{"id":679,"date":"2026-04-15T00:03:04","date_gmt":"2026-04-15T00:03:04","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/google-cloud-firestore-in-native-mode-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-databases\/"},"modified":"2026-04-15T00:03:04","modified_gmt":"2026-04-15T00:03:04","slug":"google-cloud-firestore-in-native-mode-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-databases","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/google-cloud-firestore-in-native-mode-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-databases\/","title":{"rendered":"Google Cloud Firestore in Native mode Tutorial: Architecture, Pricing, Use Cases, and Hands-On Guide for Databases"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Category<\/h2>\n\n\n\n<p>Databases<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Introduction<\/h2>\n\n\n\n<p>Firestore in Native mode is Google Cloud\u2019s fully managed NoSQL document database for building web, mobile, and server applications that need flexible schema, automatic scaling, and simple application-driven data access patterns.<\/p>\n\n\n\n<p>In simple terms: you store data as \u201cdocuments\u201d grouped into \u201ccollections,\u201d and your app reads and writes those documents using Google-provided SDKs and APIs. Firestore handles scaling, replication (based on the location you choose), and operational tasks like patching and capacity planning.<\/p>\n\n\n\n<p>Technically, Firestore in Native mode is a horizontally scalable document database with indexing, rich queries, atomic transactions, batched writes, and (when used with client SDKs) real-time listeners and offline support. It integrates with Google Cloud IAM for server-to-server access and supports security rules for client access patterns (commonly through Firebase).<\/p>\n\n\n\n<p>The core problem it solves is building responsive, globally available (multi-region option), schema-flexible applications without running and tuning database servers\u2014especially where access is document-centric and you want a straightforward operational model.<\/p>\n\n\n\n<blockquote>\n<p>Naming and mode note (important): On Google Cloud, \u201cFirestore\u201d supports two modes: <strong>Firestore in Native mode<\/strong> and <strong>Firestore in Datastore mode<\/strong>. Datastore mode is the evolution of Cloud Datastore. This tutorial is specifically and only about <strong>Firestore in Native mode<\/strong>.<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">2. What is Firestore in Native mode?<\/h2>\n\n\n\n<p>Firestore in Native mode is a fully managed NoSQL <strong>document<\/strong> database on Google Cloud designed for application backends. Its official purpose is to provide a scalable, serverless database for storing and syncing application data with strong consistency, indexing, and security controls.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Core capabilities<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Document data model<\/strong>: store JSON-like documents (fields of various types) inside collections.<\/li>\n<li><strong>Queries and indexing<\/strong>: query documents with filters, ordering, and pagination; uses automatic single-field indexes and configurable composite indexes.<\/li>\n<li><strong>Atomic operations<\/strong>: transactions and batched writes for multi-document updates.<\/li>\n<li><strong>Real-time updates (client SDKs)<\/strong>: subscribe to changes and receive updates (commonly used in web\/mobile).<\/li>\n<li><strong>Offline support (client SDKs)<\/strong>: local caching and sync (typically web\/mobile SDK features).<\/li>\n<li><strong>Managed operations<\/strong>: no servers to patch; capacity scales with usage patterns within documented limits.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Major components<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Database<\/strong>: the top-level container (commonly <code>(default)<\/code>).<\/li>\n<li><strong>Collections<\/strong>: groups of documents.<\/li>\n<li><strong>Documents<\/strong>: units of storage containing fields (key-value pairs).<\/li>\n<li><strong>Subcollections<\/strong>: collections nested under a document.<\/li>\n<li><strong>Indexes<\/strong>: single-field (automatic) and composite (configured when needed for certain queries).<\/li>\n<li><strong>Security controls<\/strong>:<\/li>\n<li><strong>IAM<\/strong> for server-side access (service accounts, workloads).<\/li>\n<li><strong>Security rules<\/strong> for client access patterns (commonly via Firebase client SDK usage).<\/li>\n<li><strong>SDKs\/APIs<\/strong>:<\/li>\n<li>Server SDKs (Google Cloud client libraries).<\/li>\n<li>Firebase Admin SDK and Firebase client SDKs (depending on your architecture).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Service type and scope<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Service type<\/strong>: fully managed NoSQL document database (serverless from the user perspective).<\/li>\n<li><strong>Scope<\/strong>: created within a <strong>Google Cloud project<\/strong> and bound to a <strong>location<\/strong> (regional or multi-region). The location choice affects latency, availability characteristics, and cost; you generally cannot change the location after creation (verify current behavior in official docs).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Regional \/ multi-region placement<\/h3>\n\n\n\n<p>Firestore in Native mode supports:\n&#8211; <strong>Regional<\/strong> locations (single region).\n&#8211; <strong>Multi-region<\/strong> locations (spanning multiple regions within a geography).<\/p>\n\n\n\n<p>Your database is <strong>project-scoped<\/strong> and <strong>location-bound<\/strong>. Review the current location list in official docs because availability can change over time:\n&#8211; https:\/\/cloud.google.com\/firestore\/docs\/locations<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Fit in the Google Cloud ecosystem<\/h3>\n\n\n\n<p>Firestore in Native mode commonly integrates with:\n&#8211; <strong>Compute<\/strong>: Cloud Run, Google Kubernetes Engine (GKE), Compute Engine, Cloud Functions.\n&#8211; <strong>Identity<\/strong>: IAM, service accounts; Firebase Authentication for client apps.\n&#8211; <strong>Networking\/security<\/strong>: VPC Service Controls, Private Google Access \/ restricted endpoints (depending on your network design).\n&#8211; <strong>Operations<\/strong>: Cloud Logging, Cloud Monitoring, Cloud Audit Logs.\n&#8211; <strong>Analytics\/ETL<\/strong>: exports to Cloud Storage; downstream processing with Dataflow\/BigQuery (implementation patterns vary\u2014verify current recommended approaches).<\/p>\n\n\n\n<p>Official documentation hub:\n&#8211; https:\/\/cloud.google.com\/firestore\/docs<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">3. Why use Firestore in Native mode?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Business reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Faster time-to-market<\/strong>: no database server provisioning, patching, or manual sharding.<\/li>\n<li><strong>Elastic scale<\/strong>: supports growth from prototype to production without re-platforming (within service limits).<\/li>\n<li><strong>Mobile\/web readiness<\/strong>: Firestore is commonly chosen for consumer apps due to SDK ecosystem and real-time capabilities.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Technical reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Flexible schema<\/strong>: documents can evolve over time, helpful for iterative product development.<\/li>\n<li><strong>Strong consistency<\/strong>: predictable reads after writes (review any documented consistency nuances for specific query types in official docs).<\/li>\n<li><strong>Rich querying for document stores<\/strong>: compound filtering, ordering, cursor-based pagination, and indexing.<\/li>\n<li><strong>Atomic multi-document changes<\/strong>: transactions and batched writes.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Managed durability and replication<\/strong>: no replication setup; it\u2019s a managed service based on your chosen location.<\/li>\n<li><strong>Simple capacity model<\/strong>: you scale by using the service; you don\u2019t size nodes\/instances for typical usage.<\/li>\n<li><strong>Integrated observability<\/strong>: metrics and audit logging integrate into standard Google Cloud operations tools.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/compliance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>IAM integration<\/strong>: granular access to the database at the project\/service level using roles and service accounts.<\/li>\n<li><strong>Auditability<\/strong>: Cloud Audit Logs capture administrative and data access events (depending on your configuration).<\/li>\n<li><strong>Encryption<\/strong>: encryption at rest and in transit are handled by Google; CMEK may be supported for some resources\/features\u2014verify current Firestore CMEK support in official docs if it\u2019s a requirement.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scalability\/performance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Horizontal scaling<\/strong>: designed for large request rates and large datasets, but you must design to avoid hot spots and follow documented limits.<\/li>\n<li><strong>Indexed reads<\/strong>: queries rely on indexes; well-designed indexes produce consistent performance.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should choose it<\/h3>\n\n\n\n<p>Choose Firestore in Native mode when you need:\n&#8211; A <strong>document database<\/strong> for application data (profiles, content, metadata, state).\n&#8211; A serverless operational model and fast iteration.\n&#8211; Real-time updates and offline support (especially for web\/mobile).\n&#8211; Strongly consistent document reads\/writes with flexible schema.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should not choose it<\/h3>\n\n\n\n<p>Avoid Firestore in Native mode when you need:\n&#8211; <strong>Relational joins, complex SQL<\/strong>, stored procedures, or strong relational constraints \u2192 consider <strong>Cloud SQL<\/strong> or <strong>AlloyDB<\/strong>.\n&#8211; <strong>Massive analytical scans<\/strong> and OLAP-style queries \u2192 consider <strong>BigQuery<\/strong> (and export\/ETL from Firestore as needed).\n&#8211; <strong>Very large single-row\/document payloads<\/strong> or frequent updates to the same document at high rate (hot document) \u2192 consider data model redesign, sharding, or other databases.\n&#8211; <strong>Wide-column\/time-series patterns<\/strong> at extreme throughput \u2192 consider <strong>Bigtable<\/strong>.\n&#8211; <strong>Globally distributed relational consistency<\/strong> with SQL \u2192 consider <strong>Spanner<\/strong>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">4. Where is Firestore in Native mode used?