Chapter Eight

Security & Identity

Eight services that together form the security posture of a Google Cloud organization. Each one answers a different question — who, what, where, with what data — and they only work as a set.

8 services

Security on GCP is layered. Cloud Identity answers who — the users and groups that everything else trusts. IAM answers what is allowed — the authorization model on top of that identity foundation. Secret Manager and Cloud KMS protect data at rest with different scopes that get confused for each other. IAP gates access to internal applications without a VPN. Cloud Armor protects public-facing traffic at the edge. Security Command Center is the dashboard that ties findings together. PAM closes the loop with just-in-time elevation for sensitive operations. Each service has a narrow role; the goal of this chapter is to know which is which.

Security Is a Stack, Not a Service

IAPGates internal apps

Cloud ArmorProtects the edge

Security Command CenterTies findings together

PAMJust-in-time elevation

Secret Manager +

Cloud KMS

Protect data at rest — Secret Manager stores the secret value, KMS manages the keys that wrap it.

IAM — what is allowed

The authorization model: which principals can perform which actions on which resources.

Cloud Identity — who

The users and groups everything above trusts. The foundation IAM binds to.

Services in This Chapter

User and group management. The identity foundation that IAM relies on. Free and Premium tiers; Workforce Identity Federation for SSO with external IdPs.

Authorization for everything on GCP. Principals, roles, resources, hierarchy, service accounts, Workload Identity Federation.

AuthorizationRBAC

Managed storage for API keys, passwords, certificates. Versioned, IAM-controlled, audit-logged. Different from KMS in an often-confused way.

Managed cryptographic keys for envelope encryption and CMEK. Software, HSM, and External Key Manager tiers.

Identity-Aware Proxy (IAP)

BeyondCorp zero-trust access to internal apps without a VPN. HTTPS proxy plus TCP forwarding for SSH/RDP without bastion hosts.

Zero TrustProxy

Edge WAF and DDoS protection for public-facing Application Load Balancers. OWASP rules, custom expressions, rate limiting, Adaptive Protection.

Security Command Center

Central security and risk dashboard. Aggregated findings, asset inventory, compliance reporting. Standard, Premium, Enterprise tiers.

Privileged Access Manager (PAM)

Just-in-time privileged access. Entitlements, time-bounded grants, approval workflows, audit. The right alternative to permanent Owner or Editor bindings.

JIT AccessPrivileged