Why security matters in GCP - Why It Works

Introduction

Security protects your cloud resources and data from unauthorized access and damage. Without security, your information can be stolen or lost, causing harm to your business and users.

When you store sensitive customer information in the cloud

When you run applications that handle payments or personal data

When you want to prevent hackers from accessing your cloud servers

When you need to comply with laws about data privacy and protection

When you want to keep your cloud services running without interruptions

Commands

This command shows who has access to your cloud project and what they can do. It helps you check if only the right people have permissions.

Terminal

gcloud projects get-iam-policy example-project

Expected Output

bindings:

- members:

  - user:[e-mail]

  role: roles/owner

- members:

  - user:[e-mail]

  role: roles/viewer

etag: BwWWja0YfJA=

version: 1

This command checks if there is a firewall rule allowing SSH access to your virtual machines. Firewalls control who can connect to your resources.

Terminal

gcloud compute firewall-rules list --filter="name=allow-ssh"

Expected Output

NAME       NETWORK  DIRECTION  PRIORITY  ALLOW       DENY  DISABLED

allow-ssh  default  INGRESS    1000      tcp:22            False

→

--filter - Filters the list to show only rules with the name 'allow-ssh'

This command shows what permissions the 'viewer' role has. Understanding roles helps you assign the right access to users.

Terminal

gcloud iam roles describe roles/viewer

Expected Output

name: roles/viewer

title: Viewer

description: Read-only access to all resources.

stage: GA

includedPermissions:

- resourcemanager.projects.get

- resourcemanager.projects.list

- storage.buckets.get

- storage.objects.get

- compute.instances.get

Key Concept

If you remember nothing else from this pattern, remember: security controls who can access and change your cloud resources to keep them safe.

Common Mistakes

Giving all users owner or admin roles

This gives too much power and increases the risk of accidental or malicious changes.

Assign only the minimum permissions users need to do their job, using predefined roles like viewer or editor.

Leaving firewall rules open to all IP addresses

This allows anyone on the internet to try to connect, increasing the chance of attacks.

Restrict firewall rules to trusted IP addresses or networks only.

Summary

Use 'gcloud projects get-iam-policy' to see who can access your cloud project.

Check firewall rules with 'gcloud compute firewall-rules list' to control network access.

Understand roles with 'gcloud iam roles describe' to assign proper permissions.