The four options you usually get

Every trainer who teaches cloud recognises all four.

A cloud simulator

A learner who has already used the real console sees the seams. A learner who has not is taught something that does not exist outside the classroom.

A shared sandbox

One learner deletes a network or exhausts an address range, and the exercise stops for the other twenty-nine. You debug your own lab rather than teach.

A learner's own account

Card details, a billing account per person, and a bill that runs long after the course ends. In several markets the learner cannot complete that step at all, and never starts.

Hand-built lab setup

A day of setup before every cohort, and scripts that drifted since the last one. The infrastructure is real, but you author it again for each delivery.

There is also cleanup, after everyone has gone home: finding what was left running, in whose account, and turning it off before it becomes an invoice.

What a cohort deploy does

The ordinary RAD deploy form, with a roster attached.

The RAD deploy form with a roster attached: a Deploy for participants panel reading 2 of 2 participants selected, above the ordinary Tenant Id and Region fields

This is the ordinary deploy form. The only difference is the panel at the top: pick the participants, and one confirmation provisions one project and one deployment for each of them. There is no separate trainer console.

Deploy-on-behalf works only into RAD-managed projects. Switching the RAD-managed option off clears the participants you had selected. A trainer cannot provision into a participant's own Google Cloud account.

What the lab tier restricts

Org policies applied to the folder the lab projects are created in.

Guardrails

  • External IP addresses are denied
  • The default network is suppressed
  • Serial port access is disabled
  • Service-account key creation and upload are blocked
  • Public storage buckets are prevented
  • Public Cloud SQL IP addresses are refused
  • The Google Cloud services that can be enabled are restricted to an allowlist
  • Resource locations are restricted to the permitted regions

Where it runs

  • RAD-managed regions8
  • Americasus-central1
  • Americasnorthamerica-south1
  • Americassouthamerica-west1
  • Europeeurope-north2
  • Middle Eastme-west1
  • Africaafrica-south1
  • Asiaasia-east1
  • Oceaniaaustralia-southeast2

One region in each of eight geographies, the cheapest available in that geography per the Cloud Billing Catalog API. africa-south1 is the only Google Cloud region on the African continent.

A deployment into a participant's own project keeps every region Google offers.

Spend visibility

  • Each tier carries a monthly Google Cloud budget that raises alerts as spend approaches and exceeds it. A budget notifies; it does not block an API call.
  • Enforcement is separate. RAD is designed to suspend billing on a managed project if the owner's purchased credit balance goes negative, and to restore it after a top-up. It only reverses a suspension it applied itself.
  • Every deployment writes a credit transaction, so a participant can see what each exercise cost.

Who owns it, and who pays for it

Ownership and cost both sit with the participant, not the trainer.

What a trainer can and cannot do

The trainer role on its own grants nothing. Visibility is derived from the roster, and it is re-checked on every request.

A trainer can

  • Provision a deployment for every participant on the roster in one action
  • See the deployments they provisioned, and follow their status while they build
  • Read the non-sensitive Terraform outputs, such as an application URL, of a deployment they provisioned for someone currently on their roster
  • Tear those deployments down when the course ends

A trainer cannot

  • Read a participant's raw configuration values — the submitted variables, including every secret in them, are restricted to the owner and to administrators
  • See anything belonging to someone who is not on the roster
  • Provision into a participant's own Google Cloud account
  • Retain access after a name is removed from the roster
  • Look up accounts outside the roster — the deploy form gives a trainer a chooser over their own participants, not a user search

End of term

A roster stands until someone clears it. Ask an administrator to empty the list at the end of term, or to strike a single name for a participant who leaves in week two.

Access is derived from membership rather than held as a separate permission, so that one edit is the whole revocation, and it takes effect on the next request.

A multi-application capstone

The catalogue carries 60+ pre-composed solutions, and a solution can be provisioned for a cohort in the same way a single module can.

Applications, in order

A solution holds between three and eight applications, provisioned three at a time into one project. A member that consumes another member's Terraform outputs waits for that deployment to finish; the rest start as soon as the solution is confirmed.

Pairs are wired

Where a producer-and-consumer pair is wired, a solution writes the producer's Terraform outputs into the consumer's configuration when it finishes. Connections in other solutions are made by hand. This wiring is a beta capability; verify it in a pilot.

Torn down in reverse

Teardown runs the dependency graph backwards, so the shared project is destroyed after the things living inside it rather than before them. For a cohort that is the difference between a clean end of term and a set of half-deleted estates left to chase.

A capstone solution is charged as one reservation across all its members, with a bundle discount of 15% for 3–4 modules, 20% for 5–6 and 25% for 7 or more. Debited, as always, from each participant.

The written curriculum already exists

Page counts from docs.radmodules.dev.

345+ hands-on deployment labs

Each one ends in something running rather than in a diagram. They map onto the same catalogue your cohort deploys from, so the lab a participant reads and the form they fill in are the same subject, step for step, throughout.

520+ module configuration guides

One for each of the 345+ application options, plus 175+ shared application-layer guides those options build on. They list the variables the deploy form asks about and what each one does, which makes them useful as pre-reading.

40+ certification study guides

Aligned to seven Google Cloud certification tracks: ACE, PCA, PCD, PCDE, PCNE, PDE and PSE. Each guide defines deployment profiles built from the foundation modules and maps the exam domains onto them for teaching.

The brochure is the version to send a head of faculty or a budget holder: what the lab tier restricts, and how a course is costed per seat. There is also a programme write-up, From Certified to Capable, for the curriculum itself.

Before you plan a cohort

RAD is in beta, and cohort provisioning is the newest part of it.