Security and access management

Data Encryption and Key Management Strategies

Google Cloud automatically protects data at rest with Google-default encryption. For more control, you can use Customer-Managed Encryption Keys (CMEK) through Cloud Key Management Service (Cloud KMS). CMEK lets you manage your own keys, including their rotation schedule, location, and who can use them, which is essential for meeting strict data regulations.

To use CMEK, you create a Key Ring and a Symmetric Key in the same geographic region as your data, like a database or storage bucket. You must then grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the specific service account that the resource uses. This permission allows the Google Cloud service to encrypt and decrypt data on your behalf. You typically enable CMEK when you first create a resource, as switching from Google-default encryption later is often not possible.

Managing a key's lifecycle is critical because the key controls access to your data. If a key is disabled or scheduled for destruction, services using it will fail. You can restore access by re-enabling the key. However, if a key is permanently destroyed, the data it protected is lost forever. You can use Cloud Audit Logs to monitor when your keys are used to access data.

Identity and Access Management (IAM) and Resource Permissions

Core Principles of IAM

Identity and Access Management (IAM) controls who can do what on specific cloud resources. It follows the principle of least privilege, which means granting only the minimum permissions a user or service account needs. Administrators use predefined roles, which are bundles of permissions, to simplify managing access across projects and folders.

Storage Access and Bucket Security

For securing cloud storage, you choose between Uniform Bucket-level Access and Access Control Lists (ACLs). Uniform access applies the same IAM policies to every object in a bucket, making security management and auditing simpler. ACLs offer more granular control for individual files but increase complexity. Using Uniform Bucket-level Access is recommended to maintain a clear security boundary.

Advanced Access Management Tools

For highly sensitive tasks, Privileged Access Manager (PAM) provides just-in-time access. This allows users to elevate their permissions only when needed and for a limited time, reducing the risk from compromised credentials. Cloud Infrastructure Entitlement Management (CIEM) helps find identity misconfigurations, like dormant accounts or users with too many permissions, across multiple cloud environments.

Database Security and Group Management

Security extends to databases through IAM database authentication, which uses access tokens instead of passwords. This allows for centralized management of database users through the same IAM system. Using Cloud Identity groups simplifies this further, as permissions assigned to a group are inherited by all its members.

Monitoring and Security Auditing

Tools like Security Command Center analyze logs to find potential threats, such as unauthorized API calls. Regularly reviewing role recommendations helps identify and remove excessive permissions, ensuring the environment stays secure and compliant.

Network Security Perimeters and Temporary Access

VPC Service Controls and Perimeters

VPC Service Controls create a resource-centric security layer that acts as a virtual boundary, or perimeter, around sensitive Google Cloud services. This perimeter helps prevent unauthorized access and stops data exfiltration, which is data being moved outside the approved environment. You add projects and specific services to a perimeter to keep data within a trusted zone.

Context-Aware Access

Access Context Manager enables context-aware access, which checks factors like a user's IP address or device security before granting access. This means a request can be denied if it comes from an untrusted network, even if the user has the right password. Using device attributes ensures only secure, managed hardware can reach protected resources inside the perimeter.

Temporary Access and Signed URLs

To follow the principle of least privilege, you can grant temporary access instead of using permanent keys. Signed URLs provide a time-limited link to a private storage object, and short-lived tokens grant temporary permissions. These tools ensure external users or systems can only access data for a brief window, which greatly reduces the risk of credential abuse.

Identity-Aware Proxy

For managing virtual machines, Identity-Aware Proxy (IAP) provides secure TCP forwarding for SSH and RDP sessions without needing public IP addresses. IAP sits between the user and the instance, verifying the user's identity and context before allowing the connection. This approach removes the need for bastion hosts and keeps the internal network hidden from direct internet attacks.

Implementation and Monitoring

Before enforcing a new VPC Service Controls perimeter, it's best to use dry run mode to see how the rules will affect existing applications. Cloud Audit Logs help security teams identify perimeter violations and refine policies over time. Regularly auditing these logs ensures the security perimeter stays effective against new threats.