GCP Security Best Practices: 20 Practical Wins (2026)

The 20 essential best practices for production-grade GCP security, organized into 5 categories — IAM, encryption, networking, operations, and compliance. These are the standard implementation patterns for the Zero Trust era.

IAM (5 items)

Ban Basic Roles (Owner/Editor/Viewer): switch to Predefined Roles + Custom Roles in production
Workload Identity Federation: fully eliminate SA key creation
Google Group-based IAM: never grant directly to individual users (prevents access leaks when staff leave)
SA Impersonation: temporarily borrow another SA's permissions (no key required)
Privileged Access Manager (PAM): Just-in-time privileged roles with approval workflow

Encryption and Key Management (4 items)

Apply CMEK across all services: GCS, BQ, Compute, Spanner, Pub/Sub, and more
Cloud HSM / EKM: mandatory for finance, healthcare, and regulated industries
Automatic key rotation: 90 days recommended
Confidential Computing: encrypt VM/GKE memory too (encryption in use)

Networking (4 items)

VPC Service Controls: protect the API layer of BigQuery, GCS, and similar services with a Perimeter
Private Google Access + Restricted VIP: access Google APIs without an external IP
Cloud Armor (Plus / Enterprise): WAF + DDoS + Adaptive Protection
Hierarchical Firewall Policy: enforce minimum rules at the organization/folder level

Zero Trust (3 items)

Identity-Aware Proxy (IAP): gate web/SSH traffic with OAuth + Context-Aware authentication
BeyondCorp Enterprise: Endpoint Verification + Context-Aware Access integrated
Chrome Enterprise Premium: browser-layer DLP + Threat Prevention

Operations and Monitoring (2 items)

Enable all Cloud Audit Logs: export to BQ including Data Access Logs and retain long-term
Security Command Center Enterprise: SIEM (Chronicle) + integrated threat detection

Compliance (2 items)

Assured Workloads: automate regulatory compliance for HIPAA, FedRAMP, EU Sovereign, and more
Sensitive Data Protection (formerly DLP): auto-detection of PII + masking + tokenization

Essential Organization Policy Examples

# 1. Disallow service account key creation
constraints/iam.disableServiceAccountKeyCreation = true

# 2. Restrict trusted domains
constraints/iam.allowedPolicyMemberDomains = ["example.com"]

# 3. Restrict external IPs on VMs
constraints/compute.vmExternalIpAccess = DENY

# 4. Restrict resource locations
constraints/gcp.resourceLocations = ["asia-northeast1", "asia-northeast2"]

# 5. Enforce uniform bucket-level access
constraints/storage.uniformBucketLevelAccess = true

# 6. Require Shielded VM
constraints/compute.requireShieldedVm = true

# 7. Require OS Login
constraints/compute.requireOsLogin = true

Security Product Map (2026)

Category	Product
Identity	Cloud Identity / Workspace
IAM	IAM, PAM, Workload Identity Federation
Keys	Cloud KMS, Cloud HSM, Cloud EKM
Network	Cloud Armor, VPC SC, Cloud IDS
Zero Trust	IAP, BeyondCorp Enterprise, Chrome Enterprise Premium
SIEM / Threat Detection	Security Command Center Enterprise (consolidated SCC + Chronicle + Mandiant)
Data Protection	Sensitive Data Protection (formerly DLP), Confidential Computing
Compliance	Assured Workloads, Access Transparency, Customer Lockbox

Integrated Zero Trust Architecture

Require SSO + 2FA + FIDO2 in Cloud Identity
Collect device posture with Endpoint Verification
Define Access Levels in Access Context Manager
Gate web and SSH traffic with IAP
Prevent BQ/GCS API exfiltration with VPC SC
Cover external-facing WAF + DDoS with Cloud Armor
Gain end-to-end visibility + threat detection via SCC Enterprise
Aggregate all logs and run detections in Chronicle SIEM

What should be the top GCP security priorities?

1. Eliminate Basic Roles (Owner/Editor) and switch to Predefined Roles. 2. Ban Service Account keys and adopt Workload Identity. 3. Enable VPC SC + CMEK. 4. Turn on all Cloud Audit Logs. 5. Deploy Security Command Center Enterprise.

Is Security Command Center required?

Strongly recommended for production. Standard is free, and Premium is now SCC Enterprise (consolidated in 2024). It bundles a wide range of threat detection and compliance checks into a single platform.

Where should a Zero Trust implementation start?

Start with the combination of Cloud Identity, Endpoint Verification, IAP, Context-Aware Access, and VPC Service Controls. BeyondCorp Enterprise (Chrome Enterprise Premium) provides the integrated package.

Should you never create Service Account keys?

If Workload Identity Federation can replace them, do not create them. Enforce the ban organization-wide with the Organization Policy constraints/iam.disableServiceAccountKeyCreation.

How many encryption options are there?

Google Default (automatic), CMEK (Customer-managed), CSEK (Customer-supplied), Cloud HSM, Cloud EKM (external HSM), and Confidential Computing (encryption in use).

How should PII and sensitive data be handled?

Detect and mask with Sensitive Data Protection (formerly DLP), encrypt with CMEK, prevent exfiltration with VPC SC, and log every access via Audit Logs.

What compliance certifications does GCP support?

ISO 27001 / 27017 / 27018 / 27701, SOC 2/3, PCI DSS, HIPAA BAA, FedRAMP, GDPR, and more. Assured Workloads automates regulatory compliance.

What is the DDoS defense?

Google Front End (GFE) automatically mitigates L3/L4 DDoS, while Cloud Armor (Standard / Plus / Enterprise) covers L7 plus WAF and Adaptive Protection.

Check what you learned with practice questions

Practice with certification-focused question sets

Visit GCP Exam Prep

Author

NicheeLab Editorial Team

NicheeLab editorial team focused on data engineering and cloud certification learning. Content is structured around practical study needs and official exam domains.

Top 20 GCP Security Best Practices: Zero Trust, CMEK, VPC SC, SCC