GCP

Org and project structure

• Org > Folder > Project hierarchy. Folders per environment (dev, staging, prod) or team
• Separate projects per environment. Never share prod project with other envs
• Dedicated logging/security project. Ship Audit Logs, SCC findings, and VPC Flow Logs there
• Organization Policy constraints: restrict public IPs, enforce uniform bucket access, restrict allowed regions, deny SA key creation
• Billing account per team or BU. Budget alerts per project

IAM

• Least privilege. Predefined roles before custom. Never primitive roles (Owner, Editor) in production
• Separate SA per workload and environment. No shared SAs across services
• No SA keys unless unavoidable. Use Workload Identity Federation for external systems, metadata server for GCP resources
• GKE: Workload Identity per pod. Never use default compute SA (PROJECT_NUMBER-compute@developer.gserviceaccount.com) — has broad Editor permissions
• Grant roles at resource level. Project-level only when scope is genuinely project-wide
• IAM Recommender enabled. Act on unused permission findings
• If keys exist: rotate regularly, audit usage, delete when unused. Never commit to git

Secrets

• Store in Secret Manager. Never in env vars, container images, Terraform state, or deployment manifests
• GKE: access via Secret Manager API or mounted volumes (Workload Identity + CSI driver)
• Auto-rotation enabled where supported
• Reference by resource name in Cloud Run and GKE specs. Never inline values

Networking

• VPC per environment. Shared VPC for multi-project setups
• Private Google Access on all subnets. No public IPs needed to reach GCP APIs
• Firewall rules: deny-all default, explicit allow only. No 0.0.0.0/0 except load balancer health checks
• Cloud NAT for outbound internet from private instances
• VPC Flow Logs on all subnets
• Private Service Connect for managed services (Cloud SQL, Memorystore, etc.)
• Cloud Armor on all internet-facing load balancers. WAF rules + DDoS protection enabled

Security

• Security Command Center Standard or Premium enabled. Route findings to security project
• Cloud Audit Logs enabled for all services: Admin Activity and Data Access
• Binary Authorization on GKE — signed images from trusted registries only
• Artifact Registry: vulnerability scanning on push. Block deploy on critical/high CVEs
• Enable Access Transparency for visibility into Google admin actions
• Shielded VMs on all GCE instances. Confidential VMs for sensitive workloads
• GCS: uniform bucket-level access enforced. No legacy ACLs

Compute

• Cloud Run for stateless workloads. GKE Autopilot for orchestrated. Raw GCE requires justification
• Cloud Run: set --min-instances to avoid cold starts on latency-sensitive services. Set --concurrency and --cpu explicitly. --cpu-boost on startup where needed
• GKE: separate node pools per workload profile (e.g. spot, high-memory, GPU)
• GKE: Pod Security Standards enforced. Workload Identity per pod. No default compute SA
• Cloud SQL: private IP only, IAM auth, automated backups, deletion protection on

IaC

• All infrastructure as code (Terraform, Pulumi, or Deployment Manager). No manual console changes in production
• IaC in version control. Changes via PR, not direct apply
• Secrets never in IaC source. Use Secret Manager references at deploy time
• Separate Terraform state per environment. Remote state in GCS with versioning and locking

Ops

• Label all resources: env, team, service, owner. Enforce with org policies
• Cloud Logging: set retention explicitly on all log buckets. Default retention incurs cost at scale
• Cloud Monitoring + Cloud Logging for all workloads. Alerting policies on error rates, latency, saturation
• Enable Error Reporting, Cloud Trace, and Cloud Profiler for full observability
• Multi-region or regional HA for all stateful services. Zonal = not production
• Committed Use Discounts for predictable baseline compute (GCE, Cloud SQL, GKE)