Patterns
Networking & Security
Cloud Infrastructure Google Cloud Platform DevOps & SRE Architecture

Networking & Security

Comprehensive guide to VPC, load balancing, Cloud Armor, IAM, and Secret Manager on Google Cloud Platform

Networking & Security

Google Cloud Platform provides comprehensive networking and security services to build secure, scalable, and high-performance applications. This section covers network architecture, load balancing, DDoS protection, identity management, and secret management. This guide provides everything from network setup basics to advanced security patterns.

Prerequisites

Before working with networking and security on GCP, ensure you have:

  • A GCP project with appropriate permissions
  • Understanding of networking fundamentals (IP addressing, subnets, routing)
  • Knowledge of security best practices
  • Familiarity with firewall and access control concepts
  • Understanding of compliance and regulatory requirements

Virtual Private Cloud (VPC)

Network isolation and connectivity for cloud resources. VPC provides network isolation and connectivity for GCP resources. It includes subnets, routes, firewalls, VPN gateways, and peering connections. VPC enables secure network architectures, hybrid connectivity, and granular network control for your cloud infrastructure.

Overview

VPC is the foundation of GCP networking, providing a virtual network that closely resembles a traditional physical network. It enables you to define network topologies, configure IP address ranges, and establish secure communication rules.

Key Components

Subnets

  • Regional subdivisions of VPC IP space
  • Can be private or public
  • Define IP address ranges using CIDR notation
  • Control which resources can communicate

Routes

  • Define traffic paths between subnets
  • Static and dynamic routing options
  • Support for custom routes
  • Integration with Cloud Routers

Firewall Rules

  • Stateful firewall rules
  • Allow/deny based on IP, protocol, port
  • Applied at the network level
  • Support for service accounts

VPN Gateways

  • Site-to-site VPN connections
  • Cloud VPN for secure connectivity
  • High availability options
  • BGP for dynamic routing

Network Architecture Patterns

Hub-and-Spoke

  • Central hub VPC with spoke VPCs
  • Shared services in hub
  • Isolated workloads in spokes
  • VPC peering for connectivity

Multi-tier

  • Web tier in public subnets
  • Application tier in private subnets
  • Database tier in isolated subnets
  • Firewall rules between tiers

Global Architecture

  • Multi-region VPC deployment
  • Cross-region load balancing
  • Disaster recovery capabilities
  • Low latency access

Use Cases

  • Creating secure network boundaries
  • Implementing hybrid cloud connectivity
  • Requiring granular network control
  • Building multi-tier applications
  • Implementing network segmentation

Pros

  • Network isolation and security
  • Hybrid connectivity options
  • Granular network control
  • Global and regional networking

Cons

  • Network complexity increases
  • Requires networking expertise
  • Configuration management overhead
  • Potential misconfiguration risks

VPC Creation

# Create VPC
gcloud compute networks create my-vpc \
  --subnet-mode=custom

# Create subnet
gcloud compute networks subnets create my-subnet \
  --network=my-vpc \
  --region=us-central1 \
  --range=10.0.0.0/24

# Create firewall rule
gcloud compute firewall-rules create allow-ssh \
  --network=my-vpc \
  --allow=tcp:22 \
  --source-ranges=0.0.0.0/0

Cloud Load Balancing

Distribute traffic across multiple instances for high availability. Cloud Load Balancing distributes traffic across multiple instances of your applications for high availability and reliability. It supports global load balancing, SSL/TLS termination, protocol-aware routing, and integration with Cloud CDN.

Load Balancer Types

Global External Application Load Balancer

  • Global anycast IP address
  • Layer 7 HTTP/HTTPS load balancing
  • Content-based routing
  • Integration with Cloud CDN

Regional External Application Load Balancer

  • Regional IP addresses
  • Layer 7 HTTP/HTTPS load balancing
  • Lower latency for regional traffic
  • Cost-effective for regional workloads

Regional Internal Application Load Balancer

  • Internal IP addresses only
  • Layer 7 HTTP/HTTPS load balancing
  • Private service access
  • Microservices communication

Cross-Region Internal Application Load Balancer

  • Internal IP addresses across regions
  • Layer 7 HTTP/HTTPS load balancing
  • Global private communication
  • Multi-region microservices

Network Load Balancing

  • Layer 4 TCP/UDP load balancing
  • High performance, low latency
  • Protocol-pass-through
  • Non-HTTP workloads

Key Features

  • Global Anycast: Single IP address worldwide
  • SSL/TLS Termination: Managed certificate management
  • Health Checks: Automatic instance health monitoring
  • Auto-scaling Integration: Works with GKE, Cloud Run, MIGs
  • Session Affinity: Sticky sessions for stateful apps

