A digital media production enterprise hosts high-value pre-release video assets within Cloud Storage buckets and processes analytics using BigQuery. