Trusted Infrastructure

Bundled into the existing Cloud Digital Leader premium course — no separate purchase.

Included in this chapter:

Pillar	Authentication	Authorization	Auditing
Question it answers	Who are you?	What may you do?	Who did what, when?
Google Cloud control	Identity + 2-Step Verification (2SV)	Identity and Access Management (IAM)	Cloud Audit Logs
What it works with	A second factor beyond the password	Principals granted roles (permission bundles) on resources	Admin Activity and Data Access log records
When it runs	Before access, to establish identity	On each action, to allow or deny it	After the fact, as an immutable record
Failure if missing	Stolen password = full access	Over-privileged or unauthorized actions	No accountability or forensic trail

Cheat sheet

Google designs its own infrastructure, so security is built in at every layer
Titan is Google's custom security chip and hardware root of trust
Data has three states (at rest, in transit, and in use) and a full security story covers all three
Data at rest is encrypted by default with AES-256, no customer action required
Data in transit is encrypted by default across Google's network
Confidential VMs encrypt data in use, and you opt into them
Authentication, authorization, and auditing are three distinct controls, never interchangeable
2-Step Verification adds a second factor so a stolen password isn't enough
IAM grants roles to principals on resources: it controls what you may do
Cloud Audit Logs record who did what, where, and when
Cloud Armor defends availability at the network edge with DDoS and WAF protection
A DDoS attack threatens availability by flooding a service
Google Security Operations (formerly Chronicle) runs detection and response in the cloud
Defense in depth means no single safeguard is a single point of failure
Cloud Armor protects an external load balancer with security policies: IP/geo filtering, rate limiting, bot management, and Adaptive Protection
Cloud KMS lets you own and control the keys; Cloud HSM and External Key Manager extend where they live
Google's data centers control physical access and securely destroy retired drives

Unlock with Premium — includes all practice exams and the complete study guide.

Cheat sheet