Cloud Security Foundation

in my project show this message “My Project (id: bionic-xxxx) is being suspended for repeatedly violating our Google Cloud Platform Terms of Service or Acceptable Use Policy (including Terms of Service of the Google API you may be using). “ and I can not do anything on my project.How can I fix this problem? I submitted a request a long time ago, but I haven't received a response from Google support yet.-Does anyone have a solution? Please help me.

Hello, I am seeking a manual escalation from a Community Manager or Admin. I am a Startup EdTech Lead caught in a documented "Infinite Support Loop" that has halted our academic research for nearly three weeks.The Deadlock: Trust & Safety (Case # [removed by moderator] ): On 5/4, I submitted a comprehensive technical Root Cause Analysis (RCA). I detailed our "Magic Byte" pre-flight validation fix and the air-gapping of the corrupted legacy dataset that triggered the "Abusive Activity" flag (due to 404/HTML payloads from a third-party source). There has been zero response for 19 days. Cloud Billing Support (Case #70072588): Agent Kervin has officially closed our support ticket, stating: "Resolving account-level restrictions... falls entirely outside our support boundaries. We do not have the administrative access to lift this restriction [or] redirect the case

Hi everyone,I'm facing a critical remediation blocker following a "Hijacked Resource" suspension on theproject. While I am eager to secure my environment and rotate all potentially compromised credentials, I am trapped in a redirect loop that prevents administrative action.The Technical Problem:Whenever I navigate to IAM & Admin or APIs & Services, the GCP Console performs a forced redirect to the suspension warning page. This means I cannot revoke existing API keys or Audit Service Account activity through the standard UI.Investigation Status:Audit: Local .env files and Git history have been reviewed, but I suspect a credential may have been intercepted or leaked elsewhere. Timeline: Appeal submitted 7+ days ago; no response received. Production environment remains offline.Seeking Expert Advi

Hi everyone,I'm facing a critical remediation blocker following a "Hijacked Resource" suspension on theproject. While I am eager to secure my environment and rotate all potentially compromised credentials, I am trapped in a redirect loop that prevents administrative action.The Technical Problem:Whenever I navigate to IAM & Admin or APIs & Services, the GCP Console performs a forced redirect to the suspension warning page. This means I cannot revoke existing API keys or Audit Service Account activity through the standard UI.Investigation Status:Audit: Local .env files and Git history have been reviewed, but I suspect a credential may have been intercepted or leaked elsewhere. Timeline: Appeal submitted 7+ days ago; no response received. Production environment remains offline.Seeking Expert Advi

Hi everyone,We are looking for Terraform templates, gcloud scripts, or proven configuration snippets suggested by GCP to optimize our GCP Cloud Armor setup. We want to avoid manual, granular signature allowlisting, as it isn't scalable and risks broadening our attack surface.Current Setup & Threats: Running standard OWASP rules (sqli-v33-stable, xss-v33-stable) and rate limiting. Actively targeted by (and needing protection from) scanners, credential stuffing, and SQLi/XSS probes. The Problems We're Facing: False Positives on APIs: Our legitimate traffic relies on complex API endpoints and large nested JSON payloads with special characters, which frequently trigger WAF blocks. Postman Blocked: Our Dev/QA teams use Postman for internal test

Hello,I am seeking help to resolve a Google Cloud account restriction that has been in place since April 1st, 2026. My service was flagged for "unauthorized activity" immediately after a staff member tried to log in via LINE's in-app browser (which I later confirmed caused a disallowed_useragent error).The problem is that my appeals have been stuck in "Processing" for over a week with no updates. In my anxiety to fix this for my school's operations, I accidentally opened three cases for the same issue:Primary Case ID: [removed by moderator] Related IDs: [removed by moderator] , [removed by moderator] I am the ICT manager for a kindergarten in Japan, and this app is essential for our staff's paid leave management. I have already provided the technical explanation in the appeals, but there has been no progress.Could a community expert or Google staff member please help me consolidate these cases and escalate the review?Thank you for you

I am requesting the ability to disable "Google Prompts" (Push notifications) without signing out of my mobile devices. Currently, Google defaults to Push even when a more secure TOTP (authenticator) or hardware key is available. This creates a high risk of "Push Fatigue" attacks where a single accidental tap grants unauthorized access. Users should have the option to choose their primary 2FA method for high-security accounts. I believe this lack of control over 2FA increases the success rate of Account Takeover (ATO) attempts, as attackers can exploit Push Fatigue during the credential recovery process.  Unfortunately, my Gmail address has been compromised in a number of third-party breaches, and I am subject to frequent ATO attempts.  Because I use VPN, a push notification alerting me to a login attempt from a remote city is not necessarily a red flag for me.  But the bigger concern I have is the inadvertent tap--my screen wakes up, my left thumb is in the wrong place

"Hi Community!I’m an Innovator currently pushing through the final two modules of the Beginner Cloud Security path. I’ve finished almost 3 models so far, but I’m feeling the mental exhaustion!My big question for those who have already 'gotten in' or are currently hiring: Is completing these Skill Badges truly enough to land an entry-level job?I’m aiming for the Employer Consortium, but I’d love guidance on:Should I do a specific project after this to prove my skills? Are there others here currently on the same path who want to study the final labs together? For those who got hired what was the one thing that made the difference?Here is my progress so far: [https://www.skills.google/public_profiles/16f2724f-67cf-

I want to join cohort which about to take place around April 2026 which is strictly requires corporate email and im Self-study and i was kindly ask is there any alternative way to join and if this is the right place to say this if not can you please direct me to the right group.  Thank you.

Since serviceAccountTokenCreator enables service account impersonation and token minting, I’m curious about more least-privilege alternatives, such as - Using the Custom Cloud Build service account identity directly Relying on Cloud Run IAM invoker bindings (in case of cloud run invocation from cloud buuld Avoiding explicit token creation unless absolutely required When is iam.serviceAccountTokenCreator truly required?

Curious what auditors and GRC teams are actually using in 2026 to assess cloud environments, especially GCP-heavy ones.Most “cloud security tools” are built for SecOps. From an audit perspective, the needs are different: Read-only access and short engagement windows Clean scoping across orgs, folders, and projects Evidence that holds up without endless screenshots Repeatability across SOC 2, PCI, ISO, HITRUST Less alerting, more defensible outputs How I currently see the landscape:Large CSPM PlatformsWiz, Prisma Cloud, Orca, LaceworkGreat coverage if a client already has them, but expensive and often awkward for point-in-time audit evidence. Strong security tools, not audit-first.Cloud-Native & Open SourceGCP Security Command Center, Prowler, ScoutSuite, CloudQueryExcellent raw data and flexib

Hi Community,I am currently architecting a security hardening roadmap for a client using Google Workspace (upgrading from basic settings).We are planning to implement Context-Aware Access and a Zero Trust model, but I am analyzing the potential friction with end-users (specifically in a Spanish-speaking non-tech environment).My question for the experts here: In your experience, what are the most common "blind spots" or pitfalls when moving from a legacy setup to a Zero Trust model in GWS?I'm interested in hearing about architectural challenges or specific configurations in DLP that you recommend prioritizing to avoid false positives during the transition.Any advice or resources on this transition strategy would be greatly appreciated.Thanks!

I’m running mysql 8.0.26-google cloudsql instancecloudsql_iam_authentication flag = ONBUT the authentication_iam plugin is not getting loaded.when I run SELECT PLUGIN_NAME, PLUGIN_STATUSFROM INFORMATION_SCHEMA.PLUGINSWHERE PLUGIN_NAME LIKE '%iam%';I getgcp_iam_authgcp_iam_group_auth According to ChatGPT, these are Postgresql plugins, not mysql.   

Hi Anil and Security Foundation Community, ​As we discuss the core pillars of cloud security (IAM, Encryption, Logging), I want to share a critical finding that challenges our understanding of the "Secure Foundation" for AI and legacy hardware integration. ​I am Davey Hoogland,Security Researcher, independant AI researcher and Author of the Hoogland methodology and contextarchitecting.  My recent research—currently under VRP review and peer review at Springer Nature—demonstrates a vulnerability that bypasses traditional cloud-first security controls by exploiting Cyber-Physical Context. ​The Vulnerability: The "Impossible" Attribution ​Using the Hoogland Methodology, I successfully injected a verified copyright attribution (© 2023 by Davey Hoogland) into the firmware of a deprecated, offline Google Project Tango device. ​Why this matters for Cloud Foundation: According to standard IAM and Network Sec

I’ve created a firewall rule to stop all traffic on all protocols from all countries except one.However when I look at my VMs network stats, the chart titled “Firewall incoming packets denied” shows less than one packet stopped per second.This is during a DDOS attack with millions of hits per second from around the world.How come the firewall does not stop 99% of these, if 99% of all countries are blocked?

Hello,Our application (Project ID: smtp-campaignbutler) is currently in the "Pending developer action" state in the Verification Center.The console instructed us to "Reply to your email thread with our Trust and Safety team". However, we have not received this email, after thoroughly checking all inboxes and spam folders for our registered developer contact email addresses.We have already resolved the two issues that were required:1. The homepage domain has been verified in Google Search Console.2. A link to our Privacy Policy has been added to the homepage footer.Since we cannot find the email to reply to, and our current support plan does not allow us to open a direct tech support case, we are hoping someone from the community or a Googler can advise on how to notify the Trust & Safety team that our fixes are complete.How can we move forward with the review process?Thank you for your help.

