Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!
Gauge your current knowledge
Gauge your current knowledge
Google Cloud automatically encrypts all data at rest using Google-default encryption, which requires no setup from you. For more control, especially to meet regulations, you can use Customer-Managed Encryption Keys (CMEK). You manage these keys through the Cloud Key Management Service (Cloud KMS), where you control the key's rotation schedule, where it's stored geographically, and who can use it.
To use CMEK, you first create a Key Ring and a Symmetric Key in the same region as your data storage. Then, you must grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the specific service account used by that storage service. This permission allows the Google Cloud service to encrypt and decrypt your data on your behalf. You typically enable CMEK when you first create a resource like a database; you often cannot switch an existing system from Google-default encryption to CMEK.
Managing a key's lifecycle is critical because losing access to a key makes the data it encrypted unrecoverable. If a key is disabled or scheduled for destruction, services like Firestore will stop working. You can restore access by re-enabling the key, but once a key is permanently destroyed, the data is lost forever. You can use Cloud Audit Logs to monitor every time a key is used to access your data.
Identity and Access Management (IAM) controls who can do what on your cloud resources. The key principle is least privilege, which means granting only the minimum permissions a user or service account needs. Administrators use predefined roles, which are bundles of permissions, to simplify security management across projects and folders.
For securing cloud storage, you choose between Uniform Bucket-level Access and Access Control Lists (ACLs). Uniform access applies the same IAM policies to every object in a bucket, which makes security management and auditing much simpler. ACLs offer more granular control per file but add complexity. Using Uniform Bucket-level Access is generally recommended to simplify your security perimeter.
For highly sensitive tasks, Privileged Access Manager (PAM) provides just-in-time access, allowing users to get elevated permissions only when needed and for a limited time. This reduces the risk from compromised credentials. Cloud Infrastructure Entitlement Management (CIEM) helps find identity misconfigurations, like dormant accounts or users with too many permissions, across multiple cloud environments.
You can use IAM database authentication to manage database users centrally through IAM. Instead of passwords, this method uses short-lived access tokens. You can also assign permissions to Cloud Identity groups, so users automatically inherit the correct access when they are added to the group. This centralizes control and simplifies user management.
Tools like Security Command Center analyze logs to find potential threats, such as unauthorized API calls. Regularly reviewing role recommendations helps identify and remove excessive permissions from users and service accounts, keeping your environment secure and compliant.
VPC Service Controls create a virtual security boundary, or perimeter, around specific projects and Google Cloud services like Cloud Storage or BigQuery. This perimeter helps prevent data from being moved outside the trusted zone, a risk known as data exfiltration, and blocks unauthorized access even if someone has valid credentials.
Access Context Manager enables context-aware access, which checks a user's context, like their IP address or device security, before granting access. A request can be denied if it comes from an untrusted network, even with the right password. This ensures only secure, managed devices can access resources inside the perimeter.
To follow the principle of least privilege, you should grant temporary access instead of permanent keys. Signed URLs provide a time-limited link to a private file in storage, allowing external users to access it for a short, controlled window. Short-lived tokens grant temporary permissions to service accounts or users, reducing the risk of credential abuse.
For accessing virtual machines, Identity-Aware Proxy (IAP) provides a secure method for SSH and RDP connections without needing public IP addresses or bastion hosts. IAP acts as a gatekeeper, verifying the user's identity and context before allowing a TCP connection to the instance. This keeps the internal network hidden from the public internet.
Before fully enforcing a VPC Service Controls perimeter, you can use dry run mode to see how the rules would affect your applications. Cloud Audit Logs help security teams monitor for policy violations. Regularly auditing these logs ensures your security perimeter stays effective against new threats and unauthorized access attempts.
StudyCerts
StudyCerts