Skip to main content

Cloud Security Foundation

Join us to discuss built-in cloud platform security controls in IAM, Network Security, Data Security, and Compliance. Connect with other Google Cloud Security experts to discuss best practices, troubleshooting, and the latest updates on Google Cloud Platform security products like Cloud Identity, VPC Service Controls, Cloud Armor, Cloud NGFW, Sensitive Data Protection, Confidential Compute, and Assured Workloads.

  • 17 Topics
  • 14 Replies
17 Topics
Seethaar
SeethaarNew Member
asked in Cloud Security Foundation
Insecure practice of uploading TLS certificate private keys in to Certificate Manager

I am really surprised (rather appalled) to know GCP wants users to upload TLS Certificates and their private keys in to the Certificate Manager for being referenced by the services such as Application Load Balancers. Though its secured with encryption at rest, there are chances of unnecessary exposure by human error in handling the private keys at the first place and as a responsible CSP, I would expect GCP to do something about this. At its face, it appeals to be a not-so-secure practice. I can understand even if the requirement is to upload PFX and password or even better an option to generate a CSR, that can be signed by an External CA and only the signed certificate need to be uploaded. I want to hear the story on the side of GCP Engineering on their choice for users to upload private keys directly. Though Certificate Manager is not a security product, I hope I can attract the attention of the Security Experts in contributing to this question.

100
Seethaar
C
crazyrevolNew Member
posted in Cloud Security Foundation
DLP discovery, scan and creation of redacted copy

Hi experts, Am new to DLP. trying out the possibilities of usage in our Org.Use-case:Our primary intended use-case is to be able to de-identify(by masking) all the documents in our cloud storage buckets of a project for PII, PCI and other sensitive information covered by the DLP infotypes. If our application service account needs to access the objects in the bucket, it should be able to read clear values in the JSON files, csv files etc. But people accessing the buckets through AD groups, should see masked values.My question: What is a good(simple) solution architecture to enable this set-up/use-case?

11
Guiimeris
ScienceCat
Staff
ScienceCatStaff
posted in Cloud Security Foundation
Skill Badge Launch Announcement: Privileged Access with IAM

Hello Learners,  Identity is so core to security that we as a community can often take it for granted, but keeping your skills sharp in the identity space leads to a great first, middle and last line of defense in the cloud. So build defense in depth and assume breach, but no matter what spend some time with our new skill badge that dives into Privileged Access Management on Google Cloud Skills Boost.  This skill badge is a chance to work through labs that build up to the critical just in time access capability provide by Privileged Access Management on Google Cloud. From custom roles to identity aware proxies, you'll take a tour of identity aligned labs that can help harden you identity posture on Google Cloud.  COURSE INFO AND LINK "Complete the intermediate Privileged Access with IAM skill badge to demonstrate skills in the following: custom roles using Identity and Access Management (IAM), the principle of least privilege, Just-in-Time (JIT) temporary eleva

00
ScienceCat
Staff
anilnandigam
Staff
anilnandigamStaff
posted in Cloud Security Foundation
06/26 Webinar Alert - Protect your data always (even in use) with Confidential Computing!

Join Google's confidential computing portfolio product experts to learn how you can get an unparalleled shield for sensitive data and algorithms, ensuring they remain protected even while in use. Check out live demos on how to leverage this one-of-a-kind transformative technology to secure your AI workloads across their entire lifecycle, from development to deployment.  Jun 26 2025, 8:00am PDT Speakers: Sam Lugani, Group Product Manager Joanna Young, Product Manager Meghna Sreenivasan, Product Manager It's going to be a power packed session, you don't want to miss it! Register here  @lugani @markcorak 

00
anilnandigam
Staff
A
andrey_petranNew Member
posted in Cloud Security Foundation
Locked out of my own Google Cloud project — no access and no support options

Hi,I'm completely locked out of my Google Cloud project (PII Removed by Staff), which I created using my personal Google Account (PII Removed by Staff). I built this project to authorize Gmail access for my WinUI 3 application using OAuth. I now receive this message when trying to access the project: You need additional access to the project...Missing permissions: resourcemanager.projects.getserviceusage.services.list Trying to use the IAM Troubleshooter results in this error: You do not have the required permissions to troubleshoot policies on the specified resource or the resource does not exist. The project no longer shows up in my console — I can't select or manage it anywhere. I’m not part of any Google Workspace or organization. I’m just an individual developer trying to recover access to something I built. I don’t know what changed. Troubleshooter URL:https://console.cloud.google.com/iam-admin/troubleshooter;permissions=resourcemanager.projects.get,serviceusage.services.list;pri

