Google Professional-Cloud-Security-Engineer - Google Cloud Certified - Professional Cloud Security Engineer

Objective: Ensure private communication between application tiers in different GCP Organizations.

Solution: Use VPC peering to enable private communication without traversing the public internet.

Steps:

Step 1: Open the Google Cloud Console.

Step 2: Navigate to the VPC Network Peering page.

Step 3: Create a new VPC peering connection in the project hosting the application tier.

Step 4: Specify the VPC network in the other organization (hosting the storage tier) to peer with.

Step 5: Accept the peering request in the other project.

Step 6: Configure the necessary routes and firewall rules to allow traffic between the peered VPC networks.

VPC peering allows you to connect two VPC networks privately and directly, ensuring that traffic between them does not traverse the public internet.

Multiple network interfaces. The simplest way to connect multiple VPC networks through a virtual appliance is by using multiple network interfaces, with each interface connecting to one of the VPC networks. Internet and on-premises connectivity is provided over one or two separate network interfaces. With many NGFW products, internet connectivity is connected through an interface marked as untrusted in the NGFW software.

https://cloud.google.com/architecture/best-practices-vpc-design#l7

This architecture has multiple VPC networks that are bridged by an L7 next-generation firewall (NGFW) appliance, which functions as a multi-NIC bridge between VPC networks. An untrusted, outside VPC network is introduced to terminate hybrid interconnects and internet-based connections that terminate on the outside leg of the L7 NGFW for inspection. There are many variations on this design, but the key principle is to filter traffic through the firewall before the traffic reaches trusted VPC networks.

To manage consumer user accounts created using the corporate domain name, you can use the transfer tool for unmanaged user accounts provided by Google Cloud Identity. Here’s how you can proceed:

Identify Unmanaged Accounts:

Use the Cloud Identity interface to identify consumer (unmanaged) accounts that exist with your corporate domain.

Initiate Transfer Process:

Use the transfer tool for unmanaged user accounts to initiate the transfer. This tool helps in converting unmanaged accounts (consumer accounts) into managed accounts.

User Notification:

Users with unmanaged accounts will receive an email notification prompting them to accept the transfer to the organization’s managed account system.

Accept Transfer:

Users need to follow the instructions in the email to accept the transfer. Once accepted, their accounts will be managed under your organization’s Cloud Identity setup.

Benefits:

Centralized Management: All user accounts under your corporate domain are managed centrally, ensuring compliance and security.

Enhanced Security: Managed accounts provide better control over security policies and access management.

References

Transfer tool for unmanaged users

Cloud Identity Documentation

Requirement:

Enforce the use of Customer-Managed Encryption Keys (CMEK) for all new Cloud Storage resources in the organization.

Policy Constraint:

Use the constraints/gcp.restrictNonCmekServices constraint to enforce CMEK usage.

Policy Type and Value:

Set the policy type to allow to specify which services must use CMEK.

In this case, the policy value should be storage.googleapis.com to target Cloud Storage.

Command:

Applying the organization policy with the appropriate binding ensures that all new Cloud Storage resources under the organization will require CMEK.

Steps:

Step 1: Go to the Google Cloud Console.

Step 2: Navigate to the Organization Policies page.

Step 3: Apply the policy constraint constraints/gcp.restrictNonCmekServices with the allow policy type and storage.googleapis.com as the policy value.

When you use a customer-managed encryption key (CMEK) to secure a Cloud Storage bucket, the key and the bucket must be located in the same region. In this case, the key is in europe-west3 and the bucket is in europe-west1, which is why you’re unable to access the key.