# DSSRF DefendAgainstSSRFAgainstMetadataEndpointIn many cloud environments, virtual machines expose a special internal service that provides identity material and configuration details. On Google Cloud, this internal interface is reachable through a link‑local address and is intended only for trusted, local use. If an application unintentionally forwards user‑controlled URLs to this internal address, sensitive workload credentials may be exposed.dssrf introduces a strict request‑validation layer for Node.js applications. Instead of allowing arbitrary destinations, it evaluates every outbound URL and rejects anything that resolves to internal network locations. This includes link‑local addresses, private ranges, IPv6 variants, and any hostname that ultimately maps to those spaces.The library also blocks indirect paths such as multi‑step redirects or DNS tricks that attempt to disguise an internal target. By enforcing a predictable and tightly scoped outbound‑requ

We have just enrolled in Cloud Armor paygo.Two attacks have been identified already. The dashboard reads “Mitigation is enforced. No action is required”.But the VM is still unavailable when we allow external traffic.What else can we do?

Hey all,We are using domain restricted sharing https://docs.cloud.google.com/resource-manager/docs/organization-policy/restricting-domains#predefined-constraint for our organization.We are just looking to add ` [removed by moderator] ` as a member to our pub/sub topic in a project. But because of the domain restrictions we are not able to add the internal google cloud account as the member. Does anyone know how we can get the principal set/customer id for a internal google cloud account? [ie: account which is owned by google]

Hi,I'm completely locked out of my Google Cloud project (PII Removed by Staff), which I created using my personal Google Account (PII Removed by Staff). I built this project to authorize Gmail access for my WinUI 3 application using OAuth. I now receive this message when trying to access the project: You need additional access to the project...Missing permissions: resourcemanager.projects.getserviceusage.services.list Trying to use the IAM Troubleshooter results in this error: You do not have the required permissions to troubleshoot policies on the specified resource or the resource does not exist. The project no longer shows up in my console — I can't select or manage it anywhere. I’m not part of any Google Workspace or organization. I’m just an individual developer trying to recover access to something I built. I don’t know what changed. Troubleshooter URL:

I am really surprised (rather appalled) to know GCP wants users to upload TLS Certificates and their private keys in to the Certificate Manager for being referenced by the services such as Application Load Balancers. Though its secured with encryption at rest, there are chances of unnecessary exposure by human error in handling the private keys at the first place and as a responsible CSP, I would expect GCP to do something about this. At its face, it appeals to be a not-so-secure practice. I can understand even if the requirement is to upload PFX and password or even better an option to generate a CSR, that can be signed by an External CA and only the signed certificate need to be uploaded. I want to hear the story on the side of GCP Engineering on their choice for users to upload private keys directly. Though Certificate Manager is not a security product, I hope I can attract the attention of the Security Experts in contributing to this que

I have been trying to deploy and run a simple Firebase Cloud Function. Every attempt fails due to what appears to be a fundamental issue with service account creation and authentication context in my project.Symptoms:When calling the function, the context.auth object is always null or undefined, even when the client sends a valid, verified ID token. The function logs show The function must be called while authenticated. During deployment, I am now receiving the error: Error: Error generating the service identity for pubsub.googleapis.com.We have already verified the following:The project is linked to an active billing account. All necessary APIs are enabled (Cloud Functions, Cloud Build, Run, Artifact Registry, IAM, etc.). We have tried manually adding IAM service accounts and toggling the Cloud Functions API off an

The rise of AI and agents is fueling API sprawl, making it harder than ever to govern your network and detect dangerous "shadow APIs." +This article introduces key enhancements to API discovery in Apigee Advanced API Security, a critical feature designed to automatically find and manage undocumented APIs across your organization. Product Manager, Megan Bruce details the new Google Cloud-wide scope and agentless observation that leverage your L7 Application Load Balancers. The new integration with Apigee API hub allows for automatic comparison against cataloged APIs, providing a centralized view to help you eliminate security risks and bring all your assets under secure management.Want to learn how to automatically detect, govern, and secure every API across your Google Cloud projects? Discover the complete process in ou

Hi experts, Am new to DLP. trying out the possibilities of usage in our Org.Use-case:Our primary intended use-case is to be able to de-identify(by masking) all the documents in our cloud storage buckets of a project for PII, PCI and other sensitive information covered by the DLP infotypes. If our application service account needs to access the objects in the bucket, it should be able to read clear values in the JSON files, csv files etc. But people accessing the buckets through AD groups, should see masked values.My question: What is a good(simple) solution architecture to enable this set-up/use-case?

I am a comfortable user of Cloud Armor WAF for my GCP Application Loadbalancers. One thing that wants me shop for other WAF vendors is the traceability of blocked connection attempts. By design, Cloud Armor does not provide this for connections blocked due to Preconfigured or IP based deny rules. This was probably done with the intent of obscurity to non-compliant connection attempts, but this is hitting the adminstrators hard. Without uniquely traceable strings, adminstrators have to beat around the bush with other identifiers such as timestamps, IP addresses etc., which is cumbersome in a heavily used environment. Given that this a standard feature of any WAF vendor in the market, I think its a very fair ask.