{"id":19748722,"url":"https://github.com/doitintl/secure-gcp-reference","last_synced_at":"2025-07-31T16:16:32.397Z","repository":{"id":44473099,"uuid":"328530217","full_name":"doitintl/secure-gcp-reference","owner":"doitintl","description":"Best practice example for secure and compliant Google Cloud Platform infrastructure","archived":false,"fork":false,"pushed_at":"2022-11-15T17:49:01.000Z","size":227,"stargazers_count":103,"open_issues_count":0,"forks_count":28,"subscribers_count":9,"default_branch":"main","last_synced_at":"2025-02-25T14:18:57.931Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/doitintl.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-01-11T02:43:38.000Z","updated_at":"2025-02-05T19:36:32.000Z","dependencies_parsed_at":"2023-01-23T02:45:11.004Z","dependency_job_id":null,"html_url":"https://github.com/doitintl/secure-gcp-reference","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/doitintl%2Fsecure-gcp-reference","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/doitintl%2Fsecure-gcp-reference/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/doitintl%2Fsecure-gcp-reference/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/doitintl%2Fsecure-gcp-reference/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/doitintl","download_url":"https://codeload.github.com/doitintl/secure-gcp-reference/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":241078774,"owners_count":19905923,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-12T02:23:13.039Z","updated_at":"2025-02-28T00:28:31.237Z","avatar_url":"https://github.com/doitintl.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"This content is provided by the team at [DoiT International](https://doit-intl.com), a global product and service organization dedicated to making the public cloud accessible while secure for all.\n\n# Secure configuration example\n![Example GCP Secure Configuration](./gcp_example.png)\n\n# Checklists\n## Initial setup\n- [ ] Configure org policies\n  - [ ] Restrict allowed IAM domains\n  - [ ] Disable SA key creation\n  - [ ] Disable SA key upload\n  - [ ] Skip default network\n  - [ ] Disable external IPs\n  - [ ] Restrict prod networks to folder\n  - [ ] Require shielded VM\n  - [ ] Require OSLogin\n  - [ ] Require uniform bucket access\n  - [ ] Disable lein removal\n- [ ] Prepare for VPC service controls (data protection)\n  - [ ] Create access policy (one per org)\n- [ ] Disable org-level roles\n  - [ ] Billing admin\n  - [ ] Project creator\n- [ ] Define disaster recovery plan\n  - [ ] DR team and contacts\n  - [ ] Geographical regions\n  - [ ] RTO, RPO\n  - [ ] Data backups\n  - [ ] Configuration management\n  - [ ] Continuous deployment\n  - [ ] Test schedule (at least annual)\n- [ ] Establish user groups in GSuite / Cloud Identity\n  - [ ] Organization Admin\n  - [ ] Network Admin\n  - [ ] Security Admin\n  - [ ] Billing Admin\n  - [ ] Devops\n  - [ ] Developers\n  - [ ] Data Scientists\n  - [ ] Contractors\n  - [ ] Teams (project or folder-level as you grow)\n- [ ] Establish resource hierarchy\n  - [ ] Define folder and project hierarchy\n  - [ ] Define environment data security perimeters (VPC service controls)\n  - [ ] Set up IAM permissions\n    - [ ] Billing\n    - [ ] Org\n      - [ ] Folder\n        - [ ] Project\n    - *Tips:*\n      - [ ] assign **only groups** IAM roles (not users)\n      - [ ] use `conditions` where possible to limit access scope\n      - [ ] set minimal permissions at each level as needed\n      - [ ] highest permission `Editor` for any project\n  - [ ] Set up Network\n    - [ ] Document IP address ranges (IPAM)\n      - [ ] Clusters\n        - [ ] secondary ranges\n      - [ ] VMs\n      - [ ] Databases\n      - [ ] Connectors\n      - [ ] Managed services\n      - [ ] Bastion (jump host)\n    - [ ] Create shared VPC (host project)\n      - [ ] VPCs\n        - [ ] Subnets\n        - [ ] Firewall rules\n      - [ ] Cloud Router\n      - [ ] NAT\n    - [ ] Serverless VPC Connector\n  - [ ] Set up Security project\n    - [ ] Enable audit logging at org level\n    - [ ] Create audit logging storage bucket\n    - [ ] Create aggregated audit log sinks to security project\n  - [ ] Set up Devops project\n    - [ ] Override key download policy (for this project)\n    - [ ] Create Terraform service account(s)\n      - [ ] Admin\n      - [ ] Developer (optional)\n    - [ ] Create artifact registry\n      - [ ] Service account permissions\n      - [ ] Container analysis\n      - [ ] Binary authorization\n    - [ ] Cloud Build\n      - [ ] Service account permissions\n      - [ ] Connect Git repositories\n  - [ ] Set up Billing project\n    - [ ] Create BigQuery dataset to store billing data\n    - [ ] Create billing export to bq dataset (only 1 per billing ID)\n    - [ ] Define resource labeling plan\n  - [ ] Set up Monitoring project\n    - [ ] Create initial workspace and add projects above\n    - [ ] Create logging bucket(s)\n    - [ ] Create notification channels\n- [ ] Set up monitoring / alerts\n  - [ ] Billing / budget alerts\n  - [ ] [CIS Benchmarks](https://gist.github.com/mikesparr/3408145208716ba821d51aa9d10c1650)\n\n## Project considerations\n- [ ] Add project leins to prevent accidental deletion (i.e. production)\n- [ ] Audit log sink to `security` project\n- [ ] Log sink to `monitoring` project logging bucket\n  - [ ] Add exclusion filters or disable `_Default`\n- [ ] Ensure network resources available\n  - [ ] Plan out or request network resources from shared VPC\n  - [ ] Add as service project\n- [ ] Set up Service Accounts\n  - [ ] CI/CD\n  - [ ] Cache\n  - [ ] Database\n  - [ ] Storage\n  - [ ] App Runtime\n- [ ] Add only permissions required for tasks\n- [ ] OS Login\n- [ ] Considerations:\n  - [ ] Storage bucket policy and lifecycle\n  - [ ] Data replications and RPO\n  - [ ] Data security perimeter\n  - [ ] Data loss prevention and PII\n  - [ ] Label resources\n  - [ ] Quotas\n  - [ ] Cloud IAP\n  - [ ] Firewall rules\n  - [ ] Monitoring\n    - [ ] Uptime checks\n    - [ ] Define SLO / SLI\n    - [ ] Dashboards\n    - [ ] Alerts\n\n# Helpful links\n- [Best practices for enterprise](https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations)\n- [GCP for AWS professionals](https://cloud.google.com/docs/compare/aws)\n- [Identity best practices](https://cloud.google.com/architecture/identity/best-practices-for-planning)\n- [Inter-region latency and throughput](https://datastudio.google.com/u/0/reporting/fc733b10-9744-4a72-a502-92290f608571/page/70YCB)\n- [Lowest-latency region check](https://gcping.com)\n- [Creating organizations](https://cloud.google.com/resource-manager/docs/creating-managing-organization)\n- [Migrating projects to org](https://cloud.google.com/resource-manager/docs/migrating-projects-billing)\n- [Migrating projects from org](https://cloud.google.com/resource-manager/docs/project-migration)\n- [GSuite and Cloud Identity](https://cloud.google.com/identity)\n- [Enforce MFA login](https://cloud.google.com/identity/solutions/enforce-mfa)\n- [Service account keys best practices](https://medium.com/@jryancanty/stop-downloading-google-cloud-service-account-keys-1811d44a97d9)\n- [Log exports for compliance](https://cloud.google.com/solutions/exporting-stackdriver-logging-for-compliance-requirements)\n- [Log exclusion filters](https://cloud.google.com/logging/docs/exclusions)\n- [Centralize logs across projects](https://blog.doit-intl.com/centralize-logs-from-multiple-projects-on-google-cloud-platform-79aa7256ed0a)\n- [Storage object lifecycles](https://cloud.google.com/storage/docs/lifecycle)\n- [Monitoring and workspaces](https://cloud.google.com/monitoring/workspaces)\n- [Request Annotation with logging](https://medium.com/google-cloud/request-annotation-with-cloud-audit-logging-and-monitoring-on-gcp-ce8e8671c086) \n- [Service monitoring (SLO/SLI)](https://cloud.google.com/service-monitoring)\n- [Disaster recovery](https://cloud.google.com/solutions/dr-scenarios-planning-guide)\n- [Velero Kubernetes backups](https://blog.doit-intl.com/google-kubernetes-engine-cluster-migration-with-velero-4a140b018f32)\n- [Project liens](https://cloud.google.com/resource-manager/docs/project-liens)\n- [Labeling best practices](https://blog.doit-intl.com/google-cloud-platform-resource-labeling-best-practices-66fded7ba57)\n- [Billing data exports](https://cloud.google.com/billing/docs/how-to/export-data-bigquery)\n- [VPC service controls](https://cloud.google.com/vpc-service-controls)\n- [Data loss prevention](https://cloud.google.com/dlp)\n- [Remove PII from logs](https://polleyg.dev/posts/bigquery-new-tables-dlp/)\n- [Compliance manager and audit reports](https://cloud.google.com/security/compliance/compliance-reports-manager)\n- [Setting up budget alerts](https://cloud.google.com/billing/docs/how-to/budgets)\n- [Budget alert notifications](https://cloud.google.com/billing/docs/how-to/notify/)\n- [Automated resource scheduling (Zorya from DoiT)](https://blog.doit-intl.com/reduce-google-compute-engine-costs-by-60-with-zorya-gce-instance-scheduler-eae07131cafa)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdoitintl%2Fsecure-gcp-reference","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdoitintl%2Fsecure-gcp-reference","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdoitintl%2Fsecure-gcp-reference/lists"}