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Industries<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Consumer and B2B SaaS<\/li>\n<li>Media and content platforms<\/li>\n<li>Gaming backends<\/li>\n<li>Retail\/e-commerce (catalog metadata, carts, personalization state)<\/li>\n<li>EdTech and collaboration tools<\/li>\n<li>Healthcare and fintech for non-ledger application data (with careful compliance design)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Team types<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Mobile and web product teams<\/li>\n<li>Platform teams building internal developer platforms<\/li>\n<li>DevOps\/SRE teams supporting serverless workloads<\/li>\n<li>Data engineering teams consuming exported operational data downstream<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Workloads<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>User profiles, preferences, and app state<\/li>\n<li>Content management metadata<\/li>\n<li>Chat\/messaging metadata (with careful data model and quota planning)<\/li>\n<li>IoT device metadata and configuration (not raw telemetry streams at extreme rates)<\/li>\n<li>Event-driven workflows (as a state store, not a queue)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Architectures<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Serverless backends (Cloud Run + Firestore)<\/li>\n<li>Mobile\/web apps using Firebase client SDKs<\/li>\n<li>Microservices needing a scalable document store<\/li>\n<li>Event-driven architectures with Pub\/Sub + Cloud Functions\/Cloud Run and Firestore as state<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Real-world deployment contexts<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Production<\/strong>: multi-region (where needed) for higher resilience and lower latency across a geography; strict IAM and audit controls.<\/li>\n<li><strong>Dev\/test<\/strong>: regional, smaller dataset, tighter quotas\/budgets; sometimes use emulator workflows (verify current Firestore emulator support and features in official docs if you need parity testing).<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">5. Top Use Cases and Scenarios<\/h2>\n\n\n\n<p>Below are realistic scenarios where Firestore in Native mode fits well. Each includes the problem, why it fits, and an example.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>User profile store<\/strong>\n   &#8211; <strong>Problem<\/strong>: Store evolving profile data without frequent schema migrations.\n   &#8211; <strong>Why it fits<\/strong>: Flexible document schema, indexed lookups by user ID, simple updates.\n   &#8211; <strong>Scenario<\/strong>: A SaaS app stores user settings, feature flags, and preferences in <code>\/users\/{uid}<\/code>.<\/p>\n<\/li>\n<li>\n<p><strong>Product catalog metadata (not full-text search)<\/strong>\n   &#8211; <strong>Problem<\/strong>: Store product metadata and filter lists quickly.\n   &#8211; <strong>Why it fits<\/strong>: Document model with indexed queries by category, price range, availability.\n   &#8211; <strong>Scenario<\/strong>: <code>\/products\/{productId}<\/code> queried by <code>categoryId<\/code> + <code>inStock=true<\/code>.<\/p>\n<\/li>\n<li>\n<p><strong>Collaboration app state<\/strong>\n   &#8211; <strong>Problem<\/strong>: Multiple clients need near-real-time updates to shared objects.\n   &#8211; <strong>Why it fits<\/strong>: Real-time listeners (client SDKs) and document-level updates.\n   &#8211; <strong>Scenario<\/strong>: Shared boards, tasks, comments with updates streamed to active users.<\/p>\n<\/li>\n<li>\n<p><strong>Mobile app offline-first data<\/strong>\n   &#8211; <strong>Problem<\/strong>: Users need to work with intermittent connectivity.\n   &#8211; <strong>Why it fits<\/strong>: Client SDK offline caching and sync patterns.\n   &#8211; <strong>Scenario<\/strong>: Field agent app caches assigned tasks and syncs updates when online.<\/p>\n<\/li>\n<li>\n<p><strong>Session store and application state<\/strong>\n   &#8211; <strong>Problem<\/strong>: Track sessions and state across stateless services.\n   &#8211; <strong>Why it fits<\/strong>: Simple reads\/writes, TTL policies (if enabled) to expire sessions.\n   &#8211; <strong>Scenario<\/strong>: <code>\/sessions\/{sessionId}<\/code> with <code>expiresAt<\/code> used by the backend.<\/p>\n<\/li>\n<li>\n<p><strong>Multi-tenant SaaS configuration<\/strong>\n   &#8211; <strong>Problem<\/strong>: Keep per-tenant settings and integration metadata.\n   &#8211; <strong>Why it fits<\/strong>: Hierarchical collections, straightforward tenant partitioning.\n   &#8211; <strong>Scenario<\/strong>: <code>\/tenants\/{tenantId}\/settings\/main<\/code> and <code>\/tenants\/{tenantId}\/integrations\/{id}<\/code>.<\/p>\n<\/li>\n<li>\n<p><strong>Workflow orchestration state (lightweight)<\/strong>\n   &#8211; <strong>Problem<\/strong>: Track workflow progress and idempotency keys.\n   &#8211; <strong>Why it fits<\/strong>: Atomic writes\/transactions, simple status documents.\n   &#8211; <strong>Scenario<\/strong>: A Cloud Run service writes <code>\/jobs\/{jobId}<\/code> with status transitions.<\/p>\n<\/li>\n<li>\n<p><strong>IoT device registry and configuration<\/strong>\n   &#8211; <strong>Problem<\/strong>: Manage device metadata and desired configuration state.\n   &#8211; <strong>Why it fits<\/strong>: Document per device; indexed queries by fleet\/site.\n   &#8211; <strong>Scenario<\/strong>: <code>\/devices\/{deviceId}<\/code> stores firmware version, site ID, and desired config.<\/p>\n<\/li>\n<li>\n<p><strong>Gaming player inventory and matchmaking metadata<\/strong>\n   &#8211; <strong>Problem<\/strong>: Fast access to player data and matchmaking queues metadata.\n   &#8211; <strong>Why it fits<\/strong>: Low-latency reads, transactions for inventory updates.\n   &#8211; <strong>Scenario<\/strong>: <code>\/players\/{id}<\/code> and <code>\/matches\/{matchId}<\/code> with transactional updates.<\/p>\n<\/li>\n<li>\n<p><strong>Notification preferences and routing<\/strong>\n   &#8211; <strong>Problem<\/strong>: Store per-user channel preferences and subscription topics.\n   &#8211; <strong>Why it fits<\/strong>: Document updates and queries by user or segment.\n   &#8211; <strong>Scenario<\/strong>: <code>\/users\/{uid}\/notificationSettings\/current<\/code>.<\/p>\n<\/li>\n<li>\n<p><strong>Content moderation metadata<\/strong>\n   &#8211; <strong>Problem<\/strong>: Track moderation status, reviewer notes, and flags.\n   &#8211; <strong>Why it fits<\/strong>: Flexible fields and audit-friendly updates, plus export for analytics.\n   &#8211; <strong>Scenario<\/strong>: <code>\/content\/{id}<\/code> with <code>status<\/code>, <code>flags[]<\/code>, <code>reviewedBy<\/code>, <code>reviewedAt<\/code>.<\/p>\n<\/li>\n<li>\n<p><strong>Feature flag targeting (simple rules)<\/strong>\n   &#8211; <strong>Problem<\/strong>: Roll out features based on user segments.\n   &#8211; <strong>Why it fits<\/strong>: Quick lookups and updates; can be cached at the edge.\n   &#8211; <strong>Scenario<\/strong>: <code>\/flags\/{flagId}<\/code> and <code>\/segments\/{segmentId}<\/code> used by an API.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">6. Core Features<\/h2>\n\n\n\n<p>This section focuses on current, commonly used Firestore in Native mode features. Where a feature\u2019s availability can vary by SDK, plan, or release stage, verify in official docs.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">6.1 Document and collection data model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Stores data as documents in collections; supports nested objects and arrays.<\/li>\n<li><strong>Why it matters<\/strong>: Fits application domain models naturally; avoids rigid schemas.<\/li>\n<li><strong>Practical benefit<\/strong>: You can ship new fields without migrations.<\/li>\n<li><strong>Caveats<\/strong>: Document size limits apply (commonly cited as 1 MiB per document\u2014verify current limits: https:\/\/cloud.google.com\/firestore\/quotas).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.2 Subcollections and hierarchical modeling<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Lets documents contain subcollections for nested organization.<\/li>\n<li><strong>Why it matters<\/strong>: Natural modeling for one-to-many relationships.<\/li>\n<li><strong>Practical benefit<\/strong>: <code>\/tenants\/{tenantId}\/users\/{userId}<\/code> style partitioning.<\/li>\n<li><strong>Caveats<\/strong>: Queries don\u2019t \u201cjoin\u201d across collections; you may need denormalization.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.3 Automatic indexing (single-field)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Automatically indexes individual fields by default.<\/li>\n<li><strong>Why it matters<\/strong>: Most simple queries work without manual index management.<\/li>\n<li><strong>Practical benefit<\/strong>: Faster prototyping; predictable query performance.<\/li>\n<li><strong>Caveats<\/strong>: Index storage and write amplification can affect cost; consider excluding fields from indexing if supported\/appropriate (verify indexing controls in docs).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.4 Composite indexes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Enables queries combining multiple filters\/orderings that require composite indexes.<\/li>\n<li><strong>Why it matters<\/strong>: Many production queries need composite indexes to be efficient and valid.<\/li>\n<li><strong>Practical benefit<\/strong>: Supports multi-criteria filtering like <code>status == \"open\"<\/code> plus <code>orderBy(priority)<\/code>.<\/li>\n<li><strong>Caveats<\/strong>: You must manage index definitions; excessive indexes increase storage and write cost.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.5 Collection group queries<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Queries across all collections\/subcollections with the same name.<\/li>\n<li><strong>Why it matters<\/strong>: Useful for multi-tenant or hierarchical designs.<\/li>\n<li><strong>Practical benefit<\/strong>: Query <code>comments<\/code> across all posts.<\/li>\n<li><strong>Caveats<\/strong>: Requires appropriate indexing; can be expensive if broad.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.6 Transactions<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Atomically read and write multiple documents.<\/li>\n<li><strong>Why it matters<\/strong>: Ensures correctness for counters, inventory, state transitions.<\/li>\n<li><strong>Practical benefit<\/strong>: Prevent overselling inventory by checking and decrementing in one transaction.<\/li>\n<li><strong>Caveats<\/strong>: Transactions have limits (reads\/writes per transaction, contention). Hot documents can cause retries and latency.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.7 Batched writes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Apply multiple writes as a single atomic batch (all succeed or fail).<\/li>\n<li><strong>Why it matters<\/strong>: Efficient updates without complex transaction logic.<\/li>\n<li><strong>Practical benefit<\/strong>: Create user + default settings + audit entry in one batch.<\/li>\n<li><strong>Caveats<\/strong>: Batch size limits exist (commonly 500 operations\u2014verify current limits).