Network security in the Google Cloud Platform

Intertwined

Virtual private clouds (VPCs) have seen Google and other hyperscalers revolutionize network management in the cloud. Although the process of dynamically creating and managing networks in on-premises IT can be very time-consuming – despite new developments such as software-defined networking (SDN) – cloud providers now offer APIs that can be used to create network constructs such as VPCs in next to no time.

However, cloud networks are often managed by DevOps teams, and the level of knowledge in DevOps is not always such that all security concerns are diligently taken into account. Additionally, the field of network security is relatively wide and presupposes expertise in tasks such as creating VPCs and their subnets, routing, analyzing flow logs, setting up firewalls, and establishing threat detection. Such concerns prompted this look into key security aspects in the Google Cloud Platform (GCP).

Enhancing Security with Shared VPC

Shared VPC is an evolution of the virtual private cloud. Shared VPC allows you to connect resources from multiple projects to a common VPC network. You can easily create a VPC with any kind of misconfiguration you can imagine. The approach of Shared VPC is to delegate the tasks of creating and managing the VPCs to a dedicated team to offload the burden of network security from the application teams, letting them take care of their applications.

Figure 1 illustrates the use of Shared and simple VPCs. In the lower part of the image, you can see a VPC spanning two regions with one subnet per region. The VPC and the virtual machines (VMs) belong to the same project, and you can see a dedicated host project at the top of the image, where Shared VPC was configured and shared. Service projects A and B are allowed to use Shared VPC, which means the projects run the VMs themselves, and the interfaces of the

...

Use Express-Checkout link below to read the full article (PDF).