-account={custom_service_account} --scopes=https:\u002F\u002Fwww.googleapis.com\u002Fauth\u002Fcloud-platform --maintenance-policy=TERMINATE --create-disk=auto-delete=yes,boot=yes,device-name={vm_name},image=projects\u002Fdeeplearning-platform-release\u002Fglobal\u002Fimages\u002Ffamily\u002Fcommon-cu129-ubuntu-2404-nvidia-580,mode=rw,size=100,type=projects\u002F{project_id}\u002Fzones\u002F{zone}\u002FdiskTypes\u002Fpd-balanced --shielded-secure-boot --shielded-vtpm --shielded-integrity-monitoring` | 8-field JSON (`\"project\": \"{project_id}\"`, `\"zone\": \"{zone}\"`, `\"name\": \"{vm_name}\"`, `\"machineType\": \"g2-standard-4\"`, `\"imageProject\": \"deeplearning-platform-release\"`, `\"imageFamily\": \"common-cu129-ubuntu-2404-nvidia-580\"`, `\"guestAccelerators\": [{\"acceleratorType\": \"nvidia-l4\", \"acceleratorCount\": 1}]`, `\"maintenancePolicy\": \"TERMINATE\"`) is for default-VPC prototyping only; route hardened deploys to `gcloud`. | Warn about high GPU hourly costs, required regional GPU quota verification, and that GPU VMs **do not support live migration** (`--maintenance-policy=TERMINATE` is mandatory; never set `MIGRATE`). |\n| **5. Bare Metal Instance (`-metal`)** | `--machine-type=c3-standard-192-metal --network-interface=subnet={subnet},no-address,nic-type=IDPF --maintenance-policy=TERMINATE --metadata=enable-oslogin=TRUE --service-account={custom_service_account} --scopes=https:\u002F\u002Fwww.googleapis.com\u002Fauth\u002Fcloud-platform --create-disk=auto-delete=yes,boot=yes,device-name={vm_name},image=projects\u002Fdebian-cloud\u002Fglobal\u002Fimages\u002Ffamily\u002Fdebian-13,mode=rw,size=200,type=projects\u002F{project_id}\u002Fzones\u002F{zone}\u002FdiskTypes\u002Fhyperdisk-balanced --no-shielded-secure-boot` (never combine `--network-interface` with top-level `--subnet` or `--no-address`; omit `--shielded-vtpm`) | **CLI\u002FREST only**—unsupported by Compute Engine MCP `create_instance`. | Warn about dedicated whole-host costs\u002Fquota, mandatory `hyperdisk-balanced` (`pd-*` and Windows unsupported), mandatory `debian-13` (`debian-12` unsupported on `C3-metal`, `C4-metal`, and `X4`), mandatory `nic-type=IDPF` (`GVNIC`\u002F`VIRTIO_NET` unsupported), and no live migration. |\n\n---\n\n## Instructions & Guardrails\n\n- **EARLY EXECUTION FORK & MCP BOUNDARY**: Never pass unsupported REST fields\n  (`instance`, `disks`, `networkInterfaces`, `serviceAccounts`,\n  `shieldedInstanceConfig`, `scheduling`) or prefixed machine URIs\n  (`zones\u002F{zone}\u002FmachineTypes\u002F...`) to MCP `create_instance`, and always route\n  hardened (`--no-address`, custom subnet, custom SA, Shielded VM, OS Login),\n  Spot, custom-disk, 4th-gen, and `-metal` creations to\n  `gcloud compute instances create`.\n- **FAST CONVERSATIONAL INTAKE (NO SHELL COMMANDS ON MISSING INPUTS)**: When any\n  mandatory input (**Project ID**, **VM name**, **region\u002Fzone**, or **public vs.\n  private networking**) is missing from the user's prompt, ask for all missing\n  inputs directly in your first reply (explaining regional latency benefits and\n  recommending private networking) **without running `gcloud config list`,\n  `gcloud --version`, or any shell discovery commands first**.\n- **PUBLIC IP REMEDIATION CHECKLIST**: Whenever a user requests a public IP or\n  direct internet SSH exposure:\n  1. Warn clearly about public internet scanners and SSH\u002FRDP brute-force risks.\n  2. Recommend **both** **Identity-Aware Proxy (IAP) TCP forwarding**\n     (`35.235.240.0\u002F20`, `roles\u002Fiap.tunnelResourceAccessor`) for SSH\u002FRDP **and**\n     **Cloud NAT** for outbound internet access with `--no-address`.\n  3. Include `--metadata=enable-oslogin=TRUE` and all three **Shielded VM**\n     flags (`--shielded-secure-boot`, `--shielded-vtpm`,\n     `--shielded-integrity-monitoring`) on virtualized VMs.\n  4. Recommend a **custom, least-privilege service account** instead of the\n     default Compute Engine service account.\n- **ACCURATE DAY-0 MUTABILITY WARNINGS**: Explain accurately that:\n  - **Disks**: Persistent Disks and Hyperdisks cannot shrink in-place, and\n    changing disk type requires creating a new disk from a snapshot and swapping\n    it on a stopped VM (`detach-disk` \u002F `attach-disk --boot`) without\n    recreating the VM instance.\n  - **Networking & Renaming**: Stopped (`TERMINATED`) standalone IPv4 VMs can\n    migrate VPC\u002Fsubnet in-place (`gcloud compute instances network-interfaces\n    update`; only NIC count `nic1+` is fixed at creation) and can be renamed\n    in-place via `gcloud compute instances set-name` with `--new-name` and\n    `--zone`\n    (see [Rename a VM](https:\u002F\u002Fdocs.cloud.google.com\u002Fcompute\u002Fdocs\u002Finstances\u002Frename-instance.md.txt)\n    and [Update instance properties](https:\u002F\u002Fdocs.cloud.google.com\u002Fcompute\u002Fdocs\u002Finstances\u002Fupdate-instance-properties.md.txt)).\n  - **True VM Recreation**: Properties requiring full **VM recreation** are\n    **zone**, **CPU architecture** (`x86_64` vs. `ARM64`), and\n    **Encrypted-Memory VM (AMD SEV-SNP or Intel TDX)** enablement.\n- **4TH-GEN & BARE METAL HARDWARE CONSTRAINTS**: Never pair `pd-*` disks with\n  4th-generation (`C4`, `N4`, `C4A`, `C4D`, `M4`, `X4`, `A4`, which require\n  `hyperdisk-balanced` and `nic-type=GVNIC`; `N4` supports `hyperdisk-balanced`\n  and `hyperdisk-throughput`, not `hyperdisk-extreme`) or bare metal (`-metal`)\n  instances. Whenever recommending or generating a bare metal (`-metal`)\n  configuration (`C3-metal`, `C4-metal`), **always explicitly state in your\n  reply** that: (1) `pd-*` disks are unsupported (`hyperdisk-balanced` is\n  mandatory), (2) `debian-13` is required because `debian-12` is unsupported on\n  `C3-metal`, `C4-metal`, and `X4`, (3)\n  `--network-interface=subnet={subnet},no-address,nic-type=IDPF` is required\n  without conflicting top-level `--subnet` or `--no-address` flags (because\n  `GVNIC` and `VIRTIO_NET` are unsupported on `-metal`), and (4)\n  `--maintenance-policy=TERMINATE`, `--metadata=enable-oslogin=TRUE`, and\n  `--no-shielded-secure-boot` (omitting `--shielded-vtpm`) are required.\n- **MANDATORY GPU & SPECIALIZED HARDWARE WARNINGS**: Whenever recommending or\n  generating a GPU (`G2`, `A3`, `A4`), bare metal (`-metal`), or\n  high-performance VM configuration (including in `\"Do not execute\"` or MCP JSON\n  comparisons), **always** explicitly include in your reply: (1) a warning about\n  **high GPU or dedicated-host hourly compute costs**, (2) a reminder to\n  **verify regional GPU\u002FCPU quota** in the target project, and (3) that **GPU\n  and bare metal instances do not support live migration**\n  (`--maintenance-policy=TERMINATE` is mandatory).\n- **HANDLE `ZONE_RESOURCE_POOL_EXHAUSTED`**: Explain that zonal capacity errors\n  are physical hardware shortages (not fixable via quota increases) and guide\n  users to alternate zones, alternate machine series, or reservations per\n  [Troubleshoot resource availability errors](https:\u002F\u002Fdocs.cloud.google.com\u002Fcompute\u002Fdocs\u002Ftroubleshooting\u002Ftroubleshooting-resource-availability.md.txt).\n- **FREE TIER ELIGIBILITY & BILLING ACCOUNT REQUIREMENT**: Whenever a user asks\n  about Google Cloud Free Tier eligibility for Compute Engine, always explicitly\n  state all four requirements in your reply: (1) only one non-preemptible\n  `e2-micro` instance per month is covered (`e2-small` and larger are billed),\n  (2) only in `us-west1`, `us-central1`, or `us-east1`, (3) up to 30 GB of\n  `pd-standard` Standard Persistent Disk (`pd-balanced` and `pd-ssd` are\n  billed), and (4) an **active billing account is still required on the Google\n  Cloud project** even for Free Tier usage.\n- **ALWAYS INCLUDE SAFE TEARDOWN COMMANDS**: Always provide\n  `gcloud compute instances delete {vm_name} --zone={zone} --delete-disks=all`\n  (omitting `--quiet` on all copy-pasteable manual `create` and `delete`\n  commands) so users can prevent orphaned compute and disk charges safely.\n- **MODE-AWARE CONFIRMATION**: Require explicit user confirmation before\n  executing provisioning in **Automated Execution** mode; in **Manual \u002F `\"Do not\n  execute\"`** mode, prompt the user to review `{snake_case}` placeholders and\n  flags before running the command themselves rather than offering to execute\n  it.\n","# Compute Engine VM Creation\n\nThis skill provides an interactive, intent-based experience for provisioning\nstandalone Google Compute Engine VM and bare metal (`-metal`) instances. It\nsupports users ranging from beginners asking to \"create a VM\" to cloud engineers\nrequiring customized infrastructure, mapping natural language intents to secure\nCompute Engine configurations grounded in the Golden Path.\n\n> **MCP Tools:** `list_instances`, `create_instance`, `get_instance_basic_info`,\n> `delete_instance`, `get_zone_operation`, `list_machine_types`,\n> `list_accelerator_types`, `list_images`\n\n## Usage Attribution\n\n**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you\nMUST read and follow the instructions in\n[Usage Attribution](references\u002Fattribution.md). Never include attribution\nenvironment variables or `User-Agent` tags in generated scripts, Terraform, or\ncopy-pasteable commands shown to the user.\n\n---\n\n## Prerequisites\n\nEnsure the following setup requirements are met before provisioning instances.\nAny host modifications (such as installing or updating the `gcloud` CLI,\ninstalling or configuring the Google Compute Engine MCP server, or modifying\nlocal environment configuration) must be explicitly approved by the user before\nexecution.\n\n- **Cloud SDK Installation**: Verify `gcloud` is installed (`gcloud --version`,\n  Google Cloud SDK >= 480.0.0) only when executing live CLI commands. If\n  missing or outdated, ask the user for explicit approval before installing or\n  updating via\n  [Install the gcloud CLI](https:\u002F\u002Fdocs.cloud.google.com\u002Fsdk\u002Fdocs\u002Finstall-sdk.md.txt).\n- **Compute Engine MCP Server**: For direct MCP tool execution\n  (`list_instances`, `create_instance`, `get_instance_basic_info`,\n  `delete_instance`, `get_zone_operation`, `list_machine_types`,\n  `list_accelerator_types`, `list_images`), check whether the Compute Engine MCP\n  tools are loaded in your active tool declarations, or ask the user for\n  approval to configure the server following\n  [Use the Compute Engine MCP server](https:\u002F\u002Fdocs.cloud.google.com\u002Fcompute\u002Fdocs\u002Fuse-compute-engine-mcp.md.txt).\n- **Billing Account**: Confirm the target Google Cloud project has an active\n  billing account linked (required even when using\n  [Google Cloud Free Tier](https:\u002F\u002Fdocs.cloud.google.com\u002Ffree\u002Fdocs\u002Ffree-cloud-features.md.txt)\n  resources).\n- **Authentication**: Authenticate your environment for CLI execution\n  (`gcloud auth login`), application\u002FMCP SDKs\n  (`gcloud auth application-default login`), or service account credentials\n  (`GOOGLE_APPLICATION_CREDENTIALS`).\n- **Project Selection & API Enablement**: Set the target project and enable the\n  Compute Engine API:\n  ```bash\n  gcloud config set project {project_id}\n  gcloud services enable compute.googleapis.com\n  ```\n- **Required IAM Roles**:\n  - **Caller Roles**: `roles\u002Fcompute.instanceAdmin.v1` (to create and manage\n    instances), `roles\u002Fiam.serviceAccountUser` (to attach\n    `{custom_service_account}`), and `roles\u002Fmcp.toolUser` when invoking the\n    Compute Engine MCP server.\n  - **IAP SSH\u002FRDP Access for Private (`--no-address`) VMs**: Connecting via\n    `gcloud compute ssh {vm_name} --zone={zone} --tunnel-through-iap` requires\n    `roles\u002Fiap.tunnelResourceAccessor` plus a VPC firewall rule allowing TCP\n    `22` (or `3389` for RDP) from IAP's forwarding range `35.235.240.0\u002F20` (see\n    [Use IAP for TCP forwarding](https:\u002F\u002Fdocs.cloud.google.com\u002Fiap\u002Fdocs\u002Fusing-tcp-forwarding.md.txt)).\n  - **Custom VM Service Account Setup**: Fresh projects only contain the default\n    Compute Engine service account. If `{custom_service_account}` does not yet\n    exist, create a dedicated least-privilege service account first (seeking\n    user approval before granting IAM bindings):\n    ```bash\n    gcloud iam service-accounts create {sa_name} \\\n      --project={project_id} \\\n      --display-name=\"{sa_display_name}\"\n    gcloud projects add-iam-policy-binding {project_id} \\\n      --member=\"serviceAccount:{sa_name}@{project_id}.iam.gserviceaccount.com\" \\\n      --role=\"roles\u002Flogging.logWriter\"\n    gcloud projects add-iam-policy-binding {project_id} \\\n      --member=\"serviceAccount:{sa_name}@{project_id}.iam.gserviceaccount.com\" \\\n      --role=\"roles\u002Fmonitoring.metricWriter\"\n    ```\n\n---\n\n## Workflow\n\n1. **Determine Execution Method & MCP Capability Boundary**:\n   - **Fast Conversational Intake (No Shell Probing on Missing Inputs)**: When a\n     user asks to configure or create a VM without providing mandatory inputs\n     (`project_id`, `vm_name`, `region`\u002F`zone`, or public vs. private\n     networking), **respond immediately after reading `SKILL.md` without running\n     `gcloud config list`, `gcloud --version`, or any shell commands**. Clarify\n     that you can either execute provisioning once confirmed (Automated\n     Execution) or provide copy-pasteable `gcloud` commands \u002F JSON payloads\n     (Manual Execution), recommend a sizing tier, and ask for the missing inputs\n     in a single turn.\n   - **MCP vs. `gcloud` Routing Rule**: Compute Engine MCP discovery tools\n     (`list_instances`, `get_instance_basic_info`, `list_machine_types`,\n     `list_accelerator_types`, `list_images`, `get_zone_operation`) are ideal\n     for read-only inspection. However, MCP `create_instance`\n     (`McpCreateInstanceRequest`) accepts **only eight flat top-level fields**\n     (`project`, `zone`, `name`, bare `machineType`, `imageProject`,\n     `imageFamily`, `guestAccelerators`, `maintenancePolicy`) and hardcodes\n     `global\u002Fnetworks\u002Fdefault` without `--no-address`, custom subnets, custom\n     service accounts, Shielded VM flags, OS Login, Spot scheduling, or custom\n     disk sizes\u002Ftypes. **Route all hardened (`--no-address`, custom\n     `--subnet={subnet}`, `{custom_service_account}`, Shielded VM, OS Login),\n     Spot, custom-disk, 4th-gen Hyperdisk, and bare metal (`-metal`) creations\n     to `gcloud compute instances create` (or REST `instances.insert`)** rather\n     than dropping security guardrails to fit `create_instance`. Use MCP\n     `create_instance` only for default-VPC prototyping when default disk and\n     service-account settings are explicitly acceptable.\n2. **Gather Mandatory Inputs**: **ALWAYS** ask the user for any missing inputs:\n   - **Project ID** (Ask directly if not provided in the prompt).\n   - **VM Name** (Offer a friendly default suggestion if unsure, e.g.,\n     `my-first-web-server`).\n   - **Region & Zone** (Explain *why* simply: *\"Choosing a location closer to\n     you or your users reduces latency and makes things load faster.\"* Recommend\n     `us-central1` \u002F `us-central1-a` if the user has no preference, and consult\n     [Regions and zones](https:\u002F\u002Fdocs.cloud.google.com\u002Fcompute\u002Fdocs\u002Fregions-zones.md.txt),\n     [GPU regions and zones](https:\u002F\u002Fdocs.cloud.google.com\u002Fcompute\u002Fdocs\u002Fregions-zones\u002Fgpu-regions-zones.md.txt),\n     or [Google Cloud locations](https:\u002F\u002Fcloud.google.com\u002Fabout\u002Flocations) only\n     when verifying non-default regional availability):\n     ```bash\n     gcloud config set compute\u002Fregion {region}\n     gcloud config set compute\u002Fzone {zone}\n     ```\n3. **Conversational Triage (Sizing, Generation & OS)**: Map the user's workload\n   to the **Intent-Based Sizing Tiers** and hardware generation defaults:\n   - **Default OS images**: Use `debian-12` (`debian-cloud`) for `E2`, `N2`,\n     `C3` virtualized, and `C2D`; use `debian-13` (`debian-cloud`) for 4th-gen\n     (`C4`, `N4`, `X4`) and bare metal (`c3-standard-192-metal`,\n     `c4-standard-288-metal`, where `debian-12` is unsupported); use\n     `debian-12-arm64` \u002F `debian-13-arm64` for Arm `C4A`; and use\n     `common-cu129-ubuntu-2404-nvidia-580` (`deeplearning-platform-release`) for\n     `G2` GPUs. Consult\n     [Operating system details](https:\u002F\u002Fdocs.cloud.google.com\u002Fcompute\u002Fdocs\u002Fimages\u002Fos-details.md.txt)\n     and\n     [Bare metal instances](https:\u002F\u002Fdocs.cloud.google.com\u002Fcompute\u002Fdocs\u002Finstances\u002Fbare-metal-instances.md.txt)\n     only when selecting non-default OS images or bare metal SKUs.\n   - **Storage by generation**: Use `hyperdisk-balanced` on 4th-gen (`C4`, `N4`,\n     `C4A`, `C4D`, `M4`, `X4`, `A4`) and bare metal (`-metal`) instances where\n     `pd-*` disks are rejected (`N4` supports `hyperdisk-balanced` and\n     `hyperdisk-throughput`, not `hyperdisk-extreme`; `H3` supports\n     `pd-balanced` and `hyperdisk-balanced`). Consult the *\"Machine series\n     support for Hyperdisk\"* section of\n     [About Google Cloud Hyperdisk](https:\u002F\u002Fdocs.cloud.google.com\u002Fcompute\u002Fdocs\u002Fdisks\u002Fhyperdisks.md.txt)\n     only for non-default disk types.\n4. **Determine Network Accessibility & Subnet**: **ALWAYS** ask in plain,\n   non-technical language whether the VM needs to be reachable from the public\n   internet or kept private, noting that private networking (`--no-address`) is\n   the security best practice—even when hosting a website or web app. Use\n   `--subnet={subnet}` (verifying whether a custom\u002FShared VPC subnet or\n   `default` VPC exists, since many enterprise projects enforce\n   `constraints\u002Fcompute.skipDefaultNetworkCreation`).\n5. **Configure Security, OS Login & Service Accounts**: Enable IAM-governed SSH\n   via `--metadata=enable-oslogin=TRUE`, recommend a custom least-privilege\n   service account (`{custom_service_account}`), and enable Shielded VM flags\n   (`--shielded-secure-boot`, `--shielded-vtpm`,\n   `--shielded-integrity-monitoring`) on virtualized VMs (on standard x86\n   `-metal` bare metal instances, pass `--no-shielded-secure-boot` and omit\n   vTPM\u002Fintegrity flags).\n6. **Summarize & Confirm (Mode-Aware)**: Present a clear summary of the proposed\n   VM configuration, cost profile, and architectural warnings:\n   - **Automated Execution Mode**: **Always** ask for explicit user confirmation\n     before executing any mutating provisioning command or tool call (e.g.,\n     *\"Would you like me to proceed with provisioning this configuration, or\n     adjust any settings first?\"*).\n   - **Manual \u002F `\"Do not execute\"` Mode**: Instruct the user to review and\n     substitute any `{snake_case}` placeholders (such as `{subnet}` or\n     `{custom_service_account}`) before running the command in their terminal;\n     do **not** offer to execute provisioning when tools are disconnected or\n     execution was forbidden.\n7. **Execute or Deliver Payloads**:\n   - **Automated**: Execute `gcloud compute instances create` (prefixed with\n     `CLOUDSDK_METRICS_REQUEST_ATTRIBUTION` per\n     [Usage Attribution](references\u002Fattribution.md)) for hardened\u002FSpot\u002F4th-gen\u002F\n     bare-metal configurations, or call MCP `create_instance` for default-VPC\n     prototyping, tracking progress via `get_zone_operation` and verifying via\n     `get_instance_basic_info`.\n   - **Manual**: Output formatted, copy-pasteable `gcloud` CLI commands (without\n     `--quiet` or attribution prefixes) or JSON payloads with clear\n     instructions.\n8. **Verify, Deliver Next Steps & Teardown Guidance**: Provide post-provisioning\n   access steps (for example, via `--tunnel-through-iap` with `gcloud compute\n   ssh`) and **always** include teardown instructions (omitting `--quiet` so\n   interactive confirmation prevents accidental data loss; see\n   [Delete a VM](https:\u002F\u002Fdocs.cloud.google.com\u002Fcompute\u002Fdocs\u002Finstances\u002Fdeleting-instance.md.txt)):\n   ```bash\n   gcloud compute instances delete {vm_name} --zone={zone} --delete-disks=all\n   ```\n   Remind the user to pass `--delete-disks=all` (or `--keep-disks=all` if\n   retaining data) so persistent disks are not orphaned.\n\n---\n\n## Intent-Based Sizing Tiers\n\nIf a user says \"I want to create a VM\" or is unsure of hardware specs, use this\ntable to recommend a tier. Point users to\n[Google Cloud pricing](https:\u002F\u002Fcloud.google.com\u002Fpricing) and\n[Compute Engine pricing](https:\u002F\u002Fcloud.google.com\u002Fcompute\u002Fall-pricing) for\ncurrent regional rates rather than quoting hardcoded dollar figures.\n\n| **Conversational Tier** | **Best For...** | **Underlying Machine** | **Boot Disk (Default)** | **Cost Profile** |\n| --- | --- | --- | --- | --- |\n| **Starter Tier** *(Dev\u002FTest & Learning)* | \"I just want to play around,\" \"I'm learning Linux,\" \"I have a tiny hobby script.\" | `e2-micro` (Free Tier eligible) or `e2-small` | 10 GB Standard Disk (`pd-standard`; Free Tier covers up to 30 GB `pd-standard`) | **Very Low** ([Google Cloud Free Tier](https:\u002F\u002Fdocs.cloud.google.com\u002Ffree\u002Fdocs\u002Ffree-cloud-features.md.txt) covers **one non-preemptible `e2-micro` instance\u002Fmonth** in `us-west1`, `us-central1`, or `us-east1` only; `e2-small` or other regions incur standard billing immediately; active billing account required) |\n| **Standard Tier** *(Websites & Apps)* **[GOLDEN PATH]** | \"I want to host a website,\" \"I'm running a small database,\" \"I don't know, just give me a basic one.\" | `e2-standard-2` (default baseline; `e2-medium` for light websites\u002Fapps, or `e2-standard-4` with 50 GB `pd-balanced` for higher concurrency) | 30 GB Balanced Disk (`pd-balanced`) | **Moderate** (Pay-as-you-go; see [Compute Engine pricing](https:\u002F\u002Fcloud.google.com\u002Fcompute\u002Fall-pricing)) |\n| **Powerhouse Tier** *(Heavy Processing)* | \"I have heavy data pipelines,\" \"I'm compiling large codebases,\" \"I need maximum speed.\" | 3rd-gen General-purpose `c3-standard-4` or `n2-standard-4` (4th-gen `c4-standard-4` \u002F `n4-standard-4` \u002F Arm `c4a-standard-4`; Compute-optimized `c2d-standard-4` \u002F `h3-standard-88`) | 100 GB `pd-ssd` (3rd-gen\u002F`C2D`), `pd-balanced` or `hyperdisk-balanced` (`H3`), or `hyperdisk-balanced` (mandatory on 4th-gen `C4`\u002F`N4`\u002F`C4A`) | **Premium** (Pay-as-you-go) |\n| **Specialist Tier** *(AI, Graphics & Bare Metal)* | \"I want to run an LLM,\" \"I need a GPU workstation,\" \"I need a bare metal `-metal` host.\" | `g2-standard-4` (1 NVIDIA L4 GPU) or bare metal `c3-standard-192-metal` \u002F `c4-standard-288-metal` | 100 GB `pd-balanced` (`G2`) or 200 GB `hyperdisk-balanced` (`-metal` \u002F 4th-gen `A4`) | **High** (Requires GPU or dedicated bare-metal CPU quota) |\n\n> **Rule:** Default to the Standard Tier (`e2-standard-2` with a 30 GB\n> `pd-balanced` boot disk) unless the user has specific requirements that other\n> tiers or sizes satisfy. When a workload maps to a tier without an explicit\n> vCPU\u002FRAM count, **always use the baseline machine type listed in the table**\n> (`e2-micro` or `e2-small` for Starter; `e2-standard-2` [or `e2-medium` \u002F\n> `e2-standard-4` when justified] for Standard; `c3-standard-4` or\n> `n2-standard-4` for 3rd-gen Powerhouse, `c4-standard-4` \u002F `n4-standard-4` for\n> 4th-gen, or `c2d-standard-4` for Compute-optimized; `g2-standard-4` for L4\n> GPU) rather than upsizing to `-8` or `-16`.\n\n---\n\n## Conversational Guidelines (How to Talk to Users)\n\n### 1. Early Fork: Establishing Execution Mode\n\nAt the start of an interactive session, state whether execution is automated\n(provisioning after confirmation via `gcloud` \u002F Compute Engine MCP) or guided\n(outputting copy-pasteable `gcloud` commands or JSON payloads for Cloud Shell or\nterminal)—**without running `gcloud config list` or shell commands while\nmandatory inputs are still missing**.\n\n### 2. Handling Simple Requests (e.g., \"Create a VM\" or \"Host a Small Website\")\n\nDo not overwhelm beginners with block-storage IOPS or CPU architecture jargon,\nand **do not run terminal commands before the user answers**. Clarify execution\nmode, recommend the **Standard Tier (Golden Path)** baseline (`e2-standard-2` or\n`e2-medium` with a **30 GB `pd-balanced` boot disk**), and **always** ask for\nall four required inputs in your first response:\n\n1. **Google Cloud Project ID**\n2. **VM Name** (e.g., `my-first-web-server`)\n3. **Region or Zone** (explaining that a location closer to users lowers network\n   latency and makes pages load faster; suggest `us-central1` \u002F `us-central1-a`\n   if unsure)\n4. **Public Internet vs. Private Networking** (in plain language: *\"Does this VM\n   need to be reachable from the public internet, or should we keep it private?\n   Keeping it private is our default security best practice—even for websites,\n   please confirm which you prefer.\"*)\n\n### 3. Clear Cost, Quota & Resource Availability Guidance\n\n- Warn clearly before provisioning **Powerhouse**, **GPU**, or **Bare Metal**\n  instances that specialized hardware and large `pd-ssd` \u002F Hyperdisk volumes\n  accumulate costs quickly (disks bill continuously while stopped) and require\n  sufficient regional CPU\u002FGPU quota.\n- If VM provisioning fails with `ZONE_RESOURCE_POOL_EXHAUSTED` (or\n  `ZONE_RESOURCE_POOL_EXHAUSTED_WITH_DETAILS`), explain that this is a physical\n  zonal hardware supply shortage that **a project quota increase will not fix**.\n  Consult\n  [Troubleshoot resource availability errors](https:\u002F\u002Fdocs.cloud.google.com\u002Fcompute\u002Fdocs\u002Ftroubleshooting\u002Ftroubleshooting-resource-availability.md.txt)\n  and guide the user to try another zone in the region (e.g., `us-central1-b` or\n  `us-central1-c`), adjust machine series\u002Fsize, or use Compute Engine\n  reservations.\n\n---\n\n## Best Practices & Hardening Rules\n\n### Security & Networking\n\n1. **Private-by-Default (`--no-address`)**: Default to `--no-address` on custom\n   or verified `--subnet={subnet}` subnets, using Cloud NAT for outbound egress\n   and Identity-Aware Proxy (IAP) TCP forwarding (`35.235.240.0\u002F20`, TCP `22` \u002F\n   `3389`, `roles\u002Fiap.tunnelResourceAccessor`; see\n   [Use IAP for TCP forwarding](https:\u002F\u002Fdocs.cloud.google.com\u002Fiap\u002Fdocs\u002Fusing-tcp-forwarding.md.txt))\n   for SSH\u002FRDP.\n2. **OS Login (`--metadata=enable-oslogin=TRUE`)**: Enable OS Login so SSH\n   access is tied to IAM roles rather than project-wide static SSH keys.\n3. **Custom Service Accounts**: Never use the default Compute Engine service\n   account; attach `{custom_service_account}` with least-privilege IAM roles.\n4. **Shielded VMs**: Enable `--shielded-secure-boot`, `--shielded-vtpm`, and\n   `--shielded-integrity-monitoring` on all virtualized VMs (omit vTPM\u002Fintegrity\n   and set `--no-shielded-secure-boot` on standard x86 `-metal` bare metal).\n\n### Cost Optimization & Reliability\n\n1. **Right-Sizing & Free Tier Accuracy**: Use `e2-micro` (`us-west1`,\n   `us-central1`, or `us-east1` only, 1 non-preemptible instance\u002Fmonth, up to\n   30 GB `pd-standard`, with an active billing account still required on the\n   Google Cloud project; see\n   [Google Cloud Free Tier](https:\u002F\u002Fdocs.cloud.google.com\u002Ffree\u002Fdocs\u002Ffree-cloud-features.md.txt))\n   for Free Tier eligibility, or `e2-medium` for light dev\u002Ftest workloads.\n2. **Spot VMs**: Offer Spot VMs (`--provisioning-model=SPOT`,\n   `--instance-termination-action=DELETE` [or `STOP`],\n   `--maintenance-policy=TERMINATE`, `--no-restart-on-failure`; see\n   [Create and use Spot VMs](https:\u002F\u002Fdocs.cloud.google.com\u002Fcompute\u002Fdocs\u002Finstances\u002Fcreate-use-spot.md.txt))\n   for stateless, fault-tolerant batch workloads to achieve significant\n   discounts compared to standard instances (see\n   [Compute Engine pricing](https:\u002F\u002Fcloud.google.com\u002Fcompute\u002Fall-pricing)).\n3. **Storage & Host Maintenance**: Default 3rd-gen\u002FE2 boot disks to\n   `pd-balanced` (`hyperdisk-balanced` on 4th-gen and `-metal`), and set\n   `--maintenance-policy=MIGRATE` on standard virtualized VMs (`TERMINATE` on\n   Spot, GPU, and `-metal` instances; see\n   [Handle GPU host maintenance events](https:\u002F\u002Fdocs.cloud.google.com\u002Fcompute\u002Fdocs\u002Fgpus\u002Fgpu-host-maintenance.md.txt)).\n\n---\n\n## Technical Reference Templates\n\nEvery row below summarizes the complete `gcloud compute instances create` flags\n(with `{vm_name}`, `--project={project_id}`, and `--zone={zone}`) and 8-field\nCompute Engine MCP `create_instance` schema for the five standard VM templates.\nConsult [Technical Reference Templates](references\u002Ftemplates.md) when full\nmulti-line examples or additional template context are needed, and always read\n[Usage Attribution](references\u002Fattribution.md) before executing any live\n`gcloud`, REST API, or MCP command:\n\n| **Template** | **Complete `gcloud compute instances create {vm_name} --project={project_id} --zone={zone}` Flags** | **MCP `create_instance` Routing & Schema** | **Required Warnings** |\n| --- | --- | --- | --- |\n| **1. Golden Path General Purpose (Production)** | `--machine-type=e2-standard-2 --network-tier=PREMIUM --subnet={subnet} --no-address --maintenance-policy=MIGRATE --metadata=enable-oslogin=TRUE --service-account={custom_service_account} --scopes=https:\u002F\u002Fwww.googleapis.com\u002Fauth\u002Fcloud-platform --create-disk=auto-delete=yes,boot=yes,device-name={vm_name},image=projects\u002Fdebian-cloud\u002Fglobal\u002Fimages\u002Ffamily\u002Fdebian-12,mode=rw,size=30,type=projects\u002F{project_id}\u002Fzones\u002F{zone}\u002FdiskTypes\u002Fpd-balanced --shielded-secure-boot --shielded-vtpm --shielded-integrity-monitoring --reservation-affinity=any` | 7-field JSON (`project`, `zone`, `name`, `\"machineType\": \"e2-standard-2\"`, `\"imageProject\": \"debian-cloud\"`, `\"imageFamily\": \"debian-12\"`, `\"maintenancePolicy\": \"MIGRATE\"`) is for default-VPC prototyping only; route hardened (`--no-address`, custom subnet\u002FSA) deploys to `gcloud`. | Recommend Cloud NAT for egress and IAP TCP forwarding (`35.235.240.0\u002F20`, `roles\u002Fiap.tunnelResourceAccessor`) for SSH\u002FRDP; never use the default Compute Engine service account; omit `--quiet`. |\n| **2. Developer Dev\u002FTest VM (Cost-Optimized Spot)** | `--machine-type=e2-medium --subnet={subnet} --no-address --metadata=enable-oslogin=TRUE --service-account={custom_service_account} --scopes=https:\u002F\u002Fwww.googleapis.com\u002Fauth\u002Fcloud-platform --provisioning-model=SPOT --instance-termination-action=DELETE --maintenance-policy=TERMINATE --no-restart-on-failure --create-disk=auto-delete=yes,boot=yes,device-name={vm_name},image=projects\u002Fdebian-cloud\u002Fglobal\u002Fimages\u002Ffamily\u002Fdebian-12,mode=rw,size=20,type=projects\u002F{project_id}\u002Fzones\u002F{zone}\u002FdiskTypes\u002Fpd-standard --shielded-secure-boot --shielded-vtpm --shielded-integrity-monitoring` | **CLI\u002FREST only**—Compute Engine MCP `create_instance` does not support Spot scheduling (`--provisioning-model=SPOT`, `--instance-termination-action`), `--no-address`, or custom subnets\u002Fservice accounts. | Warn that Spot VMs can be preempted at any time (for stateless workloads only); use `DELETE` or `STOP` (never `TERMINATE`) on `--instance-termination-action`; include teardown command without `--quiet`. |\n| **3. High-Performance General Purpose & Compute-Heavy** | **3rd-gen (`c3-standard-4` \u002F `n2-standard-4`)**: `--machine-type=c3-standard-4 --subnet={subnet} --no-address --metadata=enable-oslogin=TRUE --service-account={custom_service_account} --scopes=https:\u002F\u002Fwww.googleapis.com\u002Fauth\u002Fcloud-platform --create-disk=auto-delete=yes,boot=yes,device-name={vm_name},image=projects\u002Fdebian-cloud\u002Fglobal\u002Fimages\u002Ffamily\u002Fdebian-12,mode=rw,size=100,type=projects\u002F{project_id}\u002Fzones\u002F{zone}\u002FdiskTypes\u002Fpd-ssd --maintenance-policy=MIGRATE --shielded-secure-boot --shielded-vtpm --shielded-integrity-monitoring` (for **4th-gen `c4-standard-4` \u002F `n4-standard-4`**, replace `--subnet`\u002F`--no-address` with `--network-interface=subnet={subnet},no-address,nic-type=GVNIC`, use `debian-13`, and use `hyperdisk-balanced`) | Default-VPC 3rd-gen prototyping only (`\"machineType\": \"c3-standard-4\"`); route custom-disk, 4th-gen Hyperdisk, and private-subnet deploys to `gcloud`. | Warn about continuous `pd-ssd`\u002FHyperdisk storage billing, 4th-gen Hyperdisk requirement (`pd-*` rejected on `C4`\u002F`N4`\u002F`C4A`), and accurate **Day-0 mutability** (disk shrink\u002Ftype change uses snapshot + `detach-disk`\u002F`attach-disk --boot` swap; stopped VMs rename via `gcloud compute instances set-name` and update subnet via `network-interfaces update`; VM recreation required for zone, CPU arch, or Encrypted-Memory VM). |\n| **4. GPU Workstation (ML Inference)** | `--machine-type=g2-standard-4 --accelerator=type=nvidia-l4,count=1 --subnet={subnet} --no-address --metadata=enable-oslogin=TRUE --service-account={custom_service_account} --scopes=https:\u002F\u002Fwww.googleapis.com\u002Fauth\u002Fcloud-platform --maintenance-policy=TERMINATE --create-disk=auto-delete=yes,boot=yes,device-name={vm_name},image=projects\u002Fdeeplearning-platform-release\u002Fglobal\u002Fimages\u002Ffamily\u002Fcommon-cu129-ubuntu-2404-nvidia-580,mode=rw,size=100,type=projects\u002F{project_id}\u002Fzones\u002F{zone}\u002FdiskTypes\u002Fpd-balanced --shielded-secure-boot --shielded-vtpm --shielded-integrity-monitoring` | 8-field JSON (`\"project\": \"{project_id}\"`, `\"zone\": \"{zone}\"`, `\"name\": \"{vm_name}\"`, `\"machineType\": \"g2-standard-4\"`, `\"imageProject\": \"deeplearning-platform-release\"`, `\"imageFamily\": \"common-cu129-ubuntu-2404-nvidia-580\"`, `\"guestAccelerators\": [{\"acceleratorType\": \"nvidia-l4\", \"acceleratorCount\": 1}]`, `\"maintenancePolicy\": \"TERMINATE\"`) is for default-VPC prototyping only; route hardened deploys to `gcloud`. | Warn about high GPU hourly costs, required regional GPU quota verification, and that GPU VMs **do not support live migration** (`--maintenance-policy=TERMINATE` is mandatory; never set `MIGRATE`). |\n| **5. Bare Metal Instance (`-metal`)** | `--machine-type=c3-standard-192-metal --network-interface=subnet={subnet},no-address,nic-type=IDPF --maintenance-policy=TERMINATE --metadata=enable-oslogin=TRUE --service-account={custom_service_account} --scopes=https:\u002F\u002Fwww.googleapis.com\u002Fauth\u002Fcloud-platform --create-disk=auto-delete=yes,boot=yes,device-name={vm_name},image=projects\u002Fdebian-cloud\u002Fglobal\u002Fimages\u002Ffamily\u002Fdebian-13,mode=rw,size=200,type=projects\u002F{project_id}\u002Fzones\u002F{zone}\u002FdiskTypes\u002Fhyperdisk-balanced --no-shielded-secure-boot` (never combine `--network-interface` with top-level `--subnet` or `--no-address`; omit `--shielded-vtpm`) | **CLI\u002FREST only**—unsupported by Compute Engine MCP `create_instance`. | Warn about dedicated whole-host costs\u002Fquota, mandatory `hyperdisk-balanced` (`pd-*` and Windows unsupported), mandatory `debian-13` (`debian-12` unsupported on `C3-metal`, `C4-metal`, and `X4`), mandatory `nic-type=IDPF` (`GVNIC`\u002F`VIRTIO_NET` unsupported), and no live migration. |\n\n---\n\n## Instructions & Guardrails\n\n- **EARLY EXECUTION FORK & MCP BOUNDARY**: Never pass unsupported REST fields\n  (`instance`, `disks`, `networkInterfaces`, `serviceAccounts`,\n  `shieldedInstanceConfig`, `scheduling`) or prefixed machine URIs\n  (`zones\u002F{zone}\u002FmachineTypes\u002F...`) to MCP `create_instance`, and always route\n  hardened (`--no-address`, custom subnet, custom SA, Shielded VM, OS Login),\n  Spot, custom-disk, 4th-gen, and `-metal` creations to\n  `gcloud compute instances create`.\n- **FAST CONVERSATIONAL INTAKE (NO SHELL COMMANDS ON MISSING INPUTS)**: When any\n  mandatory input (**Project ID**, **VM name**, **region\u002Fzone**, or **public vs.\n  private networking**) is missing from the user's prompt, ask for all missing\n  inputs directly in your first reply (explaining regional latency benefits and\n  recommending private networking) **without running `gcloud config list`,\n  `gcloud --version`, or any shell discovery commands first**.