Security Best Practices in Google Cloud

Name: Security Best Practices in Google Cloud
Rating: 4.8 (5 reviews)

Master Google Cloud Security: Secure Compute Engine, Cloud Data, Applications, and GKE with Enterprise Best Practices.

Created byJairo Pirona | Trainer & Solutions Architect.

Last updated 4/2026

English

English [Auto],

What you'll learn

Secure Compute Engine using IAM roles, service accounts, organization policies, and advanced VM configurations like Shielded and Confidential VMs.
Protect cloud data in GCS and BigQuery using advanced encryption (CMEK/CSEK), signed URLs, and granular access controls with authorized views.
Mitigate application vulnerabilities and phishing threats using Web Security Scanner, Identity-Aware Proxy (IAP), and Secret Manager for credentials.
Harden Google Kubernetes Engine (GKE) clusters by implementing Workload Identity, Binary Authorization, and integrated monitoring/logging solutions.

Course content

6 sections • 49 lectures • 3h 50m total length

Introduction course
Welcome to Security Best Practices in Google Cloud!
By enrolling in this course, you are joining a growing community of cloud professionals — including information security analysts, cloud architects, engineers, and cybersecurity specialists — working to help their organizations protect systems, networks, and applications against modern cyber threats.
This course provides a broad overview of the key security controls and best practices available on Google Cloud, covering the four main pillars where security decisions are made every day: virtual machines, cloud data, applications, and container workloads.
What to expect:
The course is structured into four modules, each focused on a specific area of Google Cloud security. You will find video lessons and curated reference links that walk you through the most relevant concepts, tools, and recommended approaches for each topic.
The four modules in this course are:
Module 1 – Securing Compute Engine: Service accounts, IAM roles and API scopes, VM login management, organization policy controls, Shielded and Confidential VMs, and Certificate Authority Service.
Module 2 – Securing Cloud Data: Cloud Storage IAM and ACLs, data auditing, signed URLs, customer-managed and customer-supplied encryption keys (CMEK/CSEK), Cloud HSM, and BigQuery authorized views.
Module 3 – Application Security: Common application vulnerabilities, Web Security Scanner, identity and OAuth phishing, Identity-Aware Proxy (IAP/BeyondCorp Enterprise), and Secret Manager.
Module 4 – Securing Kubernetes (GKE): GKE architecture overview, authentication and authorization, cluster hardening, workload security, Workload Identity, Binary Authorization, and Cloud Monitoring integration.
If you want to build a more advanced, certification‑oriented and hands‑on skill set in Google Cloud security after completing this course, a natural next step is to prepare for the Google Cloud Professional Cloud Security Engineer certification. That path goes deeper into practical topics such as identity and access management, network security, data protection, and day‑to‑day security operations on Google Cloud, with a stronger focus on real‑world scenarios and implementation details than this course.

Intro0:36
Service accounts, IAM roles, and API scopes4:07
Connecting to virtual machines3:43
Connecting to VMs without external IPs2:15
Discover methods to connect to Google Cloud VMs without a public IP address, including bastion hosts with SSH, IAP TCP forwarding, and VPN for secure access.
OS Login2:24
Organization policy controls1:52
Explore Organization Policy Service and organization policy controls that provide centralized and programmatic control to enforce Compute.TrustedImageProjects constraints for organization-approved images.
Shielded VMs2:48
Confidential VMs2:16
Certificate Authority Service2:06
What Certificate Authority Service provides2:06
Compute Engine best practices3:06
Module review2:57

Intro1:13
Cloud Storage IAM permissions and ACLs2:32
Auditing cloud data1:37
Signed URLs and policy documents3:38
Encrypting with CMEK and CSEK8:32
Cloud HSM3:45
Understand how Cloud HSM delivers hardware-based key management and attestation with tamper-evident physical security. Integrate with Cloud KMS while Google manages cluster to support keys generated by Google or customers.
BigQuery IAM roles and authorized views2:02
Storage best practices2:54
Module review2:14

Intro0:42
Types of application security vulnerabilities4:02
Identify common application security vulnerabilities, from injection flaws and cross-site scripting to insecure authentication and data protection lapses, misconfigurations, and vulnerable components, and ensure timely patching and updates.
Web Security Scanner4:53
Threat: Identity and Oauth phishing2:49
Identity-Aware Proxy (IAP)4:29
Explore how Identity-Aware Proxy (IAP) provides authentication and authorization for cloud apps, enabling edgeless, VPN-free access from any location while enforcing context-aware access to VMs and resources.
Secret Manager7:07
Module review2:56

