Designing for Security and Compliance

Role Types

Google Cloud IAM uses a role-based access control (RBAC) model. Understanding the three role types and when to use each is critical for the exam.

Resource Hierarchy and Policy Inheritance

IAM policies are inherited down the hierarchy: Organization → Folder → Project → Resource. A binding at the organization level applies to all projects beneath it.

• Organization — Top level. Org Admin sets organization-wide policies. Tied to a Cloud Identity domain.
• Folders — Group projects by team, environment, or business unit. Apply policies to all projects in a folder.
• Projects — Contain resources. Billing boundary. Most common level for IAM bindings.
• Resources — Individual GCS buckets, BigQuery datasets, etc. Finest-grained IAM binding.

Service Accounts

Service accounts are identities for workloads (VMs, containers, Cloud Functions), not humans. The exam tests best practices for service account management.

• Workload Identity (GKE) — Maps K8s service accounts to GCP service accounts. Eliminates the need for exported keys.
• Attached Service Accounts — VMs and Cloud Run services use attached SAs instead of key files.
• Short-lived Credentials — Use generateAccessToken for temporary access instead of persistent keys.
• Key Rotation — If keys are absolutely necessary, rotate every 90 days. Prefer avoiding keys entirely.

# Create a service account with minimal permissions
gcloud iam service-accounts create cloud-run-sa \
    --display-name="Cloud Run Service Account"

# Grant specific role (not editor!)
gcloud projects add-iam-policy-binding my-project \
    --member="serviceAccount:cloud-run-sa@my-project.iam.gserviceaccount.com" \
    --role="roles/cloudsql.client"

# Deploy Cloud Run with the service account
gcloud run deploy my-api \
    --service-account=cloud-run-sa@my-project.iam.gserviceaccount.com \
    --image=gcr.io/my-project/my-api:v1

# Workload Identity binding for GKE
gcloud iam service-accounts add-iam-policy-binding \
    cloud-run-sa@my-project.iam.gserviceaccount.com \
    --role="roles/iam.workloadIdentityUser" \
    --member="serviceAccount:my-project.svc.id.goog[my-namespace/my-ksa]"

Encryption Layers

Cloud KMS

Cloud KMS is the central key management service. It supports symmetric (AES-256-GCM) and asymmetric (RSA, EC) keys, automatic key rotation, and integration with most GCP services via CMEK.

# Create a key ring and key for CMEK
gcloud kms keyrings create my-keyring \
    --location=us-central1

gcloud kms keys create my-key \
    --keyring=my-keyring \
    --location=us-central1 \
    --purpose=encryption \
    --rotation-period=90d \
    --next-rotation-time=2026-06-01T00:00:00Z

# Create a Cloud SQL instance with CMEK
gcloud sql instances create my-db \
    --database-version=POSTGRES_15 \
    --tier=db-custom-4-16384 \
    --region=us-central1 \
    --disk-encryption-key=projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key

# Create a BigQuery dataset with CMEK
bq mk --dataset \
    --default_kms_key=projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key \
    my-project:encrypted_dataset

VPC Service Controls

VPC Service Controls create a security perimeter around GCP resources to prevent data exfiltration. Even a user with roles/owner cannot copy data out of a perimeter to an external project.

• Service Perimeter — Defines which projects and services are protected. API calls from outside the perimeter are blocked.
• Access Levels — Allow specific exceptions (IP ranges, device trust, identity) to cross the perimeter.
• Ingress/Egress Rules — Fine-grained policies for specific API methods, identities, and resources crossing the perimeter.
• Bridge Perimeters — Allow communication between two regular perimeters.

# Create an access policy
gcloud access-context-manager policies create \
    --organization=123456789 \
    --title="Production Security"

# Create a service perimeter
gcloud access-context-manager perimeters create prod-perimeter \
    --policy=POLICY_ID \
    --title="Production Perimeter" \
    --resources="projects/12345,projects/67890" \
    --restricted-services="storage.googleapis.com,bigquery.googleapis.com" \
    --access-levels="accessPolicies/POLICY_ID/accessLevels/corp-vpn"

Identity-Aware Proxy (IAP)

IAP provides zero-trust access to applications without a VPN. It verifies user identity and context (device, location) before granting access. Supported for App Engine, Cloud Run, GKE, and Compute Engine backends behind an HTTP(S) Load Balancer.

Cloud Armor

Cloud Armor provides DDoS protection and WAF capabilities. It operates at the edge of Google's network and only integrates with the External HTTP(S) Load Balancer.

# Create a Cloud Armor security policy
gcloud compute security-policies create my-policy \
    --description="Production WAF policy"

# Block traffic from specific countries
gcloud compute security-policies rules create 1000 \
    --security-policy=my-policy \
    --expression="origin.region_code == 'CN' || origin.region_code == 'RU'" \
    --action=deny-403

# Add OWASP Top 10 protection
gcloud compute security-policies rules create 2000 \
    --security-policy=my-policy \
    --expression="evaluatePreconfiguredWaf('sqli-v33-stable')" \
    --action=deny-403

# Rate limiting
gcloud compute security-policies rules create 3000 \
    --security-policy=my-policy \
    --src-ip-ranges="*" \
    --action=throttle \
    --rate-limit-threshold-count=100 \
    --rate-limit-threshold-interval-sec=60 \
    --conform-action=allow \
    --exceed-action=deny-429

Model Armor

Model Armor protects generative AI workloads from adversarial attacks. It provides input sanitization and output filtering for Vertex AI endpoints and Gemini API calls.

Data Governance for AI

When designing AI solutions, architects must consider data governance:

• Training Data Provenance — Document data sources, consent, and licensing for training data.
• VPC-SC for AI Pipelines — Place Vertex AI resources inside a service perimeter to prevent model and data exfiltration.
• CMEK for Models — Encrypt model artifacts with customer-managed keys in Cloud KMS.
• DLP Integration — Use Cloud DLP to redact PII from training data and model inputs/outputs.

HIPAA

For healthcare workloads handling Protected Health Information (PHI):

• Business Associate Agreement (BAA) — Must be signed with Google Cloud before processing PHI.
• Covered Services — Only services listed in the BAA may process PHI (Compute Engine, GKE, Cloud Storage, BigQuery, Cloud SQL, etc.).
• Encryption — CMEK required for PHI at rest. TLS for transit.
• Audit Logging — Enable Data Access audit logs on all services handling PHI.
• VPC-SC — Create perimeters around PHI-processing projects.

SOC 2

SOC 2 compliance focuses on security, availability, processing integrity, confidentiality, and privacy. Google Cloud services are SOC 2 audited. Your responsibility as architect:

• Implement proper IAM (least privilege, no basic roles in production)
• Enable audit logging (Admin Activity + Data Access logs)
• Use Organization Policy constraints to enforce security baselines
• Deploy Security Command Center for continuous vulnerability scanning

Data Sovereignty

Data sovereignty requires data to remain within specific geographic boundaries. GCP tools for enforcement:

# Organization policy: restrict resource locations to EU
# policy.yaml
constraint: constraints/gcp.resourceLocations
listPolicy:
  allowedValues:
    - in:europe-west1-locations
    - in:europe-west4-locations

# Apply the policy to a folder
gcloud resource-manager org-policies set-policy policy.yaml \
    --folder=123456789

Security Command Center (SCC) is Google Cloud's centralized security and risk management platform. The exam tests your understanding of its tiers and capabilities.