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.8 Server timestamps and atomic field transforms<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Set server-side timestamps; update numeric fields with increments; array union\/remove, etc.<\/li>\n<li><strong>Why it matters<\/strong>: Avoids client clock skew and race conditions.<\/li>\n<li><strong>Practical benefit<\/strong>: Increment view counters safely (within contention limits).<\/li>\n<li><strong>Caveats<\/strong>: High-frequency counter updates can hotspot; use sharded counters pattern.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.9 Real-time listeners (client SDK feature)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Subscribes clients to query or document changes and pushes updates.<\/li>\n<li><strong>Why it matters<\/strong>: Enables collaborative UX without polling.<\/li>\n<li><strong>Practical benefit<\/strong>: Live chat UI or live dashboard updates.<\/li>\n<li><strong>Caveats<\/strong>: Listener costs map to reads; careful query scoping is critical to control cost.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.10 Offline persistence (client SDK feature)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Caches data locally and syncs when connectivity returns.<\/li>\n<li><strong>Why it matters<\/strong>: Better user experience for mobile\/field scenarios.<\/li>\n<li><strong>Practical benefit<\/strong>: Users can edit drafts offline.<\/li>\n<li><strong>Caveats<\/strong>: Conflict resolution and eventual sync need design; verify SDK-specific behavior.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.11 Import\/export (operational data movement)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Export Firestore data to Cloud Storage and import it back.<\/li>\n<li><strong>Why it matters<\/strong>: Backup, migration, and environment cloning.<\/li>\n<li><strong>Practical benefit<\/strong>: Nightly exports to a secure bucket for recovery and analytics staging.<\/li>\n<li><strong>Caveats<\/strong>: Exports are not the same as continuous replication; restore processes must be tested.<\/li>\n<\/ul>\n\n\n\n<p>Official guidance (export\/import):\n&#8211; https:\/\/cloud.google.com\/firestore\/docs\/manage-data\/export-import<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">6.12 Time-to-live (TTL) policies (if enabled for your use case)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Automatically deletes documents after a timestamp field passes a threshold.<\/li>\n<li><strong>Why it matters<\/strong>: Reduces storage cost and meets data retention requirements.<\/li>\n<li><strong>Practical benefit<\/strong>: Auto-expire sessions, ephemeral tokens, temporary logs.<\/li>\n<li><strong>Caveats<\/strong>: TTL deletion is not an immediate \u201cat exactly this second\u201d guarantee; verify semantics in official docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.13 Integration with Google Cloud IAM and service accounts<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does<\/strong>: Authorizes server workloads via IAM.<\/li>\n<li><strong>Why it matters<\/strong>: Consistent enterprise access control and auditability.<\/li>\n<li><strong>Practical benefit<\/strong>: Cloud Run service uses a dedicated service account with least privilege.<\/li>\n<li><strong>Caveats<\/strong>: IAM is not document-row-level; fine-grained client authorization typically uses Security Rules patterns.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">7. Architecture and How It Works<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">High-level architecture<\/h3>\n\n\n\n<p>Firestore in Native mode is a managed database service accessed via Google APIs. Your application (client or server) sends API requests to Firestore endpoints. Firestore evaluates authentication\/authorization (IAM for server calls; Security Rules for certain client patterns), executes indexed queries and document operations, and returns results.<\/p>\n\n\n\n<p>Key ideas:\n&#8211; <strong>Data path<\/strong>: app \u2192 Firestore API \u2192 indexes\/storage \u2192 response.\n&#8211; <strong>Control\/management path<\/strong>: admins define indexes, security, exports, monitoring, and IAM policies.\n&#8211; <strong>Index-driven queries<\/strong>: most queries require index support; composite indexes are sometimes mandatory.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Request\/data\/control flow<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Authentication<\/strong>\n   &#8211; Server-side: service account credentials (Application Default Credentials, workload identity, etc.).\n   &#8211; Client-side: typically Firebase Authentication tokens (when using Firebase client SDK + security rules).<\/li>\n<li><strong>Authorization<\/strong>\n   &#8211; IAM checks for Google Cloud identities\/service accounts.\n   &#8211; Security rules evaluation for client SDK access patterns (if configured\/used).<\/li>\n<li><strong>Operation execution<\/strong>\n   &#8211; Document read\/write\/delete.\n   &#8211; Query execution using indexes.<\/li>\n<li><strong>Observability<\/strong>\n   &#8211; Audit logs capture administrative actions (and optionally data access logs depending on configuration).\n   &#8211; Metrics flow to Cloud Monitoring.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Common integrations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Cloud Run<\/strong>: REST APIs that read\/write Firestore documents.<\/li>\n<li><strong>Cloud Functions<\/strong>: event-driven business logic (verify current Firestore-trigger support and recommended patterns in official docs).<\/li>\n<li><strong>Pub\/Sub<\/strong>: decouple write-heavy ingestion from downstream processing.<\/li>\n<li><strong>Cloud Storage<\/strong>: import\/export destination for backups and migrations.<\/li>\n<li><strong>BigQuery\/Dataflow<\/strong>: analytics pipelines from exported data.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Dependency services<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Google Cloud project + billing<\/strong><\/li>\n<li><strong>Firestore API enabled<\/strong><\/li>\n<li><strong>IAM + service accounts<\/strong><\/li>\n<li><strong>Cloud Logging \/ Monitoring<\/strong> (for ops)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/authentication model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>IAM<\/strong>: controls which identities can access Firestore APIs.<\/li>\n<li><strong>Security Rules<\/strong>: designed for client access control (commonly with Firebase); rules can enforce per-document\/field logic patterns.<\/li>\n<li><strong>Principle of least privilege<\/strong>: use dedicated service accounts per workload.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Networking model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Firestore is accessed via Google APIs over HTTPS.<\/li>\n<li>From VPC-based workloads, you can use:<\/li>\n<li><strong>Private Google Access<\/strong> (for private IP instances reaching Google APIs without public IP).<\/li>\n<li><strong>restricted.googleapis.com<\/strong> endpoints and <strong>VPC Service Controls<\/strong> (for exfiltration protection and perimeter controls).<\/li>\n<li>Firestore is not \u201cin your VPC\u201d in the same sense as self-managed databases. Network egress charges can apply depending on access patterns and locations.<\/li>\n<\/ul>\n\n\n\n<p>Verify networking options:\n&#8211; Private Google Access: https:\/\/cloud.google.com\/vpc\/docs\/private-google-access\n&#8211; VPC Service Controls: https:\/\/cloud.google.com\/vpc-service-controls\/docs\/overview<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Monitoring\/logging\/governance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use <strong>Cloud Monitoring<\/strong> to watch request latency, error rates, and resource usage metrics exposed by Firestore.<\/li>\n<li>Use <strong>Cloud Logging<\/strong> and <strong>Cloud Audit Logs<\/strong> for change tracking and security investigations.<\/li>\n<li>Use <strong>labels\/tags<\/strong> at the project level and consistent resource naming for governance.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Simple architecture diagram (Mermaid)<\/h4>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart LR\n  A[Web\/Mobile App or Backend Service] --&gt;|HTTPS + Auth| B[Firestore in Native mode]\n  B --&gt; C[Index + Storage Managed by Google]\n  A --&gt; D[Cloud Logging \/ Cloud Monitoring]\n  B --&gt; D\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Production-style architecture diagram (Mermaid)<\/h4>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart TB\n  subgraph Clients\n    W[Web App]\n    M[Mobile App]\n  end\n\n  subgraph GoogleCloud[Google Cloud Project]\n    CR[Cloud Run API Service\\n(service account)]\n    PUB[Pub\/Sub]\n    CF[Cloud Functions \/ Cloud Run Jobs\\n(optional consumers)]\n    FS[Firestore in Native mode]\n    GCS[Cloud Storage\\n(Exports\/Backups)]\n    SM[Secret Manager]\n    MON[Cloud Monitoring]\n    LOG[Cloud Logging]\n    AUD[Cloud Audit Logs]\n    VPCSC[VPC Service Controls\\n(optional perimeter)]\n  end\n\n  W --&gt;|OAuth\/Firebase Auth token| CR\n  M --&gt;|OAuth\/Firebase Auth token| CR\n\n  CR --&gt;|IAM Auth (service account)| FS\n  CR --&gt; PUB\n  PUB --&gt; CF\n  CF --&gt; FS\n\n  FS --&gt;|Export\/Import| GCS\n\n  CR --&gt; SM\n  CR --&gt; LOG\n  FS --&gt; LOG\n  FS --&gt; MON\n  FS --&gt; AUD\n\n  VPCSC -. optional controls .- CR\n  VPCSC -. optional controls .- FS\n  VPCSC -. optional controls .- GCS\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">8. Prerequisites<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Google Cloud requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A <strong>Google Cloud account<\/strong> and a <strong>Google Cloud project<\/strong>.<\/li>\n<li><strong>Billing enabled<\/strong> on the project (required for paid usage; some free quotas may exist depending on your plan\u2014verify on the pricing page).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Permissions \/ IAM roles<\/h3>\n\n\n\n<p>You need permissions to:\n&#8211; Enable APIs\n&#8211; Create and manage Firestore databases\n&#8211; Read\/write Firestore data during the lab<\/p>\n\n\n\n<p>Common roles (verify exact role names and suitability for your org):\n&#8211; <code>roles\/owner<\/code> (broad; simplest for personal labs)\n&#8211; More scoped:\n  &#8211; Firestore\/Datastore admin permissions (often under Datastore roles historically)\n  &#8211; Service Usage Admin to enable APIs\n  &#8211; Security Admin\/IAM Admin if you are creating service accounts<\/p>\n\n\n\n<p>Start with least privilege in production. For lab simplicity, Project Owner is acceptable on a disposable project.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Tools<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Google Cloud Console<\/strong> (web UI)<\/li>\n<li><strong>gcloud CLI<\/strong> (Cloud Shell includes it): https:\/\/cloud.google.com\/sdk\/docs\/install<\/li>\n<li>A runtime for sample code:<\/li>\n<li><strong>Python 3.10+<\/strong> (Cloud Shell typically has Python)<\/li>\n<li>Or Node.js\/Java\/Go (choose one)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">APIs to enable<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Firestore API (and potentially related service usage APIs)<\/li>\n<li>Firestore API: <code>firestore.googleapis.com<\/code><\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Region\/location availability<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Choose a Firestore location available to your project.