40
A
DailyInvestors
DailyInvestorsBronze 1
posted in Cloud Security Foundation
WebHooks

       Malicious webhooks can be a significant security risk, allowing attackers to exfiltrate data, trigger unauthorized actions, or maintain persistence within your systems.        This guide will walk you through purging malicious webhooks using Google tools, from beginner concepts to advanced administrative techniques.       How-To Guide: Purging Malicious Webhooks with Google Tools:   I. Beginner Level: Understanding Webhooks and Basic SecurityWhat is a Webhook?         Imagine a webhook as an automated message sent from one application to another when a specific event occurs. It's essentially a "user-defined HTTP callback." For example, a webhook could notify your team's chat when a new customer signs up, or trigger a build process when code is committed to a repository.How can Webhooks be Malicious?A malicious webhook is one that is either: ✓ Compromised: An attacker gai

40
DailyInvestors
S
SharkTeamNew Member
asked in Cloud Security Foundation
Org Admin: Perm. Denied Disabling Org Policy (iam.allowedPolicyMemberDomains) - Fails in Cloud Shell

Hello, I am an Organization Administrator (`roles/resourcemanager.organizationAdmin`) for my Google Cloud Organization, but I'm encountering a persistent "permission denied" error when trying to disable the `constraints/iam.allowedPolicyMemberDomains` organization policy. This issue occurs even when running the command from Cloud Shell. **My Goal:** I need to make a Cloud Run service (`sharky-chat-service` in project `chat-bot-social`) publicly accessible by granting `allUsers` the `roles/run.invoker` role. To do this, I first need to modify or disable the `constraints/iam.allowedPolicyMemberDomains` organization policy, which is currently restricting IAM members to my organization's customer ID. **Details:** * **Organization ID:** `275283949867` * **User Account:** `Admin@sharkteam.[domain-redacted-due-to-filter]` * **Project ID (for context):** `chat-bot-social` * **Cloud Run Service (for context):** `sharky-chat-service` * **Region (for context):** `europe-central2` **Current Ef

32
S
anilnandigam
Staff
anilnandigamStaff
asked in Cloud Security Foundation
Webinar alert on 05/29: All things you need to know about Secure Enterprise Blueprints

Secure Enterprise Blueprints are critical set of assets in our Security Foundation Solution. You can hear from @sleighton our Principal Architect in Google Cloud.Check this webinar on 05/29 to register learn more:https://www.brighttalk.com/webcast/18282/643736

01
C
anilnandigam
Staff
anilnandigamStaff
posted in Cloud Security Foundation
What's new in IAM, Access Risk and Cloud Governance!

There are many new capabilities available now in IAM, Access Risk, and Cloud Governance. Check this blog to see all things new announced at Next 2025. https://cloud.google.com/blog/products/identity-security/whats-new-in-iam-access-risk-and-cloud-governance?e=48754805 

00
anilnandigam
Staff
anilnandigam
Staff
anilnandigamStaff
posted in Cloud Security Foundation
RSA 2025 - Come join us to learn about Cloud Security Foundations

If you are at RSA 2025, join us on the expo floor. We have action packed security foundations topics happening all 3 days Apr 29-May 1st on the expo floor. Find the Google Cloud Security team on the show floor at booth #N-6062 in the Moscone Center, North Hall. Here you can: Meet with our security experts: Engage in one-on-one conversations on foundational cloud security topics and discover how making Google a part of your security team Check out live presentations: Theater presentations at booth on April 29th, 30th at 3PM and 4:40PM, and May 1st at 12:40PM. Topics covered include Cloud Armor for DDoS Protection, Cloud NGFW for firewall, and VPC Service Controls for mitigating data exfiltration. Don't miss us!

11
anilnandigam
Staff
anilnandigam
Staff
anilnandigamStaff
posted in Cloud Security Foundation
Webinar alert - How to uncover hidden risk with virtual red teaming.

Security Practitioners, you do not want to miss this one! We have an exciting webinar coming up tomorrow in our Security Foundation webinar series - it's on Virtual Red Teaming topic.https://www.brighttalk.com/webcast/18282/639711 Security Command Center (SCC) delivers the best protection for Google Cloud and its unique virtual red teaming capability continuously simulates millions of attack permutations against a digital twin of your cloud environment - helping you to effectively manage risk!  Join and hear from our experts - Doug Ko @pandamoose and Gary Oppel.

11
P
Staff
anilnandigam
Staff
anilnandigamStaff
posted in Cloud Security Foundation
Cloud Platform Security: Foundational Controls and Strategies

Hi All -  Check this blog post on how you can define and maintain a secure cloud platform for your workloads. Google Cloud provides many foundational security controls for you to build a layered defense architecture in cloud - this blog highlights few of these controls and an overview of using them for securing your infrastructure, data, applications, and AI models. https://www.googlecloudcommunity.com/gc/Community-Blog/Protecting-your-Google-Cloud-Workloads-Foundational-Controls-and/ba-p/890701 

20
anilnandigam
Staff
M
mentawaiisurfarNew Member
posted in Cloud Security Foundation
Unable to Access OAuth Consent Screen (Access Denied) Despite Owner Role on Standalone Project

Hello Google Cloud Community, I'm seeking help with a persistent issue accessing the OAuth Consent Screen for my Google Cloud project. Context: Project ID: youtubeAccount: Using a standard @gmail.com account (PII Removed by Sraff)Project Type: This is a standalone project, not part of any Google Cloud Organization structure.IAM Role: I have verified via the IAM & Admin > IAM page that my account (PII Removed by Staff) has the "Owner" role for this project.Problem: Despite having the Owner role, I cannot access the OAuth Consent Screen configuration page: When navigating via the GCP Console menu (APIs & Services > OAuth consent screen), I am incorrectly redirected to an "OAuth Overview / Google Auth Platform" page showing metrics, not the actual configuration settings. When attempting to access the consent screen via the direct URL (https://console.cloud.google.com/apis/credentials/consent?project=youtube - replacing youtube with the actual project ID if different), I rece

20
M
C
CloudSecNinjaBronze 3
asked in Cloud Security Foundation
VM Type Restrictions & Safe Rollout - Seeking Advice!

How can we limit which VM types users can spin up to control costs, and what's a safe way to roll out this change without breaking things? Any tips greatly appreciated!

11
A
Staff
C
CloudSecNinjaBronze 3
asked in Cloud Security Foundation
Cloud Armor & OWASP Top 10 WAF

Our team is planning to implement the OWASP Top 10 WAF rules using Google Cloud Armor to enhance our application security. What are the best practices?

11
O
Staff
markcorak
Staff
markcorakStaff
asked in Cloud Security Foundation
Learn how to build a strong Cloud Security Foundation at Google Cloud Next!

Heads up, Security Foundation Community! If you're planning to attend Google Cloud Next, don't miss this important session: Want to solidify your Google Cloud security from the ground up? Join @anilnandigam at the Start secure, stay secure: Build a strong cloud security foundation session. Learn how Google Cloud's Security Foundation and shared fate model offer clear guidance for securing your entire cloud environment. Be sure to add this must-attend session to your Next '25 agenda and save your seat. Let us know in the comments if you'll be there. See you at Next!

03
P
Staff
anilnandigam
Staff
anilnandigamStaff
asked in Cloud Security Foundation
Welcome to Security Foundation - Discuss all things Google Cloud platform security!

Hi everyone, A big welcome to all new members joining the Google Cloud Security Foundation forum! This space is dedicated to discussing the core principles, best practices, and essential services for building a secure foundation on Google Cloud Platform. We focus specifically on understanding and utilizing the cloud-first security controls that are integral parts of the Google Cloud platform itself. Topics we often cover here include these core platform controls: Identity and Access Management (IAM) fundamentals Network security basics (VPCs, Firewall Rules, Cloud Armor basics) Data security concepts (Encryption at rest/in transit) Logging and Monitoring essentials (Cloud Logging, Cloud Monitoring) Understanding the Shared Fate Model on Google Cloud Cloud Security Posture Management & more Regulations and compliance standards Please feel free to: Introduce yourself! Let us know a bit about your background and what you hope to learn or discuss. Ask questions. No question is too b

33
anilnandigam
Staff

Badge winners

  • Authored Posts 5
    leodashas earned the badge Authored Posts 5
  • Authored Posts 5
    delstonhas earned the badge Authored Posts 5
  • Authored Posts 1
    SaDaVFhas earned the badge Authored Posts 1
  • Authored Posts 5
    hzmndthas earned the badge Authored Posts 5
  • Solution 10
    hzmndthas earned the badge Solution 10
Show all badges
Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.