Creating MX record in Google cloud DNS

Google Compute Engine does not allow outbound connection on ports 25, 465 and 587. Moreover port 25 is also blocked for SMTP relay through G Suite as mentioned here:

Note: Port 25 is always blocked and cannot be used, even through SMTP relay using Google Apps.

As a workaround, you can use trusted third party providers such as SendGrid, Mailgun, or Mailjet to setup mail function on GCE or use port 465, 587 for STMP relay using G suite on GCE instance. You can find more information and steps on this link.

The naked domain redirect docs apply only to Google Sites hosted websites:

If you build a Google Site and map it to a custom address such as www.yourdomain.com...

It only works if your www record is already pointing to ghs.googlehosted.com which in your case, it isn't.

If your www record points to a site on Amazon S3, then you'd want to follow the documentation at Root Domain Support on Amazon S3 Hosted Websites. Since you're using Google for DNS only, you can treat it as any other DNS provider for configuration purposes without needing to give Google your TLS certificate.

Edit: Amazon does not provide A / AAAA records for root domain redirection, and instead requires you to use their own Route53 DNS service for this. Google's redirect is only intended to work with Google hosted services (because Google will have the TLS cert), otherwise you end up uploading your cert to multiple hosts if it works at all.