Intro0:42
Introduction to Kubernetes/GKE4:16
Explore Kubernetes core architecture, including pods, containers, nodes, clusters, and the control plane, and learn how GKE handles security, secrets, and encryption with CMEK.
Authentication and authorization2:25
Understand authentication and authorization in Google Kubernetes Engine and how accounts gain access to resources. Use workload identity and role-based access control to enforce least privilege for users and pods.
Hardening your clusters8:02
Securing your workloads3:48
Monitoring and logging2:11
Module review1:23

Intro0:48
IAM Configuration14:35
Configure google cloud iam by switching users, reviewing roles, and creating a storage bucket with cloud shell; build and manage a custom privacy reviewer role with yaml.
VPC Firewall Configuration15:33
Introduction to Cloud IDS9:49
Configuring, Using, and Auditing Service Accounts and Scopes7:13
Using Customer-Supplied Encryption Keys11:35
Creating a BigQuery Authorized View9:21
Identifying Application Vulnerabilities in Security Command Center6:44
Deploy a Flask app on a Google Cloud VM with an IP and port 8080, scan for vulnerabilities with the web security scanner, then fix cross-site scripting by escaping inputs.
Protecting Compute Engine Applications with BeyondCorp Enterprise14:30
Configuring and Using Credentials with Secret Manager5:10
Configuring Traffic Blocklist Rules7:02
Redacting Sensitive Data with the DLP API5:14
Configuring and Using Cloud Logging and Cloud Monitoring14:27

Requirements

Basic understanding of Cloud Computing and familiarity with the Google Cloud Platform (GCP) Console.
General knowledge of IT networking concepts (IP addresses, Firewalls, SSH, and RDP).
A foundational grasp of security principles (IAM and encryption) is helpful but not strictly required to follow the course.

Description

Welcome to Security Best Practices in Google Cloud, a deep-dive technical course designed for professionals who need to build, manage, and scale secure infrastructures on Google Cloud Platform (GCP). In today’s cloud-first world, security is not just a feature—it is the foundation of every successful deployment.

This course focuses on the "why" and "how" of security protocols, providing a solid conceptual foundation that goes beyond simple configuration.

This course is structured into four high-impact modules that follow the official Google Cloud security curriculum:

Securing Compute Engine: We begin by fortifying your virtual infrastructure. You will master IAM roles, service accounts, and API scopes using the principle of least privilege. We also cover advanced protection layers like OS Login, Shielded VMs, and Confidential VMs to ensure your compute resources are locked down.
Securing Cloud Data: Protect your "crown jewels." You will learn how to manage Cloud Storage permissions, utilize signed URLs for secure access, and implement advanced encryption using Customer-Managed (CMEK) and Customer-Supplied (CSEK) encryption keys. We also cover BigQuery authorized views to secure your data analytics.
Application Security: Learn to defend against modern threats. We explore the Web Security Scanner, Identity-Aware Proxy (IAP) for secure application access without VPNs, and Secret Manager for centralized, secure credential handling.
Securing Google Kubernetes Engine (GKE): Containers require specialized security. You will learn GKE hardening, Workload Identity, and Binary Authorization to ensure only trusted code runs in your environment.

This course is intentionally designed to be high-density and direct, providing the technical depth needed for Architects, DevOps Engineers, and Security Analysts without unnecessary fluff. By the end of this course, you will have a comprehensive toolkit to implement enterprise-grade security across the entire Google Cloud ecosystem.

Start building a more secure cloud environment today!

Who this course is for:

Cloud Architects and System Engineers aiming to specialize in securing critical infrastructure and workloads on Google Cloud.
DevOps Professionals looking to implement security-as-code and protect containerized applications in GKE.
Security Analysts and IT Administrators responsible for managing identities, data protection, and access in enterprise cloud environments.
IT Professionals preparing for Google Cloud Security certifications who need a focused, practical deep dive.

Security Best Practices in Google Cloud

What you'll learn

Explore related topics

Course content

Introduction1 lecture0

Module 1: Securing Compute Engine12 lectures • 30min

Module 2: Securing Cloud Data9 lectures • 28min

Module 3: Application Security7 lectures • 27min

Module 4: Securing Kubernetes7 lectures • 23min

Hand-on Labs13 lectures • 2hr 2min

Requirements

Description

Who this course is for: