Cloud Security Foundation

Hello,Our application (Project ID: smtp-campaignbutler) is currently in the "Pending developer action" state in the Verification Center.The console instructed us to "Reply to your email thread with our Trust and Safety team". However, we have not received this email, after thoroughly checking all inboxes and spam folders for our registered developer contact email addresses.We have already resolved the two issues that were required:1. The homepage domain has been verified in Google Search Console.2. A link to our Privacy Policy has been added to the homepage footer.Since we cannot find the email to reply to, and our current support plan does not allow us to open a direct tech support case, we are hoping someone from the community or a Googler can advise on how to notify the Trust & Safety team that our fixes are complete.How can we move forward with the review process?Thank you for your help.

Hi,I'm completely locked out of my Google Cloud project (PII Removed by Staff), which I created using my personal Google Account (PII Removed by Staff). I built this project to authorize Gmail access for my WinUI 3 application using OAuth. I now receive this message when trying to access the project: You need additional access to the project...Missing permissions: resourcemanager.projects.getserviceusage.services.list Trying to use the IAM Troubleshooter results in this error: You do not have the required permissions to troubleshoot policies on the specified resource or the resource does not exist. The project no longer shows up in my console — I can't select or manage it anywhere. I’m not part of any Google Workspace or organization. I’m just an individual developer trying to recover access to something I built. I don’t know what changed. Troubleshooter URL:https://console.cloud.google.com/iam-admin/troubleshooter;permissions=resourcemanager.projects.get,serviceusage.services.list;pri

I am really surprised (rather appalled) to know GCP wants users to upload TLS Certificates and their private keys in to the Certificate Manager for being referenced by the services such as Application Load Balancers. Though its secured with encryption at rest, there are chances of unnecessary exposure by human error in handling the private keys at the first place and as a responsible CSP, I would expect GCP to do something about this. At its face, it appeals to be a not-so-secure practice. I can understand even if the requirement is to upload PFX and password or even better an option to generate a CSR, that can be signed by an External CA and only the signed certificate need to be uploaded. I want to hear the story on the side of GCP Engineering on their choice for users to upload private keys directly. Though Certificate Manager is not a security product, I hope I can attract the attention of the Security Experts in contributing to this question.

I have been trying to deploy and run a simple Firebase Cloud Function. Every attempt fails due to what appears to be a fundamental issue with service account creation and authentication context in my project.Symptoms:When calling the function, the context.auth object is always null or undefined, even when the client sends a valid, verified ID token. The function logs show The function must be called while authenticated. During deployment, I am now receiving the error: Error: Error generating the service identity for pubsub.googleapis.com.We have already verified the following:The project is linked to an active billing account. All necessary APIs are enabled (Cloud Functions, Cloud Build, Run, Artifact Registry, IAM, etc.). We have tried manually adding IAM service accounts and toggling the Cloud Functions API off and on. We have removed all restrictions from the browser API key.The project seems unable to correctly manage its own service identities and pass authentication context to it

The rise of AI and agents is fueling API sprawl, making it harder than ever to govern your network and detect dangerous "shadow APIs." +This article introduces key enhancements to API discovery in Apigee Advanced API Security, a critical feature designed to automatically find and manage undocumented APIs across your organization. Product Manager, Megan Bruce details the new Google Cloud-wide scope and agentless observation that leverage your L7 Application Load Balancers. The new integration with Apigee API hub allows for automatic comparison against cataloged APIs, providing a centralized view to help you eliminate security risks and bring all your assets under secure management.Want to learn how to automatically detect, govern, and secure every API across your Google Cloud projects? Discover the complete process in our guide ➡ https://goo.gle/48YHamZ 

Hi experts, Am new to DLP. trying out the possibilities of usage in our Org.Use-case:Our primary intended use-case is to be able to de-identify(by masking) all the documents in our cloud storage buckets of a project for PII, PCI and other sensitive information covered by the DLP infotypes. If our application service account needs to access the objects in the bucket, it should be able to read clear values in the JSON files, csv files etc. But people accessing the buckets through AD groups, should see masked values.My question: What is a good(simple) solution architecture to enable this set-up/use-case?

I am a comfortable user of Cloud Armor WAF for my GCP Application Loadbalancers. One thing that wants me shop for other WAF vendors is the traceability of blocked connection attempts. By design, Cloud Armor does not provide this for connections blocked due to Preconfigured or IP based deny rules. This was probably done with the intent of obscurity to non-compliant connection attempts, but this is hitting the adminstrators hard. Without uniquely traceable strings, adminstrators have to beat around the bush with other identifiers such as timestamps, IP addresses etc., which is cumbersome in a heavily used environment. Given that this a standard feature of any WAF vendor in the market, I think its a very fair ask.

Check out this article that shares results presented at DEFCON 32 about secret findings.TL;DR We scanned 8,400+ public GCP images and did not find a single exposed secret! That’s a dramatic reversal compared to the hundreds we found in AWS AMIs and dozens in Azure Public images. GCP’s curated, tightly- controlled image marketplace has seemingly eliminated secret exposure in its cloud images.https://trufflesecurity.com/blog/guest-post-gcp-cloudquarry-searching-for-secrets-in-public-gcp-images

Hello Learners,  Identity is so core to security that we as a community can often take it for granted, but keeping your skills sharp in the identity space leads to a great first, middle and last line of defense in the cloud. So build defense in depth and assume breach, but no matter what spend some time with our new skill badge that dives into Privileged Access Management on Google Cloud Skills Boost.  This skill badge is a chance to work through labs that build up to the critical just in time access capability provide by Privileged Access Management on Google Cloud. From custom roles to identity aware proxies, you'll take a tour of identity aligned labs that can help harden you identity posture on Google Cloud.  COURSE INFO AND LINK "Complete the intermediate Privileged Access with IAM skill badge to demonstrate skills in the following: custom roles using Identity and Access Management (IAM), the principle of least privilege, Just-in-Time (JIT) temporary eleva

Join Google's confidential computing portfolio product experts to learn how you can get an unparalleled shield for sensitive data and algorithms, ensuring they remain protected even while in use. Check out live demos on how to leverage this one-of-a-kind transformative technology to secure your AI workloads across their entire lifecycle, from development to deployment.  Jun 26 2025, 8:00am PDT Speakers: Sam Lugani, Group Product Manager Joanna Young, Product Manager Meghna Sreenivasan, Product Manager It's going to be a power packed session, you don't want to miss it! Register here  @lugani @markcorak 

       Malicious webhooks can be a significant security risk, allowing attackers to exfiltrate data, trigger unauthorized actions, or maintain persistence within your systems.        This guide will walk you through purging malicious webhooks using Google tools, from beginner concepts to advanced administrative techniques.       How-To Guide: Purging Malicious Webhooks with Google Tools:   I. Beginner Level: Understanding Webhooks and Basic SecurityWhat is a Webhook?         Imagine a webhook as an automated message sent from one application to another when a specific event occurs. It's essentially a "user-defined HTTP callback." For example, a webhook could notify your team's chat when a new customer signs up, or trigger a build process when code is committed to a repository.How can Webhooks be Malicious?A malicious webhook is one that is either: ✓ Compromised: An attacker gai

Hello, I am an Organization Administrator (`roles/resourcemanager.organizationAdmin`) for my Google Cloud Organization, but I'm encountering a persistent "permission denied" error when trying to disable the `constraints/iam.allowedPolicyMemberDomains` organization policy. This issue occurs even when running the command from Cloud Shell. **My Goal:** I need to make a Cloud Run service (`sharky-chat-service` in project `chat-bot-social`) publicly accessible by granting `allUsers` the `roles/run.invoker` role. To do this, I first need to modify or disable the `constraints/iam.allowedPolicyMemberDomains` organization policy, which is currently restricting IAM members to my organization's customer ID. **Details:** * **Organization ID:** `275283949867` * **User Account:** `Admin@sharkteam.[domain-redacted-due-to-filter]` * **Project ID (for context):** `chat-bot-social` * **Cloud Run Service (for context):** `sharky-chat-service` * **Region (for context):** `europe-central2` **Current Ef

Secure Enterprise Blueprints are critical set of assets in our Security Foundation Solution. You can hear from @sleighton our Principal Architect in Google Cloud.Check this webinar on 05/29 to register learn more:https://www.brighttalk.com/webcast/18282/643736