<\/li>\n<li>Decide between <strong>regional<\/strong> vs <strong>multi-region<\/strong> based on latency and availability requirements.<\/li>\n<\/ul>\n\n\n\n<p>Location reference:\n&#8211; https:\/\/cloud.google.com\/firestore\/docs\/locations<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas\/limits to be aware of<\/h3>\n\n\n\n<p>Firestore has quotas for:\n&#8211; Request rates\n&#8211; Document sizes\n&#8211; Index limits\n&#8211; Transaction\/batch operation counts\n&#8211; Hotspotting constraints (e.g., frequent writes to same document)<\/p>\n\n\n\n<p>Always check current quotas before production:\n&#8211; https:\/\/cloud.google.com\/firestore\/quotas<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Prerequisite services (optional but common)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Logging\/Monitoring (enabled by default in most projects)<\/li>\n<li>Cloud Storage (for export\/import)<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">9. Pricing \/ Cost<\/h2>\n\n\n\n<p>Firestore in Native mode pricing is <strong>usage-based<\/strong>. Exact prices vary by location (regional vs multi-region) and can change over time. Do not rely on third-party numbers\u2014use official pricing.<\/p>\n\n\n\n<p>Official pricing:\n&#8211; https:\/\/cloud.google.com\/firestore\/pricing<br\/>\nPricing calculator:\n&#8211; https:\/\/cloud.google.com\/products\/calculator<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing dimensions (common)<\/h3>\n\n\n\n<p>Firestore in Native mode typically charges for:\n1. <strong>Document operations<\/strong>\n   &#8211; <strong>Reads<\/strong>\n   &#8211; <strong>Writes<\/strong>\n   &#8211; <strong>Deletes<\/strong>\n   Billing is based on the number of document operations, not the payload size alone.\n2. <strong>Storage<\/strong>\n   &#8211; Data storage for documents\n   &#8211; Index storage (can be a substantial portion depending on indexing)\n3. <strong>Network egress<\/strong>\n   &#8211; Data leaving Google Cloud\/Firestore to the internet or other regions (depends on architecture and client location)\n4. <strong>Backups\/export storage<\/strong>\n   &#8211; If you export to Cloud Storage, you pay for bucket storage and any egress.<\/p>\n\n\n\n<blockquote>\n<p>Free tier: Firestore has offered free quotas in some contexts (often associated with Firebase plans). Availability, limits, and applicability can differ. <strong>Verify current free tier details on the official pricing page<\/strong>.<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Cost drivers (what usually makes bills grow)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>High read volumes from:<\/li>\n<li>Real-time listeners on broad queries<\/li>\n<li>Poor pagination patterns (re-reading many documents)<\/li>\n<li>Fan-out patterns in the app<\/li>\n<li>High write volumes from:<\/li>\n<li>Event ingestion without buffering<\/li>\n<li>Over-indexing (writes update multiple indexes)<\/li>\n<li>Large index footprint:<\/li>\n<li>Many composite indexes<\/li>\n<li>Many indexed fields with high cardinality<\/li>\n<li>Cross-region traffic:<\/li>\n<li>Clients far from the database location<\/li>\n<li>Multi-region deployments with services in different regions<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Hidden or indirect costs<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Index write amplification<\/strong>: each write may update multiple indexes.<\/li>\n<li><strong>Export\/import<\/strong>: Cloud Storage costs plus operations time.<\/li>\n<li><strong>Client-driven access<\/strong>: poor client query design can explode reads.<\/li>\n<li><strong>Observability<\/strong>: Logging ingestion costs can rise in high-traffic apps.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network\/data transfer implications<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>If mobile\/web clients connect over the public internet, egress from Firestore responses can be charged depending on the destination and pricing rules.<\/li>\n<li>If your compute is in a different region than your Firestore location, you may pay inter-region network costs and see higher latency.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How to optimize cost (practical)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Minimize reads<\/strong>:<\/li>\n<li>Use precise document gets when possible.<\/li>\n<li>Paginate queries properly.<\/li>\n<li>Avoid wide real-time listeners; scope listeners to small subsets.<\/li>\n<li><strong>Minimize index overhead<\/strong>:<\/li>\n<li>Don\u2019t create composite indexes \u201cjust in case.\u201d<\/li>\n<li>Evaluate whether all fields must be indexed (verify index configuration options).<\/li>\n<li><strong>Write efficiently<\/strong>:<\/li>\n<li>Use batched writes where appropriate.<\/li>\n<li>Reduce write frequency for hot documents; use sharded counters.<\/li>\n<li><strong>Choose the right location<\/strong>:<\/li>\n<li>Keep Firestore near your primary user base and compute.<\/li>\n<li><strong>Cache where appropriate<\/strong>:<\/li>\n<li>Cache stable data in Cloud CDN\/edge or in-memory caches (e.g., Memorystore) for read-heavy endpoints.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Example low-cost starter estimate (conceptual)<\/h3>\n\n\n\n<p>A small dev\/test app might have:\n&#8211; A few thousand document reads\/day\n&#8211; A few hundred writes\/day\n&#8211; Under 1 GB total storage including indexes\n&#8211; Minimal exports<\/p>\n\n\n\n<p>Cost is often low, but it depends entirely on your region pricing and whether you have free quotas. Use the calculator with:\n&#8211; Expected monthly reads\/writes\/deletes\n&#8211; Estimated storage and index growth\n&#8211; Any export storage costs<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Example production cost considerations (what to model)<\/h3>\n\n\n\n<p>For production, model:\n&#8211; Peak QPS reads\/writes (and how they translate to document operations)\n&#8211; Average document size and index size ratio\n&#8211; Number of active real-time listeners and their query scope\n&#8211; Data growth (documents\/day) and retention (TTL)\n&#8211; Export frequency (daily\/weekly) and bucket storage retention\n&#8211; Expected egress patterns (client geography)<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">10. Step-by-Step Hands-On Tutorial<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Objective<\/h3>\n\n\n\n<p>Create and use <strong>Firestore in Native mode<\/strong> in a Google Cloud project, then perform basic document operations (create\/read\/query\/update) from a small Python app using secure authentication, and finally clean up safely.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Lab Overview<\/h3>\n\n\n\n<p>You will:\n1. Create (or select) a Google Cloud project and enable the Firestore API.\n2. Create a Firestore database in <strong>Native mode<\/strong> in a chosen location.\n3. Use Cloud Shell and Python to:\n   &#8211; Write documents\n   &#8211; Read a document\n   &#8211; Run a query\n   &#8211; Run a transaction\n4. Validate results in the Google Cloud Console.\n5. Clean up (recommended: delete the project if it\u2019s a lab-only project).<\/p>\n\n\n\n<blockquote>\n<p>Cost note: This lab is designed to be low-cost, but any paid usage depends on your pricing plan and region. Keep usage minimal and clean up afterward.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Create\/select a Google Cloud project and set it in Cloud Shell<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open Google Cloud Console: https:\/\/console.cloud.google.com\/<\/li>\n<li>Open <strong>Cloud Shell<\/strong> (top-right terminal icon).<\/li>\n<li>Set your project ID:<\/li>\n<\/ol>\n\n\n\n<pre><code class=\"language-bash\">gcloud config set project YOUR_PROJECT_ID\n<\/code><\/pre>\n\n\n\n<ol class=\"wp-block-list\" start=\"4\">\n<li>Confirm:<\/li>\n<\/ol>\n\n\n\n<pre><code class=\"language-bash\">gcloud config get-value project\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome<\/strong>: Cloud Shell shows your intended project ID.<\/p>\n\n\n\n<p><strong>Verification tip<\/strong>: In the console project selector, confirm you\u2019re in the same project.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Enable the Firestore API<\/h3>\n\n\n\n<p>Enable the Firestore API:<\/p>\n\n\n\n<pre><code class=\"language-bash\">gcloud services enable firestore.googleapis.com\n<\/code><\/pre>\n\n\n\n<p>(Optional) Confirm it\u2019s enabled:<\/p>\n\n\n\n<pre><code class=\"language-bash\">gcloud services list --enabled --filter=\"name:firestore.googleapis.com\"\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome<\/strong>: The Firestore API appears in the enabled services list.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Create a Firestore database in Native mode<\/h3>\n\n\n\n<p>Firestore databases are created in a specific <strong>location<\/strong> and <strong>mode<\/strong>. For this tutorial, use <strong>Native mode<\/strong>.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p>Choose a location:\n   &#8211; Regional example: <code>us-central1<\/code>\n   &#8211; Multi-region examples exist (names vary). Verify current available locations:<\/p>\n<ul>\n<li>https:\/\/cloud.google.com\/firestore\/docs\/locations<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>Create the database.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<blockquote>\n<p>Command note: The <code>gcloud firestore databases create<\/code> flags can evolve. If any flag differs, rely on <code>gcloud firestore databases create --help<\/code> and official docs.<\/p>\n<\/blockquote>\n\n\n\n<p>Run:<\/p>\n\n\n\n<pre><code class=\"language-bash\">gcloud firestore databases create \\\n  --database=\"(default)\" \\\n  --location=\"us-central1\" \\\n  --type=\"firestore-native\"\n<\/code><\/pre>\n\n\n\n<p>If your org requires a different location, replace <code>us-central1<\/code>.<\/p>\n\n\n\n<ol class=\"wp-block-list\" start=\"3\">\n<li>Verify database list:<\/li>\n<\/ol>\n\n\n\n<pre><code class=\"language-bash\">gcloud firestore databases list\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome<\/strong>: You see a database entry (commonly <code>(default)<\/code>) with type indicating Native mode.<\/p>\n\n\n\n<p><strong>Console verification<\/strong>:\n&#8211; Go to <strong>Google Cloud Console \u2192 Firestore<\/strong>\n&#8211; Confirm the database exists and is in <strong>Native mode<\/strong>.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Create a Python environment and install the Firestore client library<\/h3>\n\n\n\n<p>In Cloud Shell:<\/p>\n\n\n\n<pre><code class=\"language-bash\">python3 -m venv .venv\nsource .venv\/bin\/activate\npip install --upgrade pip\npip install google-cloud-firestore\n<\/code><\/pre>\n\n\n\n<p>Set your project environment variable:<\/p>\n\n\n\n<pre><code class=\"language-bash\">export GOOGLE_CLOUD_PROJECT=\"$(gcloud config get-value project)\"\necho \"$GOOGLE_CLOUD_PROJECT\"\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome<\/strong>: The library installs successfully, and the project variable prints your project ID.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Write and read documents (Python)<\/h3>\n\n\n\n<p>Create a file:<\/p>\n\n\n\n<pre><code class=\"language-bash\">cat &gt; firestore_lab.py &lt;&lt;'PY'\nimport os\nfrom google.cloud import firestore\nfrom google.api_core.exceptions import NotFound\n\nproject_id = os.environ.get(\"GOOGLE_CLOUD_PROJECT\")\nif not project_id:\n    raise RuntimeError(\"GOOGLE_CLOUD_PROJECT is not set\")\n\n# Uses Application Default Credentials in Cloud Shell\ndb = firestore.Client(project=project_id)\n\ndef put_sample_data():\n    users = db.collection(\"users\")\n\n    users.document(\"alice\").set({\n        \"name\": \"Alice\",\n        \"role\": \"admin\",\n        \"active\": True,\n        \"score\": 10,\n        \"tags\": [\"alpha\", \"internal\"]\n    })\n\n    users.document(\"bob\").set({\n        \"name\": \"Bob\",\n        \"role\": \"user\",\n        \"active\": True,\n        \"score\": 3,\n        \"tags\": [\"beta\"]\n    })\n\n    users.document(\"carol\").set({\n        \"name\": \"Carol\",\n        \"role\": \"user\",\n        \"active\": False,\n        \"score\": 7,\n        \"tags\": []\n    })\n\ndef get_user(user_id: str):\n    doc_ref = db.collection(\"users\").document(user_id)\n    snap = doc_ref.get()\n    if not snap.exists:\n        raise NotFound(f\"{user_id} not found\")\n    return snap.id, snap.to_dict()\n\ndef query_active_users_min_score(min_score: int):\n    q = (\n        db.collection(\"users\")\n        .where(\"active\", \"==\", True)\n        .where(\"score\", \"&gt;=\", min_score)\n        .order_by(\"score\", direction=firestore.Query.DESCENDING)\n        .limit(10)\n    )\n    return [(d.id, d.to_dict()) for d in q.stream()]\n\ndef transaction_promote_user(user_id: str):\n    doc_ref = db.collection(\"users\").document(user_id)\n\n    @firestore.transactional\n    def _txn(txn: firestore.Transaction):\n        snap = doc_ref.get(transaction=txn)\n        if not snap.exists:\n            raise NotFound(f\"{user_id} not found\")\n        data = snap.to_dict()\n        new_score = int(data.get(\"score\", 0)) + 5\n        txn.update(doc_ref, {\"role\": \"power_user\", \"score\": new_score})\n        return new_score\n\n    txn = db.transaction()\n    return _txn(txn)\n\nif __name__ == \"__main__\":\n    put_sample_data()\n    uid, alice = get_user(\"alice\")\n    print(\"Read:\", uid, alice)\n\n    results = query_active_users_min_score(5)\n    print(\"Query results:\")\n    for rid, rdata in results:\n        print(\" -\", rid, rdata)\n\n    new_score = transaction_promote_user(\"bob\")\n    print(\"Transaction updated bob score to:\", new_score)\n\n    uid, bob = get_user(\"bob\")\n    print(\"Read after txn:\", uid, bob)\nPY\n<\/code><\/pre>\n\n\n\n<p>Run it:<\/p>\n\n\n\n<pre><code class=\"language-bash\">python firestore_lab.py\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome<\/strong>: Output shows:\n&#8211; \u201cRead: alice \u2026\u201d\n&#8211; Query results for active users with score \u2265 5\n&#8211; Transaction updated Bob\u2019s score and role\n&#8211; Updated Bob document printed at the end<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: Verify in the Google Cloud Console<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open <strong>Google Cloud Console \u2192 Firestore<\/strong>.<\/li>\n<li>In the data viewer, confirm:\n   &#8211; Collection: <code>users<\/code>\n   &#8211; Documents: <code>alice<\/code>, <code>bob<\/code>, <code>carol<\/code>\n   &#8211; Bob\u2019s <code>role<\/code> updated to <code>power_user<\/code> and <code>score<\/code> increased by 5.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome<\/strong>: The console shows the same data your script printed.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 7 (Optional): Export data to Cloud Storage (backup pattern)<\/h3>\n\n\n\n<p>This step is optional but demonstrates a real operational action. It can incur Cloud Storage costs.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Create a bucket (choose a unique name):<\/li>\n<\/ol>\n\n\n\n<pre><code class=\"language-bash\">export BUCKET=\"gs:\/\/YOUR_UNIQUE_BUCKET_NAME\"\ngcloud storage buckets create \"$BUCKET\" --location=us-central1\n<\/code><\/pre>\n\n\n\n<ol class=\"wp-block-list\" start=\"2\">\n<li>Export Firestore:<\/li>\n<\/ol>\n\n\n\n<pre><code class=\"language-bash\">gcloud firestore export \"$BUCKET\/firestore-exports\/$(date +%Y%m%d-%H%M%S)\"\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome<\/strong>: Command prints an operation and completes successfully.<\/p>\n\n\n\n<p><strong>Verification<\/strong>:<\/p>\n\n\n\n<pre><code class=\"language-bash\">gcloud storage ls \"$BUCKET\/firestore-exports\/\"\n<\/code><\/pre>\n\n\n\n<p>You should see exported files.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Validation<\/h3>\n\n\n\n<p>Run these checks:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Database exists:<\/li>\n<\/ol>\n\n\n\n<pre><code class=\"language-bash\">gcloud firestore databases list\n<\/code><\/pre>\n\n\n\n<ol class=\"wp-block-list\" start=\"2\">\n<li>\n<p>Data exists (console):\n&#8211; Firestore \u2192 <code>users<\/code> collection visible with 3 docs<\/p>\n<\/li>\n<li>\n<p>Script runs without errors and prints expected results.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Troubleshooting<\/h3>\n\n\n\n<p>Common issues and fixes:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong><code>PERMISSION_DENIED<\/code> when running the Python script<\/strong>\n   &#8211; Cause: your identity lacks Firestore permissions, or ADC is not set up.\n   &#8211; Fix:<\/p>\n<ul>\n<li>Ensure you\u2019re running in the correct project: <code>gcloud config get-value project<\/code><\/li>\n<li>In Cloud Shell, ADC usually works automatically. If needed:\n   <code>bash\n   gcloud auth application-default login<\/code><\/li>\n<li>Confirm your user has appropriate roles (Project Owner for lab simplicity).<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong><code>NOT_FOUND: The database (default) does not exist<\/code><\/strong>\n   &#8211; Cause: Firestore database not created, or created in another project.\n   &#8211; Fix:<\/p>\n<ul>\n<li>Confirm project: <code>gcloud config get-value project<\/code><\/li>\n<li>List databases: <code>gcloud firestore databases list<\/code><\/li>\n<li>Create database again in the correct project.<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>Location errors during database creation<\/strong>\n   &#8211; Cause: invalid\/unsupported location string.\n   &#8211; Fix:<\/p>\n<ul>\n<li>Use a valid location from official docs:\n   https:\/\/cloud.google.com\/firestore\/docs\/locations<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>Query errors requiring an index<\/strong>\n   &#8211; Cause: certain compound queries require composite indexes.\n   &#8211; Fix:<\/p>\n<ul>\n<li>Follow the error message link to create the required index in console.<\/li>\n<li>Or define indexes using recommended tooling (verify current approach in docs).<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>Export fails<\/strong>\n   &#8211; Cause: insufficient permissions to bucket or missing API enablement.\n   &#8211; Fix:<\/p>\n<ul>\n<li>Ensure Storage permissions for your identity.<\/li>\n<li>Ensure the bucket is in the same project and you can write to it.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Cleanup<\/h3>\n\n\n\n<p>To avoid ongoing costs, choose one:<\/p>\n\n\n\n<p><strong>Option A (recommended for labs): Delete the entire project<\/strong>\n&#8211; Console: IAM &amp; Admin \u2192 Manage resources \u2192 select project \u2192 <strong>Delete<\/strong>\n&#8211; Or (use with care):<\/p>\n\n\n\n<pre><code class=\"language-bash\">gcloud projects delete YOUR_PROJECT_ID\n<\/code><\/pre>\n\n\n\n<p><strong>Option B: Keep project, delete lab data<\/strong>\n&#8211; Delete documents manually in console (Firestore UI), or write a cleanup script.\n&#8211; If you created a bucket, delete it:<\/p>\n\n\n\n<pre><code class=\"language-bash\">gcloud storage rm -r \"gs:\/\/YOUR_UNIQUE_BUCKET_NAME\"\n<\/code><\/pre>\n\n\n\n<blockquote>\n<p>Note: Firestore database deletion behavior and commands can vary; if you need to remove the database itself, verify the currently supported method in official docs or <code>gcloud firestore databases --help<\/code>.<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">11. Best Practices<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Architecture best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Model for your queries<\/strong>: In document databases, schema design follows query patterns.<\/li>\n<li><strong>Denormalize intentionally<\/strong>: Duplicate small pieces of data to avoid multi-step reads.<\/li>\n<li><strong>Avoid hot documents<\/strong>: Don\u2019t update the same document at very high frequency; use sharded counters or partitioned write patterns.<\/li>\n<li><strong>Use subcollections strategically<\/strong>: Keep documents reasonably sized; use subcollections for unbounded lists.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">IAM\/security best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Dedicated service accounts per workload<\/strong> (Cloud Run, GKE services).<\/li>\n<li><strong>Least privilege<\/strong>:<\/li>\n<li>Read-only services get viewer-style permissions.<\/li>\n<li>Write services get user-style permissions.<\/li>\n<li><strong>Separate projects\/environments<\/strong>: dev\/test\/prod isolation reduces blast radius.<\/li>\n<li><strong>Use security rules for client apps<\/strong> when applicable; never embed service account keys in mobile\/web apps.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cost best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Control read amplification<\/strong>:<\/li>\n<li>Use narrow queries and pagination.<\/li>\n<li>Be careful with real-time listeners on large collections.<\/li>\n<li><strong>Index governance<\/strong>:<\/li>\n<li>Only add composite indexes you truly need.<\/li>\n<li>Periodically review index usage and remove unused composite indexes (after confirming they\u2019re not needed).<\/li>\n<li><strong>TTL for ephemeral data<\/strong> (where supported) to reduce retention\/storage.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Performance best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Use document IDs for direct lookups<\/strong> whenever possible.<\/li>\n<li><strong>Batch writes<\/strong> for multi-document updates.<\/li>\n<li><strong>Paginate<\/strong> using cursors (e.g., <code>startAfter<\/code>) rather than offset-like patterns.<\/li>\n<li><strong>Keep documents small<\/strong> and avoid frequently rewriting large nested objects.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Reliability best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Choose location based on RTO\/RPO<\/strong>:<\/li>\n<li>Multi-region for higher resilience and broader latency distribution.<\/li>\n<li>Regional for simpler cost profile and locality.<\/li>\n<li><strong>Regular exports<\/strong> to Cloud Storage and periodic restore tests.<\/li>\n<li><strong>Idempotent write patterns<\/strong> for retry-safe backend operations.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operations best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Monitor<\/strong>:<\/li>\n<li>Error rates (permission denied, deadline exceeded)<\/li>\n<li>Latency<\/li>\n<li>Operation volume (reads\/writes)<\/li>\n<li><strong>Alerting<\/strong>:<\/li>\n<li>Budget alerts (billing)<\/li>\n<li>Spikes in reads\/writes<\/li>\n<li>Elevated error rates<\/li>\n<li><strong>Audit logging<\/strong>:<\/li>\n<li>Enable and retain logs per compliance needs.<\/li>\n<li><strong>Runbooks<\/strong>:<\/li>\n<li>Index creation workflow<\/li>\n<li>Incident response for permission or quota events<\/li>\n<li>Restore procedures<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Governance\/tagging\/naming best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use consistent naming for:<\/li>\n<li>Collections (<code>users<\/code>, <code>orders<\/code>, <code>tenants<\/code>)<\/li>\n<li>Document IDs (stable, deterministic when possible)<\/li>\n<li>Use projects\/labels for environment separation and cost allocation.<\/li>\n<li>Maintain an internal \u201cdata model and index registry\u201d document.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">12. Security Considerations<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Identity and access model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Server-side access (recommended for trusted environments)<\/strong>:<\/li>\n<li>Use IAM + service accounts (Cloud Run\/GKE\/Compute Engine).<\/li>\n<li>Grant only required roles.<\/li>\n<li><strong>Client-side access<\/strong>:<\/li>\n<li>Prefer Firebase Authentication + Firestore Security Rules (if your architecture uses Firebase client SDKs).<\/li>\n<li>Enforce tenant boundaries and per-user access in rules.<\/li>\n<\/ul>\n\n\n\n<p>Key principle: <strong>Never give clients broad IAM credentials<\/strong> to access Firestore directly with admin privileges.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Encryption<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Data in transit uses TLS.<\/li>\n<li>Data at rest is encrypted by Google by default.<\/li>\n<li>If you require customer-managed encryption keys (CMEK), verify current Firestore CMEK support and configuration steps in official docs (do not assume availability across all locations\/features).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network exposure<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Firestore is accessed via Google APIs; it\u2019s not a private IP database endpoint by default.<\/li>\n<li>Enterprise controls to consider:<\/li>\n<li><strong>VPC Service Controls<\/strong> to reduce data exfiltration risk.<\/li>\n<li><strong>restricted.googleapis.com<\/strong> endpoints where appropriate.<\/li>\n<li>Private Google Access for VM instances without public IPs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secrets handling<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Prefer <strong>Workload Identity<\/strong> patterns (where supported) to avoid long-lived keys.<\/li>\n<li>If you must use keys in non-Google environments, store them in a secrets manager and rotate regularly.<\/li>\n<li>On Google Cloud, use <strong>Secret Manager<\/strong> for API keys and external secrets, not Firestore documents.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Audit\/logging<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use <strong>Cloud Audit Logs<\/strong> for administrative activity and access patterns (subject to configuration).<\/li>\n<li>Centralize logs in a security project if your org uses a SIEM pipeline.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compliance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Location selection affects data residency.<\/li>\n<li>Set retention policies for exported data in Cloud Storage.<\/li>\n<li>Enforce least privilege and review access regularly.<\/li>\n<li>For regulated workloads, validate:<\/li>\n<li>Data residency guarantees<\/li>\n<li>Audit log retention<\/li>\n<li>Encryption key management requirements<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Common security mistakes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Shipping a mobile\/web app that uses admin credentials.<\/li>\n<li>Overbroad IAM roles granted to service accounts.<\/li>\n<li>Missing tenant isolation in security rules (multi-tenant data leak risk).<\/li>\n<li>Storing secrets (API keys, credentials) in documents.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secure deployment recommendations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use server-mediated access for sensitive operations (Cloud Run API).<\/li>\n<li>Implement per-tenant document partitioning and enforce it in code\/rules.<\/li>\n<li>Add budget alerts and anomaly detection for usage spikes (can indicate abuse).<\/li>\n<li>Use VPC Service Controls for high-security environments.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">13. Limitations and Gotchas<\/h2>\n\n\n\n<p>Always confirm current limits in the official quotas page:\n&#8211; https:\/\/cloud.google.com\/firestore\/quotas<\/p>\n\n\n\n<p>Common limitations\/gotchas include:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>Document size limits<\/strong>\n   &#8211; Large blobs don\u2019t belong in Firestore; store them in Cloud Storage and reference by URL.<\/p>\n<\/li>\n<li>\n<p><strong>No joins<\/strong>\n   &#8211; Data modeling requires denormalization and careful query planning.<\/p>\n<\/li>\n<li>\n<p><strong>Index-driven query constraints<\/strong>\n   &#8211; Some query shapes require composite indexes; missing indexes cause errors.\n   &#8211; Too many indexes can increase write cost and storage.<\/p>\n<\/li>\n<li>\n<p><strong>Hotspotting<\/strong>\n   &#8211; Frequent writes to the same document can throttle\/retry.\n   &#8211; Sequential document IDs can sometimes create write concentration patterns depending on usage\u2014use good ID strategies.<\/p>\n<\/li>\n<li>\n<p><strong>Batch and transaction limits<\/strong>\n   &#8211; Batched writes have operation limits.\n   &#8211; Transactions can retry on contention; design for idempotency.<\/p>\n<\/li>\n<li>\n<p><strong>Multi-region vs regional tradeoffs<\/strong>\n   &#8211; Multi-region can cost more and may have different latency characteristics.\n   &#8211; Regional can reduce cost but may reduce resilience scope.<\/p>\n<\/li>\n<li>\n<p><strong>Client listener cost surprises<\/strong>\n   &#8211; Real-time listeners can generate many document reads over time.<\/p>\n<\/li>\n<li>\n<p><strong>IAM vs Security Rules confusion<\/strong>\n   &#8211; IAM is for Google Cloud identities\/workloads.\n   &#8211; Security rules are for client access patterns (often Firebase). Mixing assumptions leads to insecure designs.<\/p>\n<\/li>\n<li>\n<p><strong>Export\/import operational complexity<\/strong>\n   &#8211; Export is not a full DR plan by itself; you need restore procedures, tested regularly.<\/p>\n<\/li>\n<li>\n<p><strong>Environment cloning<\/strong>\n   &#8211; Copying prod data to dev can violate compliance. Use anonymization and strict access controls.<\/p>\n<\/li>\n<li>\n<p><strong>Multiple databases per project<\/strong>\n   &#8211; Firestore resource model supports database IDs; actual availability\/limits can vary. Verify current multi-database support and constraints in official docs before relying on it.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">14. Comparison with Alternatives<\/h2>\n\n\n\n<p>Firestore in Native mode is one option in Google Cloud Databases. Here\u2019s how it compares to common alternatives.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Option<\/th>\n<th>Best For<\/th>\n<th>Strengths<\/th>\n<th>Weaknesses<\/th>\n<th>When to Choose<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>Firestore in Native mode (Google Cloud)<\/strong><\/td>\n<td>Web\/mobile app data, document-centric models, real-time UX<\/td>\n<td>Managed scaling, flexible schema, indexing, transactions, strong consistency, real-time\/offline (client SDKs)<\/td>\n<td>No SQL\/joins, index\/cost management, document size limits, hotspot risks<\/td>\n<td>App backends needing document store and simple ops; real-time clients<\/td>\n<\/tr>\n<tr>\n<td><strong>Firestore in Datastore mode (Google Cloud)<\/strong><\/td>\n<td>Datastore compatibility, certain legacy patterns<\/td>\n<td>Datastore-style entities\/keys, managed NoSQL<\/td>\n<td>Different feature set than Native; not the same as Native mode<\/td>\n<td>When you need Datastore mode specifically (legacy or compatibility)<\/td>\n<\/tr>\n<tr>\n<td><strong>Cloud SQL (Google Cloud)<\/strong><\/td>\n<td>Relational apps, SQL queries, joins<\/td>\n<td>SQL, transactions, relational integrity<\/td>\n<td>Scaling patterns differ; operational overhead compared to serverless NoSQL<\/td>\n<td>When data is relational and SQL is required<\/td>\n<\/tr>\n<tr>\n<td><strong>AlloyDB for PostgreSQL (Google Cloud)<\/strong><\/td>\n<td>High-performance PostgreSQL workloads<\/td>\n<td>Postgres compatibility + performance features<\/td>\n<td>Not a serverless document store; relational management<\/td>\n<td>When you need PostgreSQL semantics at scale<\/td>\n<\/tr>\n<tr>\n<td><strong>Spanner (Google Cloud)<\/strong><\/td>\n<td>Globally consistent relational at scale<\/td>\n<td>Horizontal scale + relational + strong consistency<\/td>\n<td>Different cost\/complexity profile; schema and SQL focus<\/td>\n<td>When you need global relational consistency and scale<\/td>\n<\/tr>\n<tr>\n<td><strong>Bigtable (Google Cloud)<\/strong><\/td>\n<td>Wide-column at massive throughput (time series, IoT telemetry)<\/td>\n<td>Extremely high throughput, predictable performance<\/td>\n<td>Not a document DB; schema modeling complexity<\/td>\n<td>When you need huge write\/read throughput with wide rows<\/td>\n<\/tr>\n<tr>\n<td><strong>Memorystore (Redis\/Memcached)<\/strong><\/td>\n<td>Caching, ephemeral state<\/td>\n<td>Very fast latency<\/td>\n<td>Not durable primary database<\/td>\n<td>Use as cache in front of Firestore\/SQL<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS DynamoDB<\/strong><\/td>\n<td>Managed key-value\/document on AWS<\/td>\n<td>Serverless scale, global tables<\/td>\n<td>AWS ecosystem, different query\/index model<\/td>\n<td>Choose if you\u2019re on AWS and need similar serverless NoSQL<\/td>\n<\/tr>\n<tr>\n<td><strong>Azure Cosmos DB<\/strong><\/td>\n<td>Multi-model globally distributed DB<\/td>\n<td>Global distribution, multiple APIs<\/td>\n<td>Azure ecosystem and pricing complexity<\/td>\n<td>Choose if you\u2019re on Azure with global distribution needs<\/td>\n<\/tr>\n<tr>\n<td><strong>MongoDB (Atlas\/self-managed)<\/strong><\/td>\n<td>Rich document queries and tooling<\/td>\n<td>Familiar Mongo APIs, flexible schema<\/td>\n<td>Operational complexity (self-managed) or different managed offering<\/td>\n<td>Choose when Mongo compatibility and query patterns are key<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">15. Real-World Example<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Enterprise example: Multi-tenant SaaS configuration and user state<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong><\/li>\n<li>An enterprise SaaS platform needs to store tenant configuration, feature flags, user settings, and lightweight workflow state. Requirements include strong auditability, least-privilege access, and predictable low-latency reads for APIs.<\/li>\n<li><strong>Proposed architecture<\/strong><\/li>\n<li>Cloud Run services per domain (settings, flags, workflow).<\/li>\n<li>Each service uses a dedicated service account with least-privilege IAM to Firestore.<\/li>\n<li>Data model partitions by tenant:<ul>\n<li><code>\/tenants\/{tenantId}\/users\/{userId}<\/code><\/li>\n<li><code>\/tenants\/{tenantId}\/settings\/{settingId}<\/code><\/li>\n<\/ul>\n<\/li>\n<li>Scheduled exports to Cloud Storage with retention policies.<\/li>\n<li>Cloud Monitoring dashboards and alerting on read\/write spikes and error rates.<\/li>\n<li>Optional VPC Service Controls perimeter around the project.<\/li>\n<li><strong>Why Firestore in Native mode was chosen<\/strong><\/li>\n<li>Document model fits configuration\/state.<\/li>\n<li>Managed scaling reduces operational overhead.<\/li>\n<li>Strong consistency simplifies backend logic.<\/li>\n<li><strong>Expected outcomes<\/strong><\/li>\n<li>Reduced ops load compared to self-managed databases.<\/li>\n<li>Predictable performance with index governance.<\/li>\n<li>Stronger security posture through IAM + audit logging and environment isolation.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Startup\/small-team example: Mobile app with offline-first tasks<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem<\/strong><\/li>\n<li>A small team is building a mobile app for field technicians who often work offline. The app must sync tasks, notes, and statuses when connectivity returns.<\/li>\n<li><strong>Proposed architecture<\/strong><\/li>\n<li>Firebase Authentication for user identity (or another auth provider).<\/li>\n<li>Firestore in Native mode as primary app database.<\/li>\n<li>A Cloud Run backend for privileged operations (billing, admin actions).<\/li>\n<li>Security rules enforce per-user\/per-tenant access for client reads\/writes.<\/li>\n<li><strong>Why Firestore in Native mode was chosen<\/strong><\/li>\n<li>Client SDK offline support and sync patterns.<\/li>\n<li>Rapid iteration and minimal operational overhead.<\/li>\n<li>Real-time updates for dispatchers monitoring status changes.<\/li>\n<li><strong>Expected outcomes<\/strong><\/li>\n<li>Faster release cycles.<\/li>\n<li>Good UX in poor connectivity environments.<\/li>\n<li>Costs manageable with careful listener\/query design and TTL for ephemeral records.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">16. FAQ<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>Is \u201cFirestore in Native mode\u201d the same as Firestore in Datastore mode?<\/strong><br\/>\n   No. They are two different modes with different behavior and feature sets. This tutorial is specifically about <strong>Firestore in Native mode<\/strong>.<\/p>\n<\/li>\n<li>\n<p><strong>Do I need Firebase to use Firestore in Native mode on Google Cloud?<\/strong><br\/>\n   Not necessarily. You can access Firestore using Google Cloud client libraries and IAM from server-side workloads. Firebase is commonly used for client SDKs, authentication, and security rules workflows.<\/p>\n<\/li>\n<li>\n<p><strong>Can I change my Firestore location after creating the database?<\/strong><br\/>\n   Typically, the location choice is not intended to be changed after creation. Verify current capabilities in official docs before committing.<\/p>\n<\/li>\n<li>\n<p><strong>Does Firestore support SQL?<\/strong><br\/>\n   No. Firestore is a NoSQL document database. If you need SQL, consider Cloud SQL, AlloyDB, or Spanner.<\/p>\n<\/li>\n<li>\n<p><strong>How do reads\/writes get billed?<\/strong><br\/>\n   Billing is based on document operations (reads\/writes\/deletes) plus storage and network egress. See official pricing: https:\/\/cloud.google.com\/firestore\/pricing<\/p>\n<\/li>\n<li>\n<p><strong>Why did my query fail with an index error?<\/strong><br\/>\n   Some compound queries require composite indexes. Firestore typically provides an error message with a link or instructions to create the required index.<\/p>\n<\/li>\n<li>\n<p><strong>What is the maximum size of a Firestore document?<\/strong><br\/>\n   Firestore enforces document size limits. Commonly referenced as 1 MiB, but you must verify current limits in quotas: https:\/\/cloud.google.com\/firestore\/quotas<\/p>\n<\/li>\n<li>\n<p><strong>Is Firestore strongly consistent?<\/strong><br\/>\n   Firestore in Native mode is designed for strong consistency. Review any documented caveats for specific query types and SDK behavior in official docs.<\/p>\n<\/li>\n<li>\n<p><strong>Can I do multi-document transactions?<\/strong><br\/>\n   Yes, Firestore supports transactions across multiple documents (within documented limits).<\/p>\n<\/li>\n<li>\n<p><strong>How do I implement multi-tenancy securely?<\/strong><br\/>\n   Common patterns include partitioning by tenant ID in document paths and enforcing tenant boundaries using server-side IAM controls and\/or security rules for client access.<\/p>\n<\/li>\n<li>\n<p><strong>Should I store files (images, PDFs) in Firestore?<\/strong><br\/>\n   No. Store blobs in Cloud Storage and store metadata\/URLs in Firestore.<\/p>\n<\/li>\n<li>\n<p><strong>How do I back up Firestore?<\/strong><br\/>\n   A common approach is scheduled exports to Cloud Storage and tested restore procedures. See export\/import docs: https:\/\/cloud.google.com\/firestore\/docs\/manage-data\/export-import<\/p>\n<\/li>\n<li>\n<p><strong>What causes unexpected high bills?<\/strong><br\/>\n   Often: broad real-time listeners, inefficient queries, excessive indexes, and high write amplification. Also consider network egress to clients.<\/p>\n<\/li>\n<li>\n<p><strong>Can I access Firestore privately from my VPC without public IPs?<\/strong><br\/>\n   Workloads in a VPC can access Google APIs using Private Google Access and can add perimeter controls with VPC Service Controls. Verify the latest recommended networking approach in Google Cloud docs.<\/p>\n<\/li>\n<li>\n<p><strong>How do I avoid hot documents for counters?<\/strong><br\/>\n   Use a <strong>sharded counter<\/strong> pattern (multiple documents representing parts of a counter) and aggregate them in reads, or redesign to reduce contention.<\/p>\n<\/li>\n<li>\n<p><strong>Is Firestore suitable for time-series telemetry ingestion?<\/strong><br\/>\n   For light-to-moderate metadata and device state, yes. For extreme telemetry throughput, Bigtable or Pub\/Sub + downstream storage is often a better fit.<\/p>\n<\/li>\n<li>\n<p><strong>Can I run Firestore locally for tests?<\/strong><br\/>\n   Firestore has emulator options (commonly used via Firebase tooling). Verify current emulator support and parity details in official docs before relying on it for CI.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">17. Top Online Resources to Learn Firestore in Native mode<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Resource Type<\/th>\n<th>Name<\/th>\n<th>Why It Is Useful<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Official documentation<\/td>\n<td>Firestore documentation<\/td>\n<td>Primary reference for concepts, data model, queries, SDKs, operations: https:\/\/cloud.google.com\/firestore\/docs<\/td>\n<\/tr>\n<tr>\n<td>Official pricing<\/td>\n<td>Firestore pricing<\/td>\n<td>Up-to-date pricing dimensions and regional considerations: https:\/\/cloud.google.com\/firestore\/pricing<\/td>\n<\/tr>\n<tr>\n<td>Pricing tool<\/td>\n<td>Google Cloud Pricing Calculator<\/td>\n<td>Model reads\/writes\/storage\/egress for your workload: https:\/\/cloud.google.com\/products\/calculator<\/td>\n<\/tr>\n<tr>\n<td>Locations<\/td>\n<td>Firestore locations<\/td>\n<td>Choose regional vs multi-region and validate availability: https:\/\/cloud.google.com\/firestore\/docs\/locations<\/td>\n<\/tr>\n<tr>\n<td>Quotas\/limits<\/td>\n<td>Firestore quotas and limits<\/td>\n<td>Prevent production incidents by designing within limits: https:\/\/cloud.google.com\/firestore\/quotas<\/td>\n<\/tr>\n<tr>\n<td>Data operations<\/td>\n<td>Export and import data<\/td>\n<td>Practical backup\/migration guidance: https:\/\/cloud.google.com\/firestore\/docs\/manage-data\/export-import<\/td>\n<\/tr>\n<tr>\n<td>Client libraries<\/td>\n<td>Google Cloud Firestore client libraries<\/td>\n<td>Language-specific usage examples and authentication patterns (navigate from docs hub): https:\/\/cloud.google.com\/firestore\/docs<\/td>\n<\/tr>\n<tr>\n<td>Architecture guidance<\/td>\n<td>Google Cloud Architecture Center<\/td>\n<td>Reference architectures and best practices (search within): https:\/\/cloud.google.com\/architecture<\/td>\n<\/tr>\n<tr>\n<td>Videos<\/td>\n<td>Google Cloud Tech (YouTube)<\/td>\n<td>Talks and demos; search \u201cFirestore Native mode\u201d: https:\/\/www.youtube.com\/@googlecloudtech<\/td>\n<\/tr>\n<tr>\n<td>Samples<\/td>\n<td>GoogleCloudPlatform GitHub<\/td>\n<td>Official samples sometimes include Firestore usage; search repositories: https:\/\/github.com\/GoogleCloudPlatform<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">18. Training and Certification Providers<\/h2>\n\n\n\n<p>The following institutes are presented as learning providers\/platforms. Verify schedules, syllabus, and delivery modes on their websites.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>DevOpsSchool.com<\/strong>\n   &#8211; <strong>Suitable audience<\/strong>: DevOps engineers, cloud engineers, SREs, developers\n   &#8211; <strong>Likely learning focus<\/strong>: Cloud fundamentals, DevOps tooling, platform practices (verify Firestore-specific coverage)\n   &#8211; <strong>Mode<\/strong>: check website\n   &#8211; <strong>Website<\/strong>: https:\/\/www.devopsschool.com\/<\/p>\n<\/li>\n<li>\n<p><strong>ScmGalaxy.com<\/strong>\n   &#8211; <strong>Suitable audience<\/strong>: DevOps learners, SCM\/CI-CD practitioners\n   &#8211; <strong>Likely learning focus<\/strong>: DevOps\/SCM practices and tooling (verify Google Cloud content)\n   &#8211; <strong>Mode<\/strong>: check website\n   &#8211; <strong>Website<\/strong>: https:\/\/www.scmgalaxy.com\/<\/p>\n<\/li>\n<li>\n<p><strong>CLoudOpsNow.in<\/strong>\n   &#8211; <strong>Suitable audience<\/strong>: Cloud operations and platform teams\n   &#8211; <strong>Likely learning focus<\/strong>: Cloud operations, DevOps, SRE-aligned practices (verify syllabus)\n   &#8211; <strong>Mode<\/strong>: check website\n   &#8211; <strong>Website<\/strong>: https:\/\/www.cloudopsnow.in\/<\/p>\n<\/li>\n<li>\n<p><strong>SreSchool.com<\/strong>\n   &#8211; <strong>Suitable audience<\/strong>: SREs, operations engineers, reliability-focused developers\n   &#8211; <strong>Likely learning focus<\/strong>: SRE principles, observability, reliability engineering (verify Google Cloud modules)\n   &#8211; <strong>Mode<\/strong>: check website\n   &#8211; <strong>Website<\/strong>: https:\/\/www.sreschool.com\/<\/p>\n<\/li>\n<li>\n<p><strong>AiOpsSchool.com<\/strong>\n   &#8211; <strong>Suitable audience<\/strong>: Ops teams exploring AIOps, monitoring, automation\n   &#8211; <strong>Likely learning focus<\/strong>: AIOps concepts, operations analytics (verify cloud database monitoring coverage)\n   &#8211; <strong>Mode<\/strong>: check website\n   &#8211; <strong>Website<\/strong>: https:\/\/www.aiopsschool.com\/<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">19. Top Trainers<\/h2>\n\n\n\n<p>The following are trainer-related sites\/platforms. Verify specific Firestore in Native mode expertise and course outlines directly on each site.