Security in Google Cloud Platform

Content

• Section 1: Designing, Planning, and Prototyping a GCP Network
• 1.1 Designing the overall network architecture. Considerations include:
• Failover and disaster recovery strategy
• Options for high availability
• DNS strategy (e.g., on-premises, Cloud DNS, GSLB)
• Meeting business requirements
• Meeting availability SLAs
• Choosing the appropriate load balancing options
• Optimizing for latency (e.g., MTU size, caches, CDN)
• Understanding how quotas are applied per project and per VPC
• Hybrid connectivity (e.g., Google private access for hybrid connectivity)
• Container networking
• IAM and security
• SaaS, PaaS, and IaaS services
• Microsegmentation for security purposes (e.g., using metadata, tags)
• 1.2 Designing a Virtual Private Cloud (VPC). Considerations include:
• CIDR range for subnets
• IP addressing (e.g., static, ephemeral, private)
• Standalone or shared
• Multiple vs. single
• Multi-zone and multi-region
• Peering
• Firewall (e.g., service account–based, tag-based)
• Routes
• Differences between Google Cloud Networking and other cloud platforms
• 1.3 Designing a hybrid network. Considerations include:
• Using Interconnect (e.g., dedicated vs. partner)
• Peering options (e.g., direct vs. carrier)
• IPsec VPN
• Cloud Router
• Failover and disaster recovery strategy (e.g., building high availability with BGP using cloud router)
• Shared vs. standalone VPC Interconnect access
• Cross-organizational access
• Bandwidth
• 1.4 Designing a Container IP Addressing plan for Google Kubernetes Engine

• ---

  Section 2: Implementing a GCP Virtual Private Cloud (VPC)
• 2.1 Configuring VPCs. Considerations include:
• Configuring GCP VPC resources (CIDR range, subnets, firewall rules, etc.)
• Configuring VPC Peering
• Creating a shared VPC and explaining how to share subnets with other projects
• Configuring API access (Private, Public, NAT GW, Proxy)
• Configuring VPC flow logs
• 2.2 Configuring routing. Tasks include:
• Configuring internal static/dynamic routing
• Configuring routing policies using tags and priority
• Configuring NAT (e.g., CloudNAT, instance-based NAT)
• 2.3 Configuring and maintaining Google Kubernetes Engine clusters. Considerations include:
• VPC-native Clusters using Alias IPs
• Clusters with Shared VPC
• Private Clusters
• Cluster Network policy
• Adding authorized networks for Cluster Master Access
• 2.4 Configuring and managing firewall rules. Considerations include:
• Target network tags and service accounts
• Priority
• Network protocols
• Ingress and egress rules
• Firewall logs

• ---

  Section 3: Configuring Network Services
• 3.1 Configuring load balancing. Considerations include:
• Creating backend services
• Firewall and security rules
• HTTP(S) load balancer: including changing URL maps, backend groups, health checks, CDN, and SSL certs
• TCP and SSL Proxy Load Balancers
• Network load balancer
• Internal load balancer
• Session affinity
• Capacity scaling
• 3.2 Configuring Cloud CDN. Considerations include:
• Enabling and disabling Cloud CDN
• Using cache keys
• Cache invalidation
• Signed URLs
• 3.3 Configuring and maintaining Cloud DNS. Considerations include:
• Managing zones and records
• Migrating to Cloud DNS
• DNS Security (DNSSEC)
• Global serving with Anycast
• Cloud DNS
• Internal DNS
• Integrating on-premises DNS with GCP
• 3.4 Enabling other network services. Considerations include:
• Health checks for your instance groups
• Canary (A/B) releases
• Distributing backend instances using regional managed instance groups
• Enabling private API access
• Section 4: Implementing Hybrid Interconnectivity

• ---

  Section 4: Implementing Hybrid Interconnectivity
• 4.1 Configuring Interconnect. Considerations include:
• Partner (e.g., Layer 2 vs. Layer 3 connectivity)
• Virtualizing using Vlan attachments
• Bulk storage uploads
• 4.2 Configuring a site-to-site IPsec VPN (e.g., route-based, policy-based, dynamic or static routing).
• 4.3 Configuring Cloud Router for reliability.

• ---

  Section 5: Implementing Network Security
• 5.1 Configuring Identity and Access Management (IAM). Tasks include:
• Viewing account IAM assignments
• Assigning IAM roles to accounts or Google Groups
• Defining custom IAM roles
• Using pre-defined IAM roles (e.g., network admin, network viewer, network user)
• 5.2 Configuring Cloud Armor policies. Considerations include:
• IP-based access control
• 5.3 Configuring third-party device insertion into VPC using multi-nic (NGFW)
• 5.4 Managing keys for SSH access

• ---

  Section 6: Managing and Monitoring Network Operations
• 6.1 Logging and monitoring with Stackdriver or GCP Console
• 6.2 Managing and maintaining security. Considerations include:
• Firewalls (e.g., cloud-based, private)
• Diagnosing and resolving IAM issues (shared VPC, security/network admin)
• 6.3 Maintaining and troubleshooting connectivity issues. Considerations include:
• Identifying traffic flow topology (e.g., load balancers, SSL offload, network endpoint groups)
• Draining and redirecting traffic flows
• Cross-connect handoff for Interconnect
• Monitoring ingress and egress traffic using flow logs
• Monitoring firewall logs
• Managing and troubleshooting VPNs
• Troubleshooting Cloud Router BGP peering issues
• 6.4 Monitoring, maintaining, and troubleshooting latency and traffic flow. Considerations include:
• Network throughput and latency testing
• Routing issues
• Tracing traffic flow

• ---

  Section 7: Optimizing Network Resources
• 7.1 Optimizing traffic flow. Considerations include:
• Load balancer and CDN location
• Global vs. Regional dynamic routing
• Expanding subnet CIDR ranges in service
• Accommodating workload increases (e.g., autoscaling vs. manual scaling)
• 7.2 Optimizing for cost and efficiency. Considerations include:
• Cost optimization (Network Service Tiers, Cloud CDN, autoscaler (max instances))
• Automation
• VPN vs. Interconnect
• Bandwidth utilization (e.g., kernel sys tuning parameters)