There are many new capabilities available now in IAM, Access Risk, and Cloud Governance. Check this blog to see all things new announced at Next 2025. https://cloud.google.com/blog/products/identity-security/whats-new-in-iam-access-risk-and-cloud-governance?e=48754805 

If you are at RSA 2025, join us on the expo floor. We have action packed security foundations topics happening all 3 days Apr 29-May 1st on the expo floor. Find the Google Cloud Security team on the show floor at booth #N-6062 in the Moscone Center, North Hall. Here you can: Meet with our security experts: Engage in one-on-one conversations on foundational cloud security topics and discover how making Google a part of your security team Check out live presentations: Theater presentations at booth on April 29th, 30th at 3PM and 4:40PM, and May 1st at 12:40PM. Topics covered include Cloud Armor for DDoS Protection, Cloud NGFW for firewall, and VPC Service Controls for mitigating data exfiltration. Don't miss us!

Security Practitioners, you do not want to miss this one! We have an exciting webinar coming up tomorrow in our Security Foundation webinar series - it's on Virtual Red Teaming topic.https://www.brighttalk.com/webcast/18282/639711 Security Command Center (SCC) delivers the best protection for Google Cloud and its unique virtual red teaming capability continuously simulates millions of attack permutations against a digital twin of your cloud environment - helping you to effectively manage risk!  Join and hear from our experts - Doug Ko @pandamoose and Gary Oppel.

Hi All -  Check this blog post on how you can define and maintain a secure cloud platform for your workloads. Google Cloud provides many foundational security controls for you to build a layered defense architecture in cloud - this blog highlights few of these controls and an overview of using them for securing your infrastructure, data, applications, and AI models. https://www.googlecloudcommunity.com/gc/Community-Blog/Protecting-your-Google-Cloud-Workloads-Foundational-Controls-and/ba-p/890701 

Hello Google Cloud Community, I'm seeking help with a persistent issue accessing the OAuth Consent Screen for my Google Cloud project. Context: Project ID: youtubeAccount: Using a standard @gmail.com account (PII Removed by Sraff)Project Type: This is a standalone project, not part of any Google Cloud Organization structure.IAM Role: I have verified via the IAM & Admin > IAM page that my account (PII Removed by Staff) has the "Owner" role for this project.Problem: Despite having the Owner role, I cannot access the OAuth Consent Screen configuration page: When navigating via the GCP Console menu (APIs & Services > OAuth consent screen), I am incorrectly redirected to an "OAuth Overview / Google Auth Platform" page showing metrics, not the actual configuration settings. When attempting to access the consent screen via the direct URL (https://console.cloud.google.com/apis/credentials/consent?project=youtube - replacing youtube with the actual project ID if different), I rece

How can we limit which VM types users can spin up to control costs, and what's a safe way to roll out this change without breaking things? Any tips greatly appreciated!

Our team is planning to implement the OWASP Top 10 WAF rules using Google Cloud Armor to enhance our application security. What are the best practices?

Heads up, Security Foundation Community! If you're planning to attend Google Cloud Next, don't miss this important session: Want to solidify your Google Cloud security from the ground up? Join @anilnandigam at the Start secure, stay secure: Build a strong cloud security foundation session. Learn how Google Cloud's Security Foundation and shared fate model offer clear guidance for securing your entire cloud environment. Be sure to add this must-attend session to your Next '25 agenda and save your seat. Let us know in the comments if you'll be there. See you at Next!

Hi everyone, A big welcome to all new members joining the Google Cloud Security Foundation forum! This space is dedicated to discussing the core principles, best practices, and essential services for building a secure foundation on Google Cloud Platform. We focus specifically on understanding and utilizing the cloud-first security controls that are integral parts of the Google Cloud platform itself. Topics we often cover here include these core platform controls: Identity and Access Management (IAM) fundamentals Network security basics (VPCs, Firewall Rules, Cloud Armor basics) Data security concepts (Encryption at rest/in transit) Logging and Monitoring essentials (Cloud Logging, Cloud Monitoring) Understanding the Shared Fate Model on Google Cloud Cloud Security Posture Management & more Regulations and compliance standards Please feel free to: Introduce yourself! Let us know a bit about your background and what you hope to learn or discuss. Ask questions. No question is too b