Use Cases

  • Scaling applications globally
  • Ensuring high availability
  • Optimizing performance across regions
  • Handling high traffic volumes
  • Implementing zero-downtime deployments

Pros

  • Global load balancing
  • Integrated with other GCP services
  • SSL/TLS termination
  • Health checking and auto-healing

Cons

  • Additional infrastructure cost
  • Configuration complexity
  • Potential single point of failure
  • Requires proper health checks

Configuration

# load-balancer.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    kubernetes.io/ingress.global-static-ip-name: my-static-ip
spec:
  rules:
  - host: my-app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: my-service
            port:
              number: 80

Cloud Armor

DDoS protection and web security for applications. Cloud Armor provides DDoS protection and web security for applications behind Cloud Load Balancing. It offers edge security policies, WAF capabilities, IP blacklisting/whitelisting, and pre-configured rules for common threats.

Security Features

DDoS Protection

  • Global DDoS mitigation infrastructure
  • Automatic attack detection and mitigation
  • Protection against volumetric attacks
  • Layer 3/4/7 attack protection

Web Application Firewall (WAF)

  • OWASP Top 10 protection
  • SQL injection prevention
  • Cross-site scripting (XSS) protection
  • Custom security rules

IP-based Controls

  • IP blacklists and whitelists
  • Geographic blocking
  • Rate limiting by IP
  • Country-based access control

Pre-configured Rules

  • Common attack signatures
  • Security best practices
  • Compliance requirements
  • Regularly updated signatures

Use Cases

  • Protecting web applications from DDoS attacks
  • Implementing security policies
  • Requiring edge security filtering
  • Meeting compliance requirements
  • Protecting against common web vulnerabilities

Pros

  • DDoS protection at scale
  • Integrated with load balancing
  • Custom security policies
  • Real-time threat visibility

Cons

  • Additional service cost
  • Rule configuration complexity
  • Potential false positives
  • Requires ongoing rule maintenance

Security Policy

# Create security policy
gcloud compute security-policies create my-security-policy \
  --description="My security policy"

# Add pre-configured WAF rules
gcloud compute security-policies rules create 1000 \
  --security-policy=my-security-policy \
  --expression="evaluatePreconfiguredExpr('xss-stabilization')" \
  --action="allow"

# Add IP whitelist
gcloud compute security-policies rules create 2000 \
  --security-policy=my-security-policy \
  --expression="inIpRange(origin.ip, '192.0.2.0/24')" \
  --action="allow"

IAM Security

Identity and Access Management for secure resource access. IAM is Google Cloud’s centralized security framework for controlling access to resources. It uses a unified model with roles, permissions, and policies to enforce the principle of least privilege. Includes features like service accounts, policy bindings, and integration with external identity providers.

IAM Model

Permissions

  • Fine-grained access control
  • Specific actions on resources
  • Defined by Google Cloud services
  • Cannot be directly assigned

Roles

  • Collections of permissions
  • Three types: Basic, Predefined, Custom
  • Assignable to principals
  • Hierarchical inheritance

Policies

  • Bind roles to principals
  • Specific to resources
  • Inherited through hierarchy
  • Additive nature

Principal Types

Google Accounts

  • Individual user accounts
  • Gmail or Google Workspace
  • Personal or corporate
  • Full access control

Service Accounts

  • Applications and services
  • Non-human identity
  • Key-based authentication
  • Used for programmatic access

Google Groups

  • Collection of users
  • Simplified management
  • Nested group support
  • Granular permissions

External Identities

  • Federated identity
  • SAML 2.0 / OIDC
  • Workload Identity Federation
  • Cloud Identity

Best Practices

Principle of Least Privilege

  • Grant minimum required permissions
  • Use specific roles over basic roles
  • Regular permission audits
  • Temporary access elevation

Resource Hierarchy

  • Organization policies
  • Folder-level permissions
  • Project-level isolation
  • Resource-specific controls

Service Account Management

  • Dedicated service accounts per application
  • Key rotation and management
  • Workload Identity Federation
  • Disable unused accounts

Use Cases

  • Securing access to GCP resources
  • Implementing compliance requirements
  • Managing team permissions across projects
  • Controlling application access
  • Implementing audit trails

Pros

  • Centralized access control
  • Fine-grained permissions
  • Integration with enterprise identity
  • Audit logging and compliance

Cons

  • Complex permission modeling
  • Requires careful planning
  • Permission hierarchy complexity
  • Potential for over-permissive policies

IAM Commands

# Grant role to user
gcloud projects add-iam-policy-binding my-project \
  --member='user:alice@example.com' \
  --role='roles/editor'

