GCP Security

This roadmap covers securing Google Cloud: the resource hierarchy, IAM, organization policies, networks, data, logging and response. A free-trial project and basic cloud knowledge are enough to start.

• Create a separate project for learning
• Enable 2-step verification on your account
• Set a budget alert

• CyberA4U Academy — courses

Google Cloud organizes resources as organization → folders → projects → resources. IAM and policies inherit down this tree.

• Explain organizations, folders and projects
• Understand policy inheritance
• Plan a folder structure

Tools & tech: GCP

• Google Cloud — Resource hierarchy

IAM binds principals (users, groups, service accounts) to roles on resources. Predefined and custom roles let you grant least privilege.

• Grant roles at the right level
• Prefer predefined roles over basic Owner/Editor
• Review who has access

Tools & tech: GCP

• Google Cloud IAM overview

Organization policies set guardrails across projects — for example, blocking public IPs, external sharing or service account key creation.

• Understand constraints and inheritance
• Apply common security constraints
• Use dry-run before enforcing

Tools & tech: GCP

• Organization Policy Service — Introduction

VPC firewall rules and hierarchical policies control traffic. Private Google Access and removing public IPs keep workloads off the internet.

• Write least-privilege firewall rules
• Use tags or service accounts as targets
• Remove unnecessary public IPs

Tools & tech: GCP

• Cloud NGFW / VPC firewall rules

Cloud Storage buckets must not be public by accident. Use uniform bucket-level access, public access prevention and IAM.

• Enable public access prevention
• Use uniform bucket-level access
• Control access with IAM

Tools & tech: GCP

• Cloud Storage — Best practices

Cloud KMS manages encryption keys. Customer-managed keys give you control over rotation and who can decrypt.

• Create keys and rings
• Grant encrypt/decrypt permissions narrowly
• Configure rotation

Tools & tech: GCP

• Cloud Key Management Service overview

Cloud Audit Logs record admin and data access; Security Command Center finds misconfigurations and threats across the organization.

• Understand audit log types and enable data access logs
• Export logs centrally
• Review SCC findings

Tools & tech: GCP

• Cloud Audit Logs overview
• Security Command Center overview

Google Kubernetes Engine adds cluster-level controls: private clusters, Workload Identity, node hardening and policy enforcement.

• Create a private cluster
• Use Workload Identity instead of keys
• Apply basic Kubernetes security controls

Tools & tech: GCP

• GKE security overview

Service accounts are identities for workloads. Leaked service account keys are a major risk; avoid keys and grant minimal roles.

• Avoid creating service account keys
• Use attached service accounts and Workload Identity
• Grant minimal roles

Tools & tech: GCP

• Best practices for using service accounts

Frequent issues include public buckets, overly broad basic roles, service account keys, open firewall rules and missing audit logs.

• Recognize common misconfigurations
• Use Security Command Center to find them
• Fix them with org policies

Tools & tech: GCP

Learn it on CyberA4U:Module 21: Cloud Environment Attack Techniques

• Security Command Center overview

Event Threat Detection and audit-log queries detect threats such as leaked credentials, crypto-mining and data exfiltration.

• Understand managed detections
• Write log queries for risky actions
• Route findings to responders

Tools & tech: GCP

• Event Threat Detection overview

Responding in Google Cloud means disabling compromised identities, isolating VMs with firewall rules, snapshotting disks and reviewing audit logs.

• Disable compromised service accounts and keys
• Isolate and snapshot VMs
• Investigate with audit logs

Tools & tech: GCP

• Google Cloud — Data incident response process

Google's enterprise foundations blueprint describes a secure baseline for new organizations and projects.

• Build a baseline from the foundations blueprint
• Automate it with org policies and IaC
• Review it regularly

Tools & tech: GCP

• Google Cloud — Enterprise foundations blueprint

Check that you can secure a Google Cloud project's identities, network, data and logging.

• Apply least-privilege IAM and org policies
• Secure network and storage
• Detect and respond using logs and SCC

• CyberA4U CTF Arena — practice challenges

You can now secure common Google Cloud workloads. Consider the Google Professional Cloud Security Engineer certification and continue with Kubernetes Security or Cloud Detection & Response.

• Keep your baseline documented
• Choose your next roadmap
• Share one lesson learned

• CyberA4U CTF Arena — practice challenges