\n- **PUBLIC IP REMEDIATION CHECKLIST**: Whenever a user requests a public IP or\n  direct internet SSH exposure:\n  1. Warn clearly about public internet scanners and SSH\u002FRDP brute-force risks.\n  2. Recommend **both** **Identity-Aware Proxy (IAP) TCP forwarding**\n     (`35.235.240.0\u002F20`, `roles\u002Fiap.tunnelResourceAccessor`) for SSH\u002FRDP **and**\n     **Cloud NAT** for outbound internet access with `--no-address`.\n  3. Include `--metadata=enable-oslogin=TRUE` and all three **Shielded VM**\n     flags (`--shielded-secure-boot`, `--shielded-vtpm`,\n     `--shielded-integrity-monitoring`) on virtualized VMs.\n  4. Recommend a **custom, least-privilege service account** instead of the\n     default Compute Engine service account.\n- **ACCURATE DAY-0 MUTABILITY WARNINGS**: Explain accurately that:\n  - **Disks**: Persistent Disks and Hyperdisks cannot shrink in-place, and\n    changing disk type requires creating a new disk from a snapshot and swapping\n    it on a stopped VM (`detach-disk` \u002F `attach-disk --boot`) without\n    recreating the VM instance.\n  - **Networking & Renaming**: Stopped (`TERMINATED`) standalone IPv4 VMs can\n    migrate VPC\u002Fsubnet in-place (`gcloud compute instances network-interfaces\n    update`; only NIC count `nic1+` is fixed at creation) and can be renamed\n    in-place via `gcloud compute instances set-name` with `--new-name` and\n    `--zone`\n    (see [Rename a VM](https:\u002F\u002Fdocs.cloud.google.com\u002Fcompute\u002Fdocs\u002Finstances\u002Frename-instance.md.txt)\n    and [Update instance properties](https:\u002F\u002Fdocs.cloud.google.com\u002Fcompute\u002Fdocs\u002Finstances\u002Fupdate-instance-properties.md.txt)).\n  - **True VM Recreation**: Properties requiring full **VM recreation** are\n    **zone**, **CPU architecture** (`x86_64` vs. `ARM64`), and\n    **Encrypted-Memory VM (AMD SEV-SNP or Intel TDX)** enablement.\n- **4TH-GEN & BARE METAL HARDWARE CONSTRAINTS**: Never pair `pd-*` disks with\n  4th-generation (`C4`, `N4`, `C4A`, `C4D`, `M4`, `X4`, `A4`, which require\n  `hyperdisk-balanced` and `nic-type=GVNIC`; `N4` supports `hyperdisk-balanced`\n  and `hyperdisk-throughput`, not `hyperdisk-extreme`) or bare metal (`-metal`)\n  instances. Whenever recommending or generating a bare metal (`-metal`)\n  configuration (`C3-metal`, `C4-metal`), **always explicitly state in your\n  reply** that: (1) `pd-*` disks are unsupported (`hyperdisk-balanced` is\n  mandatory), (2) `debian-13` is required because `debian-12` is unsupported on\n  `C3-metal`, `C4-metal`, and `X4`, (3)\n  `--network-interface=subnet={subnet},no-address,nic-type=IDPF` is required\n  without conflicting top-level `--subnet` or `--no-address` flags (because\n  `GVNIC` and `VIRTIO_NET` are unsupported on `-metal`), and (4)\n  `--maintenance-policy=TERMINATE`, `--metadata=enable-oslogin=TRUE`, and\n  `--no-shielded-secure-boot` (omitting `--shielded-vtpm`) are required.\n- **MANDATORY GPU & SPECIALIZED HARDWARE WARNINGS**: Whenever recommending or\n  generating a GPU (`G2`, `A3`, `A4`), bare metal (`-metal`), or\n  high-performance VM configuration (including in `\"Do not execute\"` or MCP JSON\n  comparisons), **always** explicitly include in your reply: (1) a warning about\n  **high GPU or dedicated-host hourly compute costs**, (2) a reminder to\n  **verify regional GPU\u002FCPU quota** in the target project, and (3) that **GPU\n  and bare metal instances do not support live migration**\n  (`--maintenance-policy=TERMINATE` is mandatory).\n- **HANDLE `ZONE_RESOURCE_POOL_EXHAUSTED`**: Explain that zonal capacity errors\n  are physical hardware shortages (not fixable via quota increases) and guide\n  users to alternate zones, alternate machine series, or reservations per\n  [Troubleshoot resource availability errors](https:\u002F\u002Fdocs.cloud.google.com\u002Fcompute\u002Fdocs\u002Ftroubleshooting\u002Ftroubleshooting-resource-availability.md.txt).\n- **FREE TIER ELIGIBILITY & BILLING ACCOUNT REQUIREMENT**: Whenever a user asks\n  about Google Cloud Free Tier eligibility for Compute Engine, always explicitly\n  state all four requirements in your reply: (1) only one non-preemptible\n  `e2-micro` instance per month is covered (`e2-small` and larger are billed),\n  (2) only in `us-west1`, `us-central1`, or `us-east1`, (3) up to 30 GB of\n  `pd-standard` Standard Persistent Disk (`pd-balanced` and `pd-ssd` are\n  billed), and (4) an **active billing account is still required on the Google\n  Cloud project** even for Free Tier usage.\n- **ALWAYS INCLUDE SAFE TEARDOWN COMMANDS**: Always provide\n  `gcloud compute instances delete {vm_name} --zone={zone} --delete-disks=all`\n  (omitting `--quiet` on all copy-pasteable manual `create` and `delete`\n  commands) so users can prevent orphaned compute and disk charges safely.\n- **MODE-AWARE CONFIRMATION**: Require explicit user confirmation before\n  executing provisioning in **Automated Execution** mode; in **Manual \u002F `\"Do not\n  execute\"`** mode, prompt the user to review `{snake_case}` placeholders and\n  flags before running the command themselves rather than offering to execute\n  it.\n",{"name":5,"metadata":24,"description":7},{"version":25,"category":26},"1.0.0","Compute","main","67c4dbc8ff6313ef117d938e53bb21315fc281ae","skills\u002Fcloud\u002Fcompute-vm-creation",2014,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills","https:\u002F\u002Fgithub.com\u002Fgoogle","https:\u002F\u002Fopensource.google\u002F","Google ❤️ Open Source","2026-11-14 23:31:00",{"source":8,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add google\u002Fskills --skill compute-vm-creation",{"tool":42,"command":43},"bunx","bunx skills add google\u002Fskills --skill compute-vm-creation",{"tool":45,"command":46},"pnpm","pnpm dlx skills add google\u002Fskills --skill