cloudnative wiki

GCP Security Operations

3 min read

GCP Security Operations 🟠🔐

Google Cloud Platform security architecture unifies Cloud Security Posture Management (CSPM), Cloud Workload Protection (CWPP), Security Information and Event Management (SIEM), and identity federation under a Zero Trust model.

Core Security & Zero Trust Services

ServiceCategoryPurpose & ArchitectureDeep Dive Reference
Security Command Center (SCC)CSPM / CWPPCentralized vulnerability management and agentless hypervisor VM Threat Detection (VMTD).Security Command Center (SCC)
Cloud ArmorEdge WAF & DDoSGlobal Anycast edge DDoS defense, OWASP ModSecurity CRS, and ML Adaptive Protection.Cloud Armor Deep Dive
Identity-Aware Proxy (IAP)Zero Trust AccessBeyondCorp context-aware HTTPS/TCP proxying, eliminating VPNs for SSH/RDP.IAP & BeyondCorp Deep Dive
Workload Identity FederationKeyless AuthOIDC/SAML token exchange eliminating static JSON service account keys for GitHub and AWS.Workload Identity Federation
Cloud KMS & Cloud HSMKey ManagementFIPS 140-2 Level 3 hardware HSM, CMEK envelope encryption, and External Key Manager (EKM).Cloud KMS & Envelope Encryption
Sensitive Data Protection (Cloud DLP)Data PrivacyAutomated discovery, classification, and cryptographic tokenization of PII/PHI.Cloud DLP Deep Dive
Certificate Authority Service (CAS)Enterprise PKIManaged private CA hierarchy (Root/Subordinate CAs) and Certificate Manager client mTLS.Certificate Authority Service
Organization PoliciesPreventive GuardrailsProgrammatic admission-control guardrails across Org/Folder/Project hierarchies.Organization Policies Deep Dive
Binary AuthorizationSupply Chain GatekeeperCryptographic container image deploy-time verification enforcing SLSA Level 3 provenance.Binary Authorization

Security Command Center (SCC)

Google Cloud’s cloud-native CSPM and CWPP platform. Activate at organization or project level.

# Enable Security Command Center API
gcloud services enable securitycenter.googleapis.com
 
# List high-severity active security findings across the organization
gcloud scc findings list --organization=<org-id> --severity=HIGH --filter="state=\"ACTIVE\""

Tiers & Detection Capabilities

  • SCC Standard: Included free of charge; reports basic asset inventory and basic misconfigurations.
  • SCC Premium / Enterprise: Advanced threat detection, Event Threat Detection (ETD), Container Threat Detection (CTD), agentless hypervisor-level VM Threat Detection (VMTD), and compliance reporting against CIS GCP Foundations Benchmark.

Chronicle SIEM & Security Operations

Google SecOps (Chronicle) is Google’s cloud-native SIEM built on Google search infrastructure, designed for petabyte-scale security telemetry ingestion, sub-second threat hunting, and YARA-L detection rule execution.

# Ingest security telemetry logs directly via Cloud Logging sinks
gcloud logging sinks create chronicle-ingest-sink \
  chronicle.googleapis.com/v1alpha/projects/<PROJECT_ID>/locations/<LOCATION>/instances/<INSTANCE_ID> \
  --log-filter="logName:\"logs/cloudaudit.googleapis.com\""

Workload Identity Federation

Eliminates high-risk static JSON service account keys by federating identities from AWS, Azure, GitHub Actions, or Kubernetes via standard OIDC token exchange:

# Create a Workload Identity Pool for external CI/CD runners
gcloud iam workload-identity-pools create github-actions-pool \
  --location="global" \
  --description="Pool for GitHub Actions CI/CD workflows"
 
# Bind an external repository subject to a Google Cloud Service Account
gcloud iam service-accounts add-iam-policy-binding deployer-sa@my-prod-project.iam.gserviceaccount.com \
  --role="roles/iam.workloadIdentityUser" \
  --member="principalSet://iam.googleapis.com/projects/1234567890/locations/global/workloadIdentityPools/github-actions-pool/attribute.repository/my-org/my-repo"

Graph View

Backlinks