GCP Flashcards
Cloud Composer
Fully managed workflow orchestration service built on Apache Workflow.
Create, Schedule, Monitor, Manage workflows.
DAG - Directed Acyclic Graphs
Create Instances
gcloud compute instances create gcelab2 –machine-type n1-standard-2 –zone us-central1-f
SSH into created VM machine
gcloud compute ssh gcelab2 –zone us-central1-f
Check windows machine is up
gcould compute instances get-serial-port-output instance-1 –zone us-central1-a
Reset password of windows machine
gcloud compute reset-windows-password instance-1 –zone us-central1-a –user admin
Check the project from gcloud
gcloud config list project
Fetch set values
gcloud config get-value compute/zone
Create kubeconfig entry for kubernetes cluster
gcloud container clusters get-credentials gcelab2
Resource Hierarchy
Google Cloud resources are organized hierarchically. This allows us to map the enterprise’s operational structure to GCP, and to manage access control and permissions for groups of related resources.
Top-level node - Organization resource
provides central visibility and control over all resources.
Next in the hierarchy are Folders.
Used for isolating requirements for different departments and teams.
Next in the hierarchy are Projects.
They contain computing, storage and networking resources.
What is Cloud Identity
A unified identity, access, app, and endpoint management (IAM/EMM) platform.
- give users access to apps with single sign on
- multi factor authentication
- endpoint management enforces policies for personal and corporate devices.
BeyondCorp
Google’s Zero trust solution, that let’s employees work from anywhere without having to log into VPN.
BeyondCorp allows for single sign-on, access control policies, access proxy, and user- and device-based authentication and authorization. The BeyondCorp principles are:
- Access to services must not be determined by the network from which you connect
- Access to services is granted based on contextual factors from the user and their device
- Access to services must be authenticated, authorized, and encrypted
VPC Service Controls
Used to create perimeters that protect the resources and data of services specified.
Following controls:
1. Clients within a perimeter do not have access to resources outside the perimeter.
2. Data cannot be copied to unauthorized resources outside the perimeter.
3. Data exchange between clients and resources separated by perimeter is secured by ingress and egress rules.
4. Context-aware access to resources is based on client attributes.
Created at the organization level.
Cloud Computing
- On-demand self-service
- Broad network access
- Resource Pooling
- Rapid Elasticity
- Measured service
Edge network location
Information served from here for lowest latency.
Zone
The zone is not a single DC. They are independent geographic areas.
Data Center
ISO 14001 Certification
Billing
- Billing in sub-hour
- Discount for sustained use
- Discount for committed use
- Discount for preemptible use
- Custom VM - Pay only for application
GCP doesn’t lock-in
BigTable - Apache HSpace
Dataproc - Hadoop
TensorFlow - Opensource libraries
Compute
- Compute Engine
- Kubernetes Engine
- App Engine
- Cloud Functions
Storage
- Bigtable
- Cloud Storage
- Cloud SQL
- Cloud Spanner
- Cloud Datastore
Big Data
- Big Query
- Pub/Sub
- Data flow
- Data proc
- Data lab
Machine Learning
- Natural Language API
- Vision API
- Machine Learning
- Speech API
- Translate API
Operational Security
- Intrusion detection systems
- techniques to reduce insider risk
- employee U2F use
- software development practices
Internet Communication security
- Google Front End
- Designed-in Denial of Service protection
Storage services security
- Encryption at rest
Service deployment security
- Encryption of inter-service communication
Hardware Infrastructure
- Hardware design and provenance
- Secure boot stack
- Premises security
User Identity Security
Central identity service with support for U2F
Budgets
- Budgets and alerts
- can be based on the billing account or GCP project
- can be triggered as a % previous month spend or fixed amount
- Billing export
store detailed information in a location which can be analyzed later, like in Big Query or Cloud Storage - Reports
Visual tool - Quotas
prevent overconsumption of resources
Rate quota - Resets after a certain time
Allocation quota - Fixed quotas, for example, 5 networks per project. Can be raised by Google support.
Resources organization
The main way to organize the resources we use in GCP
All resources in a project should have a common business objective.
This helps in setting up policies that follow the principle of least privilege.
Organization
- Folder
- Folder
- Folder
- Project
- Resources
- Project
- Folder
- Folder
Policies are inherited downwards. Each of the elements above is a point where policies can be defined.
Google Cloud Security Responsibility
Google:
- Managing infrastructure security
- helps with best practices, templates, products, and solutions.
Customer:
- responsible for securing their data
Project attributes
- Project ID - globally unique - by client - immutable
- Project name - not unique - by client - mutable
- Priject number - globally unique - by GCP - Immutable
Folders
Provide flexible management
Can be used to assign policies for specific departments.
The organization node is mandatory to use this.
We can move projects to folders at any time.
Organization node
Top of hierarchy
Special roles:
- Organization Policy Administrator
- Project Creator
GSuite automatically creates an organization node, if the client doesn’t have this, they can use Client Identity to create one.
Hierarchy policies
The more generous policies are accepted.
If project says Bob can access GCS while Org policy says Bob can’t access, the final result would be Bob being able to access GCS,
IAM Policy
- who (google group, google account, gsuite/cloud identity domain)
- can do what (Roles: Primitive, Predefined, Custom)
- on which resource
Primitive roles: Very coarse
Owner, Editor, Viewer, Billing Administrator
Predefined roles: A little finer control on access.
E.g. Instance Admin Role - specific to instance service.
Custom roles can be used only at project and organization level, and cannot be used at folder level.
Service Account
SAs, control server to server interactions.
Used to authenticate one service to another.
Used to control privileges used by resources.
Identified with email address:
PROJECT_NUMBER-compute@developer.gserviceaccount.com
They use cryptographic keys/tokens to manage access. They do not have passwords.
A predefined or custom role can be assigned to the service account.
A service account also acts as a resource, so an IAM policy can be attached to it.
