Cloud Security Foundation

Hi experts, Am new to DLP. trying out the possibilities of usage in our Org.Use-case:Our primary intended use-case is to be able to de-identify(by masking) all the documents in our cloud storage buckets of a project for PII, PCI and other sensitive information covered by the DLP infotypes. If our application service account needs to access the objects in the bucket, it should be able to read clear values in the JSON files, csv files etc. But people accessing the buckets through AD groups, should see masked values.My question: What is a good(simple) solution architecture to enable this set-up/use-case?

I am a comfortable user of Cloud Armor WAF for my GCP Application Loadbalancers. One thing that wants me shop for other WAF vendors is the traceability of blocked connection attempts. By design, Cloud Armor does not provide this for connections blocked due to Preconfigured or IP based deny rules. This was probably done with the intent of obscurity to non-compliant connection attempts, but this is hitting the adminstrators hard. Without uniquely traceable strings, adminstrators have to beat around the bush with other identifiers such as timestamps, IP addresses etc., which is cumbersome in a heavily used environment. Given that this a standard feature of any WAF vendor in the market, I think its a very fair ask.

Check out this article that shares results presented at DEFCON 32 about secret findings.TL;DR We scanned 8,400+ public GCP images and did not find a single exposed secret! That’s a dramatic reversal compared to the hundreds we found in AWS AMIs and dozens in Azure Public images. GCP’s curated, tightly- controlled image marketplace has seemingly eliminated secret exposure in its cloud images.https://trufflesecurity.com/blog/guest-post-gcp-cloudquarry-searching-for-secrets-in-public-gcp-images

Hello Learners,  Identity is so core to security that we as a community can often take it for granted, but keeping your skills sharp in the identity space leads to a great first, middle and last line of defense in the cloud. So build defense in depth and assume breach, but no matter what spend some time with our new skill badge that dives into Privileged Access Management on Google Cloud Skills Boost.  This skill badge is a chance to work through labs that build up to the critical just in time access capability provide by Privileged Access Management on Google Cloud. From custom roles to identity aware proxies, you'll take a tour of identity aligned labs that can help harden you identity

Join Google's confidential computing portfolio product experts to learn how you can get an unparalleled shield for sensitive data and algorithms, ensuring they remain protected even while in use. Check out live demos on how to leverage this one-of-a-kind transformative technology to secure your AI workloads across their entire lifecycle, from development to deployment.  Jun 26 2025, 8:00am PDT

       Malicious webhooks can be a significant security risk, allowing attackers to exfiltrate data, trigger unauthorized actions, or maintain persistence within your systems.        This guide will walk you through purging malicious webhooks using Google tools, from beginner concepts to advanced administrative techniques.       How-To Guide: Purging Malicious Webhooks with Google Tools:   I. Beginner Level: Understanding Webhooks and Basic SecurityWhat is a Webhook?         Imagine a webhook as an automated message sent from one application to another when a specific event occurs. It's essentially a "user-defined HTTP callback." For example, a webhook could notify your team's chat when a new customer signs up, or trigger a build process when code is committed to a repository.How can Webhooks be Malicious?

Hello, I am an Organization Administrator (`roles/resourcemanager.organizationAdmin`) for my Google Cloud Organization, but I'm encountering a persistent "permission denied" error when trying to disable the `constraints/iam.allowedPolicyMemberDomains` organization policy. This issue occurs even when running the command from Cloud Shell. **My Goal:** I need to make a Cloud Run service (`sharky-chat-service` in project `chat-bot-social`) publicly accessible by granting `allUsers` the `roles/run.invoker` role. To do this, I first need to modify or disable the `constraints/iam.allowedPolicyMemberDomains` organization policy, which is currently restricting IAM members to my organization's customer ID. **Details:** * **Organization ID:** `275283949867` * **User Account:** `Admin@sharkteam.[domain-redacted-due-to-filter]` * **Project ID (for context):** `chat-bot-social` * **Cloud Run Service (for context):** `sharky-chat-service` * **Region (

Secure Enterprise Blueprints are critical set of assets in our Security Foundation Solution. You can hear from @sleighton our Principal Architect in Google Cloud.Check this webinar on 05/29 to register learn more:https://www.brighttalk.com/webcast/18282/643736

There are many new capabilities available now in IAM, Access Risk, and Cloud Governance. Check this blog to see all things new announced at Next 2025. https://cloud.google.com/blog/products/identity-security/whats-new-in-iam-access-risk-and-cloud-governance?e=48754805 

If you are at RSA 2025, join us on the expo floor. We have action packed security foundations topics happening all 3 days Apr 29-May 1st on the expo floor. Find the Google Cloud Security team on the show floor at booth #N-6062 in the Moscone Center, North Hall. Here you can: Meet with our security experts: Engage in one-on-one conversations on foundational cloud security topics and discover how making Google a part of your security team Check out live presentations: Theater presentations at booth on April 29th, 30th at 3PM and 4:40PM, and May 1st at 12:40PM. Topics covered include Cloud Armor for DDoS Protection, Cloud NGFW for firewall, and VPC Service Controls for mitigating data exfiltration. Don't miss us!

Security Practitioners, you do not want to miss this one! We have an exciting webinar coming up tomorrow in our Security Foundation webinar series - it's on Virtual Red Teaming topic.https://www.brighttalk.com/webcast/18282/639711 Security Command Center (SCC) delivers the best protection for Google Cloud and its unique virtual red teaming capability continuously simulates millions of attack permutations against a digital twin of your cloud environment - helping you to effectively manage risk!  Join and hear from our experts - Doug Ko @pandamoose and Gary Oppel.

Hi All -  Check this blog post on how you can define and maintain a secure cloud platform for your workloads. Google Cloud provides many foundational security controls for you to build a layered defense architecture in cloud - this blog highlights few of these controls and an overview of using them for securing your infrastructure, data, applications, and AI models. https://www.googlecloudcommunity.com/gc/Community-Blog/Protecting-your-Google-Cloud-Workloads-Foundational-Controls-and/ba-p/890701 

Hello Google Cloud Community, I'm seeking help with a persistent issue accessing the OAuth Consent Screen for my Google Cloud project. Context: Project ID: youtubeAccount: Using a standard @gmail.com account (PII Removed by Sraff)Project Type: This is a standalone project, not part of any Google Cloud Organization structure.IAM Role: I have verified via the IAM & Admin > IAM page that my account (PII Removed by Staff) has the "Owner" role for this project.Problem: Despite having the Owner role, I cannot access the OAuth Consent Screen configuration page: When navigating via the GCP Console menu (APIs & Services > OAuth consent screen), I am incorrectly redirected to an "OAuth Overview / Google Auth Platform" page showing metrics, not the actual configuration settings. When attempting to access the consent screen via the direct URL (

How can we limit which VM types users can spin up to control costs, and what's a safe way to roll out this change without breaking things? Any tips greatly appreciated!

Our team is planning to implement the OWASP Top 10 WAF rules using Google Cloud Armor to enhance our application security. What are the best practices?

Heads up, Security Foundation Community! If you're planning to attend Google Cloud Next, don't miss this important session: Want to solidify your Google Cloud security from the ground up? Join @anilnandigam at the Start secure, stay secure: Build a strong cloud security foundation session. Learn how Google Cloud's Security Foundation and shared fate model offer clear guidance for securing your entire cloud environment. Be sure to add this must-attend session to your Next '25 agenda and save your seat. Let us know in the comments if you'll be there. See you at Next!

Hi everyone, A big welcome to all new members joining the Google Cloud Security Foundation forum! This space is dedicated to discussing the core principles, best practices, and essential services for building a secure foundation on Google Cloud Platform. We focus specifically on understanding and utilizing the cloud-first security controls that are integral parts of the Google Cloud platform itself. Topics we often cover here include these core platform controls: Identity and Access Management (IAM) fundamentals Network security basics (VPCs, Firewall Rules, Cloud Armor basics) Data security concepts (Encryption at rest/in transit) Logging and Monitoring essentia