Designing for Security and Compliance
Security questions reward precision about which control answers which threat.
Identity and access
IAM binds a principal to a role on a resource, and access is inherited down the hierarchy. Prefer predefined roles over primitive (Owner/Editor/Viewer), and custom roles when a predefined role is too broad. Deny policies override allow policies. For workloads, avoid exported service account keys: use attached service accounts on Compute Engine/GKE, GKE Workload Identity, or Workload Identity Federation for external workloads, plus short-lived impersonation.
Data protection and perimeter
Cloud KMS provides CMEK (and EKM for external key custody) with rotation. Sensitive Data Protection (Cloud DLP) classifies and de-identifies data. VPC Service Controls creates a perimeter that blocks data exfiltration even for principals who hold valid IAM - this is the answer whenever the risk is an authorized user copying data out. Access Transparency and Access Approval address Google-staff access concerns.
Network and posture
Hierarchical firewall policies, Private Google Access, Private Service Connect, Cloud Armor, and Identity-Aware Proxy for zero-trust access to internal apps. Security Command Center surfaces misconfigurations and threats; organization policy constraints prevent risky configurations in the first place.
Compliance
Know which audit logs are always on: Admin Activity and System Event logs are enabled by default and free; Data Access logs are opt-in per service and cost money. Data residency is enforced with location constraints in org policy plus regional resources.
Traps
Choosing a firewall rule when the scenario is exfiltration by an insider; granting primitive roles; recommending service account keys; confusing IAP (user access) with VPC Service Controls (data perimeter).
Rule of thumb: humans authenticate through your IdP and get short-lived tokens; workloads get attached identities, never downloaded keys.