Skip to content

Best Pratices

High Level Documentation

Link Notes
Google Cloud security best practices center Best practices guides provide specific, informed guidance on helping secure Google Cloud deployments and describe recommended configurations, architectures, suggested settings, and other operational advice

Operational Guides

Link Notes
Google Cloud security foundations guide Opinionated guidance and accompanying automation to help you build security into your starting point for your Google Cloud deployments (companion repo)
PCI on GKE Set of Terraform configurations and scripts that demonstrate how to bootstrap a PCI environment in Google Cloud
Best practices for enterprise multi-tenancy Best practices to safely and efficiently set up multiple multi-tenant clusters for an enterprise organization
Why You Should Enable GKE Shielded Nodes Today Mitigations provided by Shielded Nodes
Bastion Hosts

Code Samples

Link Notes
Cloud Foundation Toolkit Best practice Infrastructure as Code (IaC) templates
cloud-foundation-fabric End-to-end modular samples for Terraform on GCP
Google Cloud samples Search for samples demonstrating the usage of Google Cloud products, across ML APIs, Storage, serverless, and more. You can filter by language and product



Link Notes
Exchange AWS Credentials for GCP Credentials using GCP STS Service Sample procedure that will exchange a long term or short term AWS credential for a GCP credential
Access GCP from AWS using Workload Identity Federation
  • Workload Identity federation allows to access GCP resources from AWS without the need for service account keys
  • gcp-workload-identity-federation: Python module to enable workload identity federation from AWS to GCP
Keyless API - Launching GCP workloads from AWS How to call Google Cloud APIs from AWS or Azure without managing secret keys impersonating a service account


Link Notes
Domain-Wide Delegation of Authority in GSuite
  • How to setup Domain-Wide Delegation of Authority in GSuite
Don't fear the authentication: Google Drive edition
  • Just as you can share a Drive folder with a person, you can also share a Drive folder with an IAM service account
Back to top