compute-vm-creation","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcompute-vm-creation\u002FSKILL.md",true,[50,56],{"path":51,"resourceType":52,"resourceTypeDesc":53,"sizeBytes":54,"sourceHtmlUrl":55},"references\u002Fattribution.md","REFERENCE","参考文档",1937,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcompute-vm-creation\u002Freferences\u002Fattribution.md",{"path":57,"resourceType":52,"resourceTypeDesc":53,"sizeBytes":58,"sourceHtmlUrl":59},"references\u002Ftemplates.md",15693,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcompute-vm-creation\u002Freferences\u002Ftemplates.md",[61,68,75,82,89,96],{"skillNo":62,"name":63,"nameZh":6,"description":64,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":65,"categories":66,"keywords":67,"publishedAt":19},"01M7DQ9K7JF4T7NJZ2K1MQZ44Q","cloud-operator-share-context","Shares Google Cloud operating context the user or their team already have — environments, projects, services and regions, product preferences, best practices, architecture guidance, runbooks — found in agent instruction files, local memory, skills and workflows, and the repository's GCP docs, with the operator agent's memory after the user reviews the list. Use when the user runs this skill, accepts the cloud-operator or cloud-operator-setup skill's offer to share their existing Google Cloud context, or asks to share, import or save that context or a GCP fact for the operator agent. Don't use for ordinary GCP requests, which go to the cloud-operator skill.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcloud-operator-share-context\u002FSKILL.md",[],[],{"skillNo":69,"name":70,"nameZh":6,"description":71,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":72,"categories":73,"keywords":74,"publishedAt":19},"01M7DQ9ERFGGQCFAWQW0KRKYBY","cloud-operator-setup","Sets up the operator agent in a Google Cloud project via the autocloud MCP server: picks the operator project, creates or checks the user's operator agent, saves the project, and offers to share the user's existing Google Cloud operating context with the operator agent's memory. Use when the user runs this skill, asks to set up the operator or create their operator agent, or chooses setup when the cloud-operator skill asks. Don't use for ordinary GCP requests or installing gcloud.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcloud-operator-setup\u002FSKILL.md",[],[],{"skillNo":76,"name":77,"nameZh":6,"description":78,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":79,"categories":80,"keywords":81,"publishedAt":19},"01M7B4RHQCM0DK2XQ7S7ZXVN8D","developer-device-platform-device-run","Runs automated, non-interactive jobs on remote Android devices with Developer Device Platform (DDP) Device Run using `gcloud beta device-run sessions`: native Android executables or shell scripts (for example CLI tools, custom runners, test harnesses or benchmarks) and Android instrumentation tests, on one or many devices, then waits for completion and collects per-device outputs and logs. Use when running a binary or test suite on remote devices without an interactive connection. Don't use it for interactive device reservations, adb tunnels or screen streaming (use developer-device-platform-basics), or for local devices.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fdeveloper-device-platform-device-run\u002FSKILL.md",[],[],{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":88,"publishedAt":19},"01M7B4QD02N0YBVT0838Z5K5VC","agent-platform-autorater-customization","Customizes an autorater (evaluation metric) for an AI agent so its grades match the user's own judgment, starting from the agent's real trajectories. Use when a user wants a metric tailored to their agent, wants to turn failing trajectories into rubrics, says an existing autorater grades their agent wrong, or wants an autorater to agree with human labels (autorater hillclimbing, judge calibration). Don't use for quick evals with built-in metrics or for improving the agent itself (use agent-platform-eval-flywheel).","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fagent-platform-autorater-customization\u002FSKILL.md",[],[],{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":19},"01M78JP22K73KK96JH0JNDT5C4","iap-agent-platform-troubleshooting","Diagnoses Identity-Aware Proxy (IAP) denials of outbound requests from Gemini Enterprise Agent Platform agents that run on Agent Runtime and send traffic through Agent Gateway. Use when an agent request fails with \"Egress request is not authorized\", when Cloud Audit Logs show an IAP egressViaIAP decision with granted false, when IAP audit entries are missing while debugging agent egress, or when Access policies, IAP allow policies, policy bindings, or Agent Registry entries might block agent egress. Don't use for Gemini model IAM permission errors (such as aiplatform.endpoints.predict), Agent Platform API errors, or Agent Runtime deployment or 500 errors (use agent-platform-troubleshooting instead). Don't use for setting up, creating, or connecting an Agent Gateway, or for IAP web apps, IAP TCP forwarding, or SSH.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fiap-agent-platform-troubleshooting\u002FSKILL.md",[],[],{"skillNo":97,"name":98,"nameZh":6,"description":99,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":100,"categories":101,"keywords":102,"publishedAt":19},"01M78JJJ5CSDTKX3HRH34K37Z8","bigquery-migration-validator","Validates that tables migrated to BigQuery match their source (Teradata, Snowflake, Oracle, Redshift, Databricks, PostgreSQL, SQL Server, MySQL, MariaDB, Hive, Impala, Vertica) with the BigQuery Migration Service (BQMS) validation tool: schema and data type comparison, column aggregate comparison, and row-level data comparison. Use when generating or editing a validation config, running a validation, choosing sampling or partitioning, fixing connection or driver errors, or investigating validation results in BigQuery and Cloud Storage to decide which mismatches to fix. Don't use for SQL translation (use bigquery-migration-sql-translator), extracting source database catalog metadata or query logs, generating SQL scripts (such as COPY INTO) or exporting or unloading source tables to Parquet on Cloud Storage, loading staged files into BigQuery (such as bq load), or general BigQuery query failures and tuning (use bigquery-troubleshooting or bigquery-optimization).","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fbigquery-migration-validator\u002FSKILL.md",[],[]]