https://cloud.google.com/bigquery/docs/quickstarts/quickstart-web-ui?authuser=4

`gcloud services list --available` returns not only the enabled services in the project but also services that CAN be enabled.
https://cloud.google.com/sdk/gcloud/reference/services/list#--available Run the following command to list the enabled APIs and services in your current project:
gcloud services list
whereas, Run the following command to list the APIs and services available to you in your current project:
gcloud services list -available
https://cloud.google.com/sdk/gcloud/reference/services/list#--available
--available
Return the services available to the project to enable. This list will include any services that the project has already enabled.
To list the services the current project has enabled for consumption, run:
gcloud services list --enabled
To list the services the current project can enable for consumption, run:
gcloud services list -available

A custom image belongs only to your project. To create an instance with a custom image, you must first have a custom image.
Reference:https://cloud.google.com/compute/docs/instances/create-start-instance Preparing your instance for an image You can create an image from a disk even while it is attached to a running VM instance. However, your image will be more reliable if you put the instance in a state that is easier for the image to capture. Use one of the following processes to prepare your boot disk for the image:
Stop the instance so that it can shut down and stop writing any data to the persistent disk.
If you can't stop your instance before you create the image, minimize the amount of writes to the disk and sync your file system.
Pause apps or operating system processes that write data to that persistent disk.
Run an app flush to disk if necessary. For example, MySQL has a FLUSH statement. Other apps might have similar processes.
Stop your apps from writing to your persistent disk.
Run sudo sync.
After you prepare the instance, create the image.
https://cloud.google.com/compute/docs/images/create-delete-deprecate-private- images#prepare_instance_for_image

In general, Google recommends that each instance that needs to call a Google API should run as a service account with the minimum permissions necessary for that instance to do its job. In practice, this means you should configure service accounts for your instances with the following process: Create a new service account rather than using the Compute Engine default service account. Grant IAM roles to that service account for only the resources that it needs. Configure the instance to run as that service account. Grant the instance the
https://www.googleapis.com/auth/cloud-platform scope to allow full access to all Google Cloud APIs, so that the IAM permissions of the instance are completely determined by the IAM roles of the service account.
Avoid granting more access than necessary and regularly check your service account permissions to make sure they are up-to-date.https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for- instances#best_practices Reference: https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances

1. Create an ingress firewall rule with the following settings: "¢ Targets: all instances with tier #2 service account "¢ Source filter: all instances with tier #1 service account "¢ Protocols: allow TCP:8080 2. Create an ingress firewall rule with the following settings: "¢ Targets: all instances with tier #3 service account "¢ Source filter: all instances with tier #2 service account "¢ Protocols: allow TCP: 8080