Cloud Security Foundation

Hello Cloud Security Community,I am facing a blocking issue while trying to verify my OAuth Branding in the Google Cloud Console. I am stuck in an infinite loop where the verification process times out after exactly 15-20 minutes.The Step-by-Step Issue:1. I navigate to Google Auth Platform > Branding.2. The status says: "Your branding must be verified before it can be visible to users."3. I click the "Verify Branding" button.4. The status changes to: "Verification in progress… This operation can take up to 5 minutes".5. Actual behavior: It keeps spinning for 15 to 20 minutes (far exceeding the 5 minutes stated).6. Result: It eventually fails with the message: "Failed to verify branding. The validation failed due to an unknown error. Refresh the page and try again."

Hello,Our application (Project ID: smtp-campaignbutler) is currently in the "Pending developer action" state in the Verification Center.The console instructed us to "Reply to your email thread with our Trust and Safety team". However, we have not received this email, after thoroughly checking all inboxes and spam folders for our registered developer contact email addresses.We have already resolved the two issues that were required:1. The homepage domain has been verified in Google Search Console.2. A link to our Privacy Policy has been added to the homepage footer.Since we cannot find the email to reply to, and our current support plan does not allow us to open a direct tech support case, we are hoping someone from the community or a Googler can advise on how to notify the Trust & Safety team that our fixes are complete.How can we move forward with the review process?Thank you for your help.

# DSSRF DefendAgainstSSRFAgainstMetadataEndpointIn many cloud environments, virtual machines expose a special internal service that provides identity material and configuration details. On Google Cloud, this internal interface is reachable through a link‑local address and is intended only for trusted, local use. If an application unintentionally forwards user‑controlled URLs to this internal address, sensitive workload credentials may be exposed.dssrf introduces a strict request‑validation layer for Node.js applications. Instead of allowing arbitrary destinations, it evaluates every outbound URL and rejects anything that resolves to internal network locations. This includes link‑local addresses, private ranges, IPv6 variants, and any hostname that ultimately maps to those spaces.The library also blocks indirect paths such as multi‑step redirects or DNS tricks that attempt to disguise an internal target. By enforcing a predictable and tightly scoped outbound‑requ

I’ve created a firewall rule to stop all traffic on all protocols from all countries except one.However when I look at my VMs network stats, the chart titled “Firewall incoming packets denied” shows less than one packet stopped per second.This is during a DDOS attack with millions of hits per second from around the world.How come the firewall does not stop 99% of these, if 99% of all countries are blocked?

We have just enrolled in Cloud Armor paygo.Two attacks have been identified already. The dashboard reads “Mitigation is enforced. No action is required”.But the VM is still unavailable when we allow external traffic.What else can we do?

Hi Community,I am currently architecting a security hardening roadmap for a client using Google Workspace (upgrading from basic settings).We are planning to implement Context-Aware Access and a Zero Trust model, but I am analyzing the potential friction with end-users (specifically in a Spanish-speaking non-tech environment).My question for the experts here: In your experience, what are the most common "blind spots" or pitfalls when moving from a legacy setup to a Zero Trust model in GWS?I'm interested in hearing about architectural challenges or specific configurations in DLP that you recommend prioritizing to avoid false positives during the transition.Any advice or resources on this transition strategy would be greatly appreciated.Thanks!

Hey all,We are using domain restricted sharing https://docs.cloud.google.com/resource-manager/docs/organization-policy/restricting-domains#predefined-constraint for our organization.We are just looking to add ` [removed by moderator] ` as a member to our pub/sub topic in a project. But because of the domain restrictions we are not able to add the internal google cloud account as the member. Does anyone know how we can get the principal set/customer id for a internal google cloud account? [ie: account which is owned by google]

Hi,I'm completely locked out of my Google Cloud project (PII Removed by Staff), which I created using my personal Google Account (PII Removed by Staff). I built this project to authorize Gmail access for my WinUI 3 application using OAuth. I now receive this message when trying to access the project: You need additional access to the project...Missing permissions: resourcemanager.projects.getserviceusage.services.list Trying to use the IAM Troubleshooter results in this error: You do not have the required permissions to troubleshoot policies on the specified resource or the resource does not exist. The project no longer shows up in my console — I can't select or manage it anywhere. I’m not part of any Google Workspace or organization. I’m just an individual developer trying to recover access to something I built. I don’t know what changed. Troubleshooter URL:

I am really surprised (rather appalled) to know GCP wants users to upload TLS Certificates and their private keys in to the Certificate Manager for being referenced by the services such as Application Load Balancers. Though its secured with encryption at rest, there are chances of unnecessary exposure by human error in handling the private keys at the first place and as a responsible CSP, I would expect GCP to do something about this. At its face, it appeals to be a not-so-secure practice. I can understand even if the requirement is to upload PFX and password or even better an option to generate a CSR, that can be signed by an External CA and only the signed certificate need to be uploaded. I want to hear the story on the side of GCP Engineering on their choice for users to upload private keys directly. Though Certificate Manager is not a security product, I hope I can attract the attention of the Security Experts in contributing to this que

I have been trying to deploy and run a simple Firebase Cloud Function. Every attempt fails due to what appears to be a fundamental issue with service account creation and authentication context in my project.Symptoms:When calling the function, the context.auth object is always null or undefined, even when the client sends a valid, verified ID token. The function logs show The function must be called while authenticated. During deployment, I am now receiving the error: Error: Error generating the service identity for pubsub.googleapis.com.We have already verified the following:The project is linked to an active billing account. All necessary APIs are enabled (Cloud Functions, Cloud Build, Run, Artifact Registry, IAM, etc.). We have tried manually adding IAM service accounts and toggling the Cloud Functions API off an

The rise of AI and agents is fueling API sprawl, making it harder than ever to govern your network and detect dangerous "shadow APIs." +This article introduces key enhancements to API discovery in Apigee Advanced API Security, a critical feature designed to automatically find and manage undocumented APIs across your organization. Product Manager, Megan Bruce details the new Google Cloud-wide scope and agentless observation that leverage your L7 Application Load Balancers. The new integration with Apigee API hub allows for automatic comparison against cataloged APIs, providing a centralized view to help you eliminate security risks and bring all your assets under secure management.Want to learn how to automatically detect, govern, and secure every API across your Google Cloud projects? Discover the complete process in ou

Hi experts, Am new to DLP. trying out the possibilities of usage in our Org.Use-case:Our primary intended use-case is to be able to de-identify(by masking) all the documents in our cloud storage buckets of a project for PII, PCI and other sensitive information covered by the DLP infotypes. If our application service account needs to access the objects in the bucket, it should be able to read clear values in the JSON files, csv files etc. But people accessing the buckets through AD groups, should see masked values.My question: What is a good(simple) solution architecture to enable this set-up/use-case?

I am a comfortable user of Cloud Armor WAF for my GCP Application Loadbalancers. One thing that wants me shop for other WAF vendors is the traceability of blocked connection attempts. By design, Cloud Armor does not provide this for connections blocked due to Preconfigured or IP based deny rules. This was probably done with the intent of obscurity to non-compliant connection attempts, but this is hitting the adminstrators hard. Without uniquely traceable strings, adminstrators have to beat around the bush with other identifiers such as timestamps, IP addresses etc., which is cumbersome in a heavily used environment. Given that this a standard feature of any WAF vendor in the market, I think its a very fair ask.

Check out this article that shares results presented at DEFCON 32 about secret findings.TL;DR We scanned 8,400+ public GCP images and did not find a single exposed secret! That’s a dramatic reversal compared to the hundreds we found in AWS AMIs and dozens in Azure Public images. GCP’s curated, tightly- controlled image marketplace has seemingly eliminated secret exposure in its cloud images.https://trufflesecurity.com/blog/guest-post-gcp-cloudquarry-searching-for-secrets-in-public-gcp-images

Hello Learners,  Identity is so core to security that we as a community can often take it for granted, but keeping your skills sharp in the identity space leads to a great first, middle and last line of defense in the cloud. So build defense in depth and assume breach, but no matter what spend some time with our new skill badge that dives into Privileged Access Management on Google Cloud Skills Boost.  This skill badge is a chance to work through labs that build up to the critical just in time access capability provide by Privileged Access Management on Google Cloud. From custom roles to identity aware proxies, you'll take a tour of identity aligned labs that can help harden you identity

Join Google's confidential computing portfolio product experts to learn how you can get an unparalleled shield for sensitive data and algorithms, ensuring they remain protected even while in use. Check out live demos on how to leverage this one-of-a-kind transformative technology to secure your AI workloads across their entire lifecycle, from development to deployment.  Jun 26 2025, 8:00am PDT

       Malicious webhooks can be a significant security risk, allowing attackers to exfiltrate data, trigger unauthorized actions, or maintain persistence within your systems.        This guide will walk you through purging malicious webhooks using Google tools, from beginner concepts to advanced administrative techniques.       How-To Guide: Purging Malicious Webhooks with Google Tools:   I. Beginner Level: Understanding Webhooks and Basic SecurityWhat is a Webhook?         Imagine a webhook as an automated message sent from one application to another when a specific event occurs. It's essentially a "user-defined HTTP callback." For example, a webhook could notify your team's chat when a new customer signs up, or trigger a build process when code is committed to a repository.How can Webhooks be Malicious?

Hello, I am an Organization Administrator (`roles/resourcemanager.organizationAdmin`) for my Google Cloud Organization, but I'm encountering a persistent "permission denied" error when trying to disable the `constraints/iam.allowedPolicyMemberDomains` organization policy. This issue occurs even when running the command from Cloud Shell. **My Goal:** I need to make a Cloud Run service (`sharky-chat-service` in project `chat-bot-social`) publicly accessible by granting `allUsers` the `roles/run.invoker` role. To do this, I first need to modify or disable the `constraints/iam.allowedPolicyMemberDomains` organization policy, which is currently restricting IAM members to my organization's customer ID. **Details:** * **Organization ID:** `275283949867` * **User Account:** `Admin@sharkteam.[domain-redacted-due-to-filter]` * **Project ID (for context):** `chat-bot-social` * **Cloud Run Service (for context):** `sharky-chat-service` * **Region (

Secure Enterprise Blueprints are critical set of assets in our Security Foundation Solution. You can hear from @sleighton our Principal Architect in Google Cloud.Check this webinar on 05/29 to register learn more:https://www.brighttalk.com/webcast/18282/643736

There are many new capabilities available now in IAM, Access Risk, and Cloud Governance. Check this blog to see all things new announced at Next 2025. https://cloud.google.com/blog/products/identity-security/whats-new-in-iam-access-risk-and-cloud-governance?e=48754805 

If you are at RSA 2025, join us on the expo floor. We have action packed security foundations topics happening all 3 days Apr 29-May 1st on the expo floor. Find the Google Cloud Security team on the show floor at booth #N-6062 in the Moscone Center, North Hall. Here you can: Meet with our security experts: Engage in one-on-one conversations on foundational cloud security topics and discover how making Google a part of your security team Check out live presentations: Theater presentations at booth on April 29th, 30th at 3PM and 4:40PM, and May 1st at 12:40PM. Topics covered include Cloud Armor for DDoS Protection, Cloud NGFW for firewall, and VPC Service Controls for mitigating data exfiltration. Don't miss us!

Security Practitioners, you do not want to miss this one! We have an exciting webinar coming up tomorrow in our Security Foundation webinar series - it's on Virtual Red Teaming topic.https://www.brighttalk.com/webcast/18282/639711 Security Command Center (SCC) delivers the best protection for Google Cloud and its unique virtual red teaming capability continuously simulates millions of attack permutations against a digital twin of your cloud environment - helping you to effectively manage risk!  Join and hear from our experts - Doug Ko @pandamoose and Gary Oppel.

Hi All -  Check this blog post on how you can define and maintain a secure cloud platform for your workloads. Google Cloud provides many foundational security controls for you to build a layered defense architecture in cloud - this blog highlights few of these controls and an overview of using them for securing your infrastructure, data, applications, and AI models. https://www.googlecloudcommunity.com/gc/Community-Blog/Protecting-your-Google-Cloud-Workloads-Foundational-Controls-and/ba-p/890701 

Hello Google Cloud Community, I'm seeking help with a persistent issue accessing the OAuth Consent Screen for my Google Cloud project. Context: Project ID: youtubeAccount: Using a standard @gmail.com account (PII Removed by Sraff)Project Type: This is a standalone project, not part of any Google Cloud Organization structure.IAM Role: I have verified via the IAM & Admin > IAM page that my account (PII Removed by Staff) has the "Owner" role for this project.Problem: Despite having the Owner role, I cannot access the OAuth Consent Screen configuration page: When navigating via the GCP Console menu (APIs & Services > OAuth consent screen), I am incorrectly redirected to an "OAuth Overview / Google Auth Platform" page showing metrics, not the actual configuration settings. When attempting to access the consent screen via the direct URL (

How can we limit which VM types users can spin up to control costs, and what's a safe way to roll out this change without breaking things? Any tips greatly appreciated!