Professional Cloud Security Engineer

Secure the Agent Infrastructure and Network Architecture

Agent infrastructure isolation starts with placing agent execution environments inside a Virtual Private Cloud (VPC), which creates a private network boundary separate from the public internet. Administrators use Private Service Connect network attachments in dedicated subnets to isolate agent runtimes, and they enable Private Google Access and Cloud NAT so private instances can reach Google services without receiving public IP addresses that could be attacked. Strict firewall rules control what traffic can enter and leave the network, and disabling IP forwarding prevents unauthorized routing between instances.

Protecting agent endpoints from external threats requires layered defenses at the network edge. A regional Application Load Balancer terminates SSL certificates and routes incoming requests to healthy agent instances, while Cloud Armor provides rate limiting and layer-7 filtering to block denial-of-service attacks and malicious web traffic before it reaches the agents. Identity-Aware Proxy (IAP) adds another check by evaluating who is asking for access, what device they are using, and whether their request meets defined permission rules before traffic enters the environment.

Communication between agents and external tools must be encrypted and authenticated. The Agent-to-Agent (A2A) protocol requires TLS 1.2 or higher for all traffic and uses OAuth2 and OpenID Connect tokens so each side can verify the other's identity. For internal enterprise tools, administrators set up Private DNS Peering so agents can resolve hostnames through private Cloud DNS zones without exposing queries to the public internet. Security teams should also disable default public service URLs to force all external API calls through controlled gateways.

Preventing data from leaving the environment involves creating a governance boundary around all services the agents can access. VPC Service Controls (VPC-SC) establish a security perimeter that blocks data from moving to unauthorized networks or services. Storage buckets and data stores used by agents must use Customer-Managed Encryption Keys (CMEK) through Cloud KMS so the organization controls the encryption keys, not Google. Model Armor and Sensitive Data Protection add AI-specific controls by inspecting prompts and responses for sensitive information and malicious injection attempts.

Implement Data Governance and Protection for AI Workflows

Organizations handling regulated data like health records or government information need isolated, compliant environments. Assured Workloads creates such an environment on Google Cloud, enforcing controls required by HIPAA, FedRAMP High, and DoD IL4. This service also enforces data residency, meaning data must be stored and processed only in approved geographic locations such as the US multi-region.

Protecting AI data throughout its lifecycle requires classifying what sensitivity level each piece of data has, encrypting it at rest, and managing how long it is kept. Cloud Data Loss Prevention (DLP) discovers and classifies sensitive information within training data, user prompts, and model outputs, then can de-identify it to remove personal details. Cloud Key Management Service (KMS) manages customer-managed encryption keys (CMEK) that encrypt data stored in Cloud Storage buckets and BigQuery datasets, giving the organization exclusive control over who can decrypt the data.

VPC Service Controls create a secure perimeter around the AI project and all services it depends on, preventing data from flowing to unauthorized networks or regions. Combined with explicit data location policies, these controls stop data from being moved outside approved geographic boundaries. For government deployments, this means connecting only to storage and database services that are inside the Assured Workloads boundary and disabling features like grounding services or analytics connectors that are not compliant with the required regulations.

Some workflows require that no data be retained after processing. Achieving zero data retention means disabling in-memory caching for Gemini models at the project level and avoiding features like Grounding with Google Search that store data for mandatory periods. Model Armor can define security templates that filter both prompts sent to models and responses returned, checking for sensitive data, prompt injection attacks, and other risks that align with the organization's overall data governance policy.

Manage Identity, Access, and Audit Controls for Agent Interactions

Authentication verifies that users are who they claim to be before they can interact with the Gemini Enterprise Agent Platform. Users authenticate through accounts managed by Cloud Identity, Google Workspace, or an external identity provider connected through federation. Organizations should enable single sign-on (SSO) so users can log in once and access all permitted resources, and require 2-step verification to protect against stolen passwords. Strong password requirements should be enforced and monitored to maintain good authentication practices.

Access controls determine what authenticated users can do after they log in. Identity and Access Management (IAM) provides granular permissions, and administrators should create groups for application developers rather than granting access to individual users, following the principle of least privilege which gives users only the permissions they need. Custom IAM roles can be created with specific permissions like cloudaicompanion.companions.generateChat for generating chat responses, while predefined roles like Discovery Engine Admin, Editor, and Viewer offer different levels of access to Gemini Enterprise resources.

VPC Service Controls create a security perimeter that prevents data from leaving the environment through unauthorized paths. When VPC Service Controls are enabled, certain actions like sending emails or creating tickets from within the agent are blocked by default to maintain security boundaries. Organizations must work with Google representatives to add specific services to an allowlist if those actions need to be permitted within the perimeter.

Logging and monitoring track what agents do and detect when something suspicious happens. Cloud Audit Logs record administrative actions and API calls, creating an audit trail for compliance and investigation. Security Command Center provides threat detection across the environment, and Event Threat Detection can identify suspicious patterns such as unusual API behavior, attempts to evade defenses, or credential misuse involving AI agents. Security teams use these tools to maintain visibility into agent activities and respond quickly to potential threats.

Identity provider configuration controls how users prove their identity when accessing data sources within Gemini Enterprise. Organizations can use Google Identity directly or connect external providers like Microsoft Entra ID through Workforce Identity Federation. When identity settings change, any existing data stores that have already ingested data may need to be recreated to apply the new access controls. Users must have the Discovery Engine User role (roles/discoveryengine.user) to access, manage, and share applications within the platform.