# Create service account
gcloud iam service-accounts create my-sa \
  --display-name="My Service Account"

# Grant role to service account
gcloud projects add-iam-policy-binding my-project \
  --member='serviceAccount:my-sa@my-project.iam.gserviceaccount.com' \
  --role='roles/storage.objectAdmin'

# Create custom role
gcloud iam roles create my-custom-role \
  --project=my-project \
  --title="My Custom Role" \
  --permissions="compute.instances.start,compute.instances.stop"

Secret Manager

Secure storage and management of sensitive data. Secret Manager is a secure and convenient storage system for sensitive data like API keys, passwords, and certificates. It provides versioning, automatic rotation, access control through IAM, and integration with other GCP services.

Key Features

Secret Storage

  • Encrypted at rest and in transit
  • Automatic encryption with Google-managed keys
  • Customer-managed encryption keys (CMEK)
  • Regional and global availability

Versioning

  • Automatic version creation
  • Version history and rollback
  • Disable and destroy versions
  • Immutable secret versions

Access Control

  • IAM-based permissions
  • Fine-grained access policies
  • Audit logging for access
  • Integration with VPC Service Controls

Automatic Rotation

  • Scheduled rotation
  • Custom rotation logic
  • Integration with Pub/Sub notifications
  • Zero-downtime rotation

Integration Patterns

Cloud Run Integration

# secret-volume.yaml
apiVersion: serving.knative.dev/v1
kind: Service
metadata:
  name: my-service
spec:
  template:
    spec:
      containers:
      - image: gcr.io/my-project/my-app
        volumeMounts:
        - name: my-secret
          mountPath: /etc/secrets
      volumes:
      - name: my-secret
        secret:
          secretName: my-secret

GKE Integration

# external-secret.yaml
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: my-external-secret
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: my-secret-store
    kind: SecretStore
  target:
    name: my-secret
  data:
  - secretKey: api-key
    remoteRef:
      key: my-api-key

Use Cases

  • Storing sensitive configuration data
  • Managing secrets across applications
  • Implementing secret rotation policies
  • Securing API keys and credentials
  • Managing certificates and keys

Pros

  • Centralized secret management
  • Automatic rotation capabilities
  • Integrated access control
  • Audit logging and compliance

Cons

  • Additional service dependency
  • Cost for secret storage
  • Integration setup required
  • Learning curve for best practices

Secret Management

# Create secret
echo -n "my-secret-value" | gcloud secrets create my-secret \
  --data-file=-

# Access secret
gcloud secrets versions access latest \
  --secret=my-secret

# Add new version
echo -n "new-secret-value" | gcloud secrets versions add my-secret \
  --data-file=-

# Enable automatic rotation
gcloud secrets update my-secret \
  --rotation="7d" \
  --rotation-period="7d"

Network Security Best Practices

Defense in Depth

  • Layer security controls
  • Network segmentation
  • Zero-trust architecture
  • Continuous monitoring

Least Privilege

  • Minimize network exposure
  • Restrictive firewall rules
  • Private IP communication
  • Service account constraints

Monitoring and Alerting

  • VPC Flow Logs
  • Cloud Armor insights
  • IAM audit logs
  • Secret access logging

Compliance and Governance

  • Organization policies
  • Access transparency
  • Data residency controls
  • Regular security reviews

Common Issues and Troubleshooting

VPC Connectivity Problems

  • Verify subnet CIDR ranges and routing tables
  • Check firewall rule configurations
  • Review VPC peering status
  • Monitor network latency and throughput

Load Balancer Configuration Errors

  • Verify backend service health checks
  • Check URL map and routing rules
  • Review SSL/TLS certificate configuration
  • Monitor load balancer capacity limits

IAM Permission Issues

  • Verify service account permissions
  • Check role assignments and bindings
  • Review organization policy constraints
  • Monitor access logs for denied requests

Secret Access Problems

  • Verify secret version availability
  • Check IAM permissions for secret access
  • Review secret rotation schedules
  • Monitor secret access logs

Cleanup Commands

# Delete VPC network
gcloud compute networks delete my-vpc

# Delete load balancer
gcloud compute forwarding-rules delete my-lb --region=us-central1

# Delete security policy
gcloud compute security-policies delete my-security-policy

# Revoke IAM role
gcloud projects remove-iam-policy-binding my-project \
  --member='user:alice@example.com' \
  --role='roles/editor'

# Delete service account
gcloud iam service-accounts delete my-sa@my-project.iam.gserviceaccount.com

# Delete secret
gcloud secrets delete my-secret

Jump to other sections

Additional Resources