The Technology Chronicle

 Google API Private Access Private Google Access is configured at the subnet level and allows subnetworks to access GCP services privately. The resources in the subnet can access Google services without an external IP, for eg: Cloud storage, Youtube, etc. It offers better security as the exposure to outside networks is reduced, thereby minimizing the possibilities of data interception and attacks. Google cloud service accounts  These accounts are used for service-to-service authentication. For eg: an application in compute engine can use a service account to access a storage account  Two types of service accounts - Google-managed service accounts & user-managed service accounts In Google-managed service accounts, the private and public keys are managed by Google. Each key can be used for a max of two weeks. Private keys of google managed keys are never directly accessible and the platform itself manages the key rotation process With user-managed keys, only public keys...

 Integrating existing identity management solution with Google Cloud Platform Given below are the  steps to integrate a third party identity management platform You should have a domain that is enabled for email. In case of a preexisting domain registered with Google or a non-existent domain you cannot proceed You should have permissions to verify domain ownership by creating txt or CNAME entry Implement SAML SSO if existing identity management system is to be used for authentication to GCP console Create the first cloud identity administration account and account for admin who will manage users in GCP Configure billing accounts- this can either be an online account or offline invoiced account linked to a Purchase Order. For applying for an invoiced billing account you would need to meet certain criteria , ie be a registered business for one year, have min billing of $2500/month for 3 months Create additional admin accounts like network admins or organization admins Use direct...

   This blog covers review notes for logging, DNS security & Google Cloud web Security Scanner Service 1. Aggregated sinks Sinks can be constructed with the "includeChildren" parameter set to "True" for cloud organisation / folders. The logs from these organizations , folders , projects or billing accounts can be routed to these sinks. 2. DNS security extension DNS Security Extensions (DNSSEC) is the security protocol that enables authentication of DNS data. It is a DNS protocol extension that adds an additional degree of security by enabling users to digitally sign their DNS records, making it more challenging for attackers to tamper with DNS data. Customers can enable DNSSEC on Google Cloud's Cloud DNS service to safeguard their domains from unauthorized alterations. 3. Google Cloud web Security Scanner Service To find common vulnerabilities in web applications, such as those listed in the OWASP Top 10, customers can use the Google cloud web security sca...

Key points to review before the exam about firewalls, container best practices and DDoS protection 1. Firewall default rules: Following rules are created with lowest priority and will be applicable if not overridden by a higher priority rule All default outbound traffic is allowed (Refer the following document for exceptions: https://cloud.google.com/vpc/docs/firewalls#blockedtraffic) All ingress traffic is blocked 3. Container best practices: Package single app or piece of software as a container. An application with unique parent process but different possible child processes qualifies for this Run a PID1 and register Signal handlers Enable process namespace sharing in Kubernetes Use a specialized init system Optimize for Docker build cache Remove unnecessary tools Build the smallest image possible using the smallest base image, creating images with common layers and reducing clutter Enable image scanning for vulnerability Tag images using options like semantic versioning and Git c...

Do checkout some of  my blogs that I published in Medium.com in 2022 in Google Cloud Community Google Cloud DevOps Series : Google Cloud compute options for Kubernetes This is a blog series on Google Cloud DevOps , and how Devops is done the Google way. I have authored Part 2 of the blog series that talks about Compute options for Kubernetes Google Cloud Anthos Series : Anthos Multi-Cluster Ingress This is a blog series on Google Cloud Anthos and how it can help scale your applications transcending geographic and cloud boundaries. I have authored Part 6 of this blog series that explains how Multi-Cluster Ingress can be enabled for Anthos SAP on Google Cloud Series : The fundamentals This is a blog series that focusses on the constructs of hosting SAP workloads on Google cloud. I have authored Part 1 of the  blog series that covers the fundamentals of SAP on Google cloud