This self-paced training course gives participants broad study of security controls and techniques on Google Cloud. Through recorded lectures, demonstrations, and hands-on labs, participants explore and deploy the components of a secure Google Cloud solution, including Cloud Storage access control technologies, Security Keys, Customer-Supplied Encryption Keys, API access controls, scoping, shielded VMs, encryption, and signed URLs. It also covers securing Kubernetes environments.

Syllabus

Welcome to Security Best Practices in Google Cloud

Welcome and Getting Started Guide!

Securing Compute Engine: Techniques and Best Practices

Module overview
Service accounts, IAM roles, and API scopes
Lab Intro: Configuring, Using, and Auditing VM Service Accounts and Scopes
Configuring, Using, and Auditing VM Service Accounts and Scopes
Connecting to virtual machines
Connecting to VMs without external IPs
OS Login
Organization policy controls
Shielded VMs
Confidential VMs
Certificate Authority Service
What Certificate Authority Service provides
Compute Engine best practices
Module review
Quiz: Securing Compute Engine

Securing Cloud Data: Techniques and Best Practices

Module overview
Cloud Storage IAM permissions and ACLs
Auditing cloud data
Signed URLs and policy documents
Encrypting with CMEK and CSEK
Lab Intro: Using Customer-Supplied Encryption Keys with Cloud Storage
Using Customer-Supplied Encryption Keys with Cloud Storage
Lab Intro: Using Customer-Managed Encryption Keys with Cloud Storage and Cloud KMS
Using Customer-Managed Encryption Keys with Cloud Storage and Cloud KMS
Cloud HSM
Demo: Using and Verifying Keys in Cloud HSM
BigQuery IAM roles and authorized views
Lab Intro: Creating a BigQuery Authorized View
Creating a BigQuery Authorized View
Storage best practices
Module review
Module Quiz