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>RajeshKumar.xyz<\/strong>\n   &#8211; <strong>Likely specialization<\/strong>: DevOps\/cloud training content (verify Firestore coverage)\n   &#8211; <strong>Suitable audience<\/strong>: Engineers seeking practical training\n   &#8211; <strong>Website<\/strong>: https:\/\/rajeshkumar.xyz\/<\/p>\n<\/li>\n<li>\n<p><strong>devopstrainer.in<\/strong>\n   &#8211; <strong>Likely specialization<\/strong>: DevOps tooling and cloud practices (verify Google Cloud modules)\n   &#8211; <strong>Suitable audience<\/strong>: DevOps\/cloud engineers and students\n   &#8211; <strong>Website<\/strong>: https:\/\/www.devopstrainer.in\/<\/p>\n<\/li>\n<li>\n<p><strong>devopsfreelancer.com<\/strong>\n   &#8211; <strong>Likely specialization<\/strong>: Freelance DevOps services and training resources (verify course offerings)\n   &#8211; <strong>Suitable audience<\/strong>: Teams seeking short-term coaching or consulting-style training\n   &#8211; <strong>Website<\/strong>: https:\/\/www.devopsfreelancer.com\/<\/p>\n<\/li>\n<li>\n<p><strong>devopssupport.in<\/strong>\n   &#8211; <strong>Likely specialization<\/strong>: DevOps support and learning resources (verify Firestore\/cloud database topics)\n   &#8211; <strong>Suitable audience<\/strong>: Ops teams and learners needing hands-on guidance\n   &#8211; <strong>Website<\/strong>: https:\/\/www.devopssupport.in\/<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">20. Top Consulting Companies<\/h2>\n\n\n\n<p>These companies are listed as consulting\/service providers. Verify service scope, references, and engagement models directly.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>cotocus.com<\/strong>\n   &#8211; <strong>Likely service area<\/strong>: Cloud\/DevOps consulting (verify Google Cloud database specialization)\n   &#8211; <strong>Where they may help<\/strong>: Architecture reviews, migration planning, operational readiness\n   &#8211; <strong>Consulting use case examples<\/strong>:<\/p>\n<ul>\n<li>Designing Firestore data model and index strategy<\/li>\n<li>Setting up CI\/CD and environment isolation for dev\/test\/prod<\/li>\n<li>Cost review for read\/write patterns<\/li>\n<li><strong>Website<\/strong>: https:\/\/cotocus.com\/<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>DevOpsSchool.com<\/strong>\n   &#8211; <strong>Likely service area<\/strong>: DevOps and cloud consulting\/training (verify Firestore-specific offerings)\n   &#8211; <strong>Where they may help<\/strong>: Platform enablement, delivery pipelines, operational practices\n   &#8211; <strong>Consulting use case examples<\/strong>:<\/p>\n<ul>\n<li>Cloud Run + Firestore reference architecture<\/li>\n<li>IAM and least-privilege setup for service accounts<\/li>\n<li>Observability and incident response runbooks<\/li>\n<li><strong>Website<\/strong>: https:\/\/www.devopsschool.com\/<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>DEVOPSCONSULTING.IN<\/strong>\n   &#8211; <strong>Likely service area<\/strong>: DevOps consulting services (verify Google Cloud database expertise)\n   &#8211; <strong>Where they may help<\/strong>: DevOps process, infrastructure automation, reliability practices\n   &#8211; <strong>Consulting use case examples<\/strong>:<\/p>\n<ul>\n<li>Terraform-based provisioning around Google Cloud projects\/APIs<\/li>\n<li>Operational monitoring and alerting for Firestore-backed services<\/li>\n<li>Security posture review (IAM, audit logs, perimeter controls)<\/li>\n<li><strong>Website<\/strong>: https:\/\/www.devopsconsulting.in\/<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">21. Career and Learning Roadmap<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn before Firestore in Native mode<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Google Cloud fundamentals:<\/li>\n<li>Projects, billing, IAM, service accounts<\/li>\n<li>VPC basics and Private Google Access concepts<\/li>\n<li>Basic database concepts:<\/li>\n<li>ACID vs eventual consistency<\/li>\n<li>Indexing fundamentals<\/li>\n<li>API-driven development:<\/li>\n<li>Using SDKs and authentication (ADC, service accounts)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn after Firestore in Native mode<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Production architecture:<\/li>\n<li>Cloud Run\/GKE service design<\/li>\n<li>Caching strategies (Memorystore)<\/li>\n<li>Event-driven systems (Pub\/Sub)<\/li>\n<li>Security and governance:<\/li>\n<li>VPC Service Controls<\/li>\n<li>Organization policies and audit log pipelines<\/li>\n<li>Data lifecycle:<\/li>\n<li>Export\/import automation<\/li>\n<li>Analytics pipeline design (Cloud Storage \u2192 Dataflow\/BigQuery patterns)<\/li>\n<li>Reliability engineering:<\/li>\n<li>SLOs\/SLIs, alerting, incident response<\/li>\n<li>Load testing and capacity modeling (based on quotas)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Job roles that use it<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud engineer \/ platform engineer<\/li>\n<li>Backend developer<\/li>\n<li>Mobile\/web developer (especially with Firebase)<\/li>\n<li>DevOps engineer \/ SRE<\/li>\n<li>Solutions architect<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Certification path (if available)<\/h3>\n\n\n\n<p>Google Cloud certifications don\u2019t usually certify a single database service alone, but Firestore knowledge is useful for:\n&#8211; Associate Cloud Engineer\n&#8211; Professional Cloud Developer\n&#8211; Professional Cloud Architect\n&#8211; Professional Cloud DevOps Engineer<\/p>\n\n\n\n<p>Verify current certification details:\n&#8211; https:\/\/cloud.google.com\/learn\/certification<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Project ideas for practice<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Multi-tenant settings service<\/strong> with Cloud Run + Firestore and per-tenant partitioned collections.<\/li>\n<li><strong>Offline-first mobile checklist app<\/strong> using client SDK + security rules (verify current recommended setup).<\/li>\n<li><strong>Sharded counter implementation<\/strong> with a dashboard showing aggregation.<\/li>\n<li><strong>Export\/restore drill<\/strong>: nightly exports to Cloud Storage and scripted verification.<\/li>\n<li><strong>Cost experiment<\/strong>: compare listener-based design vs direct gets + caching for the same UX.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">22. Glossary<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Collection<\/strong>: A group of Firestore documents.<\/li>\n<li><strong>Document<\/strong>: A record stored in Firestore containing fields (JSON-like data).<\/li>\n<li><strong>Field<\/strong>: A key-value pair within a Firestore document.<\/li>\n<li><strong>Subcollection<\/strong>: A collection nested under a document.<\/li>\n<li><strong>Composite index<\/strong>: An index spanning multiple fields to support certain compound queries.<\/li>\n<li><strong>Collection group query<\/strong>: A query across all collections with the same collection ID, regardless of path.<\/li>\n<li><strong>Transaction<\/strong>: An atomic set of reads\/writes that either fully succeeds or fails.<\/li>\n<li><strong>Batched write<\/strong>: A group of write operations committed atomically (all succeed or fail).<\/li>\n<li><strong>Hotspot<\/strong>: A design that concentrates many operations on the same document\/key range, causing contention and throttling.<\/li>\n<li><strong>IAM (Identity and Access Management)<\/strong>: Google Cloud system for authorizing identities and workloads.<\/li>\n<li><strong>Service account<\/strong>: A Google Cloud identity used by applications\/services to authenticate to APIs.<\/li>\n<li><strong>ADC (Application Default Credentials)<\/strong>: A Google authentication mechanism used by client libraries to find credentials automatically.<\/li>\n<li><strong>VPC Service Controls<\/strong>: A Google Cloud feature to reduce data exfiltration risk by defining security perimeters around services.<\/li>\n<li><strong>Private Google Access<\/strong>: Allows VMs without public IPs to reach Google APIs.<\/li>\n<li><strong>Egress<\/strong>: Network data leaving a Google Cloud service to external destinations (may be billable).<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">23. Summary<\/h2>\n\n\n\n<p>Firestore in Native mode is a Google Cloud Databases service that provides a fully managed NoSQL document database for application backends, especially web and mobile apps that benefit from flexible schema, indexed queries, and (in many client architectures) real-time updates and offline support.<\/p>\n\n\n\n<p>It matters because it reduces operational burden while enabling scalable, strongly consistent document access patterns. It fits best when your application data model is document-centric and you can design around Firestore\u2019s query\/index patterns and quotas.<\/p>\n\n\n\n<p>Cost-wise, focus on the true drivers: document reads\/writes\/deletes, index footprint, storage growth, and network egress\u2014especially from real-time listeners and broad queries. Security-wise, use IAM and dedicated service accounts for server workloads, and use security rules for client access patterns where applicable; avoid granting broad privileges to clients.<\/p>\n\n\n\n<p>Use Firestore in Native mode when you need a managed document store with fast iteration and predictable operations. If you need SQL, joins, or complex relational constraints, choose Cloud SQL\/AlloyDB\/Spanner instead.<\/p>\n\n\n\n<p>Next step: read the official documentation end-to-end, then build a small Cloud Run + Firestore service and practice index management and export\/restore procedures:\n&#8211; https:\/\/cloud.google.com\/firestore\/docs<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Databases<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12,51],"tags":[],"class_list":["post-679","post","type-post","status-publish","format-standard","hentry","category-databases","category-google-cloud"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/679","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=679"}],"version-history":[{"count":0,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/679\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=679"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=679"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=679"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}