Security engineering begins by defining who can act on a resource, which paths can reach it, and what evidence records the result. Our smallest boundary is a Cloud Storage bucket in one Google Cloud project, accessed by a Cloud Run service. The course will extend this boundary into identity, network, encryption, detection, and verification controls.
Identity and Access Management (IAM) authorizes a principal to perform a permitted action on a resource. IAM allow policies can inherit from the organization, folder, or project to the bucket. A service account is a workload identity, not a human administrator account. Granting only the runtime service account the bucket permission limits the data-plane request boundary.
Network controls govern traffic paths rather than resource permissions. VPC firewall rules evaluate traffic for Compute Engine network interfaces. Cloud Key Management Service (Cloud KMS) manages customer-controlled encryption keys for supported resources. Security Command Center collects security posture and threat-detection findings. Each control answers a different question, so none replaces IAM authorization.
Let’s inspect how organization, project, and resource controls meet at one workload boundary.
Assume example-payments-project hosts a Cloud Run service in us-central1. Its runtime service account writes approved receipts to example-receipts-bucket. An administrator group reviews configuration. A separate continuous integration and delivery service account deploys revisions. Separating these identities prevents a deployment credential from automatically becoming a data-access credential.
The threat model includes a compromised developer credential, an overbroad runtime role, and unintended data export. The Cloud Run service needs only its required bucket actions. The administrator group needs controlled management access. The deployment identity needs deployment permissions, not broad operational administration. This establishes least privilege as a testable requirement rather than a generic intention.
Let’s visualize the identities, region, and data resource that define this workload’s security scope.