Google Cloud
Google Cloud's IAM model is powerful and easy to over-grant if you don't design the org policy hierarchy first. Perimeters and workload identity federation are where I spend most of my review time.
Updated
How I use it
- Organization policy hierarchy design as the baseline, before touching individual project IAM
- Workload Identity Federation to remove long-lived service account keys from CI/CD
- VPC Service Controls perimeters around sensitive data services
Recurring problems I find
- Service account keys downloaded once for a script and never rotated or removed
- Broad roles (Editor, Owner) granted for convenience at the project level
Google now offers a first-class Agent Identity, supported as a principal in VPC Service Controls and org policy.
Related
Wiz Technical Essentials
Wiz Technical Essentials: agentless cloud security posture management, toxic-combination analysis and cloud risk prioritisation.
Cloud security assessment
Configuration and architecture assessment for Azure, GCP and Alibaba Cloud: identity, network, data, logging and CSPM findings with a fix roadmap.
Cloud security
Multi-cloud security practice: landing zones, identity, posture management, MITRE ATT&CK-aligned detection engineering and CIS hardening baselines.
Multi-cloud baseline
How to express a single set of security requirements — including AI workload guardrails — across Azure, Google Cloud and Alibaba Cloud without maintaining three unrelated standards.