GCP Security Engineer cheat sheet

IAM policy inheritance: resources inherit allow policies from organization → folder → project → resource; a child policy can only grant more, never revoke an inherited grant.

Role types: basic (Owner/Editor/Viewer) are broad and legacy; predefined roles are Google-managed per service; custom roles are project- or org-level and can be in launch or GA stage.

Policy binding condition (IAM Conditions) uses a CEL expression with attributes such as request.time, resource.name, resource.type, and access.level; a conditional binding is ignored if the expression cannot be evaluated.

Deny policies evaluate before allow policies; a deny always wins over any allow. Deny policies use deny rules with denied principals, denied permissions, and optional exception principals.

Principal types: Google Account, Google group, service account, Google Workspace domain, Cloud Identity domain, and allAuthenticatedUsers/allUsers (public). allUsers grants anonymous access.

Service account key creation can be blocked at org level with the constraint iam.disableServiceAccountKeyCreation; prefer Workload Identity Federation or short-lived tokens over JSON keys.

Workforce Identity Federation lets external IdPs (OIDC/SAML) authenticate users without syncing identities into Cloud Identity; used with IAM principal sets.

Least privilege workflow: audit with Policy Analyzer and IAM Recommender, replace basic roles with predefined roles, then scope with conditions and deny policies.

VPC firewall rules are stateful and evaluated by priority (0–65535, lower number wins); implied rules allow egress and deny ingress, and the default network ships with permissive rules that should be removed.

Hierarchical firewall policies attach at org or folder level and are evaluated before VPC firewall rules; they support goto_next, allow, and deny actions.

VPC Service Controls uses a service perimeter to restrict data access for supported APIs; access levels define conditions (IP ranges, device attributes) for crossing the perimeter.

Private Google Access lets VM instances without external IPs reach Google APIs; Private Service Connect uses a producer/consumer endpoint model for private access to services.

Cloud Load Balancing with Google-managed certificates terminates TLS; SSL policies attach to target proxies to set minimum TLS version and cipher profile.

Cloud Armor security policies provide WAF rules (preconfigured rules such as OWASP ModSecurity), IP/geo allow-deny lists, and rate limiting; they attach to backend services.

Cloud NAT provides outbound-only internet access for private instances; it does not permit inbound connections.

Shared VPC: the host project owns the network and subnets, service projects attach and consume them; firewall and subnet IAM stay with the host project.

Cloud KMS key hierarchy: key ring → key → key version. Rotation creates a new primary version; old versions remain for decryption. CMEK keys can be regional or multi-regional.

Cloud HSM provides FIPS 140-2 Level 3 validated hardware keys; Cloud EKM keeps key material in an external key manager and never stores it in Google.

Default encryption at rest uses Google-managed keys with AES-256; CMEK, CSEK, and client-side encryption add customer control.

Cloud DLP discovers and de-identifies sensitive data using infoTypes; de-identification methods include masking, tokenization (format-preserving encryption), and date shifting.

Sensitive Data Protection inspection can run on Cloud Storage, BigQuery, Datastore, and streaming content; findings can be written to BigQuery or Pub/Sub.

Secret Manager stores versioned secrets with IAM-based access and optional CMEK; Secret Manager does not automatically rotate secrets.

Data residency: choose region or multi-region locations for storage and datasets; VPC Service Controls helps prevent data exfiltration across perimeter boundaries.

BigQuery column-level access uses policy tags in Data Catalog; row-level security uses row access policies; authorized views restrict dataset-level exposure.

Cloud Logging: audit logs include Admin Activity (always on, no charge), Data Access (off by default, billed), System Event, and Policy Denied logs.

Log sinks route logs to Cloud Storage, BigQuery, Pub/Sub, or another project; aggregated sinks at folder/org level capture child project logs. Log buckets have retention and can be locked.

Cloud Monitoring alerting policies use metric thresholds, log-based metrics, and uptime checks; notification channels include email, SMS, Pub/Sub, and webhooks.

Security Command Center tiers: Standard and Premium; Premium adds Event Threat Detection, Container Threat Detection, and vulnerability findings. Findings can be exported to Pub/Sub.

VPC Flow Logs capture network flows at the subnet level; firewall rules logging records allow/deny decisions; both feed into log-based metrics and alerts.

Access Transparency logs record Google personnel access to customer data; Access Approval requires explicit customer approval before Google support access.

Cloud Asset Inventory records resource history and configuration; it supports feeds to Pub/Sub for change monitoring.

Incident response: use IAM Recommender and Policy Analyzer to find over-permissive grants, rotate compromised keys, and review audit logs for the principal across projects.

Google Cloud compliance certifications (ISO 27001, SOC 1/2/3, PCI DSS, HIPAA) are documented in the Compliance Resource Center and via the compliance reports in the console; customers must still configure controls themselves.

Assured Workloads provides compliance regimes (FedRAMP, IL4, CJIS, ITAR, HIPAA, PCI) by enforcing constraints on a folder such as region restrictions and personnel access.

Organization Policy constraints enforce guardrails: e.g., constraints/compute.restrictVpcPeering, constraints/gcp.resourceLocations, constraints/iam.disableServiceAccountKeyCreation.

Data residency and sovereignty are supported through location constraints and Assured Workloads; the data location is set per resource at creation.

Access Transparency and Access Approval support audit requirements for third-party access; both are configured at organization level.

Compliance reports (SOC 2, ISO) are downloadable from the console; they are attestations, not automatic controls for your project.

For HIPAA, a signed Business Associate Agreement (BAA) with Google is required; HIPAA-eligible services are listed by Google and must be used.

Regular access reviews: use IAM Policy Analyzer, Cloud Asset Inventory exports, and Access Review features to evidence least privilege.