Google Cloud

Enabling Federations between Google Cloud and Azure Entra ID

Overview In this post, we delve into Workforce Identity Federation, a service that enables organizations to grant access to Google Cloud services without the need for users to create a Google Account. This simplifies user management and enhances security by leveraging existing identity providers. While Workforce Identity Federation shares some similarities with Workload Identity Federation, they serve different purposes. Workforce Identity Federation focuses on providing access for employees and users, whereas Workload Identity Federation is designed for managing access for service accounts and applications.

Tuesday, September 10, 2024 Read

Securing your Google Cloud with Security Posture (SCC)

Overview Following on the topic of the previous post, I’ll be focusing now in an alternate way to enforce Organization Policies via Security Command Center Premium. This could be a good solution for those users that have Security Command Center and also want to apply a pre-defined Security Posture SCC - Predefined Security Posture. The SCC Promise The Security Posture allows for more than enforcing Organization Policies, it allows also to make Health Checks for a few services, such as, no password for Cloud SQL instances, or BigQuery datasets are not encrypted with a CMEK for example. Although, I am focusing on Organization Policies on this post, I will be going over what it can do and what it cannot do.

Monday, February 19, 2024 Read

Securing your Google Cloud with Organization Policies

Overview Security is always a hot topic and although we can secure each solution on a one by one basis, we can help application and infrastrcture teams by offloading some of these concerns. With the implementation of Google Cloud Organization policies we aim exactly at enabling a secure posture within a Google Cloud Organization. What are Organization Policies Policies or as per Google Cloud documentation, constraints, are configurations that limit what can or cannot be done within a Google Cloud Organization, Folder or Project.

Saturday, February 3, 2024 Read

Asset Inventory

Overview This month’s post is about Google Cloud Asset Inventory. I love this service for the fact that I can get an overview of my organization easily. Furthermore, it allow its users to make complex queries to identify resources and their relationships. Depending on the level of Asset Inventory permissions granted, whether at the project, folder, or organization level, one can gain a comprehensive overview of an organization. What can Asset Inventory do for me? The official documentation refers that we can do the following -. Use a custom query language to search for assets metadata. -. Export assets metadata to get a historic view of the changes or a change done to assets within a specific timeframe. -. Enable notifications through real-time notifications. -. Find who has access to what.

Friday, December 15, 2023 Read

Configuring a Cloud Run Service Behind a Load Balancer: Step-by-Step Guide

Introduction In the ever-evolving world of cloud computing, the ability to balancer traffic and serve it close to your consumers is typically a fundamnetal requirement. Cloud Run, Google Cloud’s serverless platform, is a managed services that scales up and down as needed. Combining Cloud Run with a Global Load Balancer, will make sure that your traffic goes to the nearest region of your application consumers. This post will provide an overview of the architecture and provide you with a ready to deploy Terraform code to create the service across one or more regions.

Monday, November 13, 2023 Read

Just in Time Acess in Google Cloud

Overview Best practices state that you should have the privileges to do your function no more and no less. A few times, these privileges are still to high and one of the common “workarounds” is to have a separate set of credentials for those high-privileged accounts. This brings the downside of having to remember two or more set of credentials and human nature tends to use the same password or a variation of the original password, increasing the risk that one or more accounts belonging to a user get compromised.

Friday, September 15, 2023 Read

Terraform IAM modules for Google Cloud

Overview Identity and Access Management (IAM) in Google Cloud can be configured at different levels, ranked from the most restrictive to the least restrictive as follows:: resource project folder organization It’s important to note that any IAM assignment made at a higher level gets inherited by lower levels. For instance, an IAM assignment given at the organization level will be inherited by underlying folders, projects, and resources. For more detailed information, refer to the official documentation.

Tuesday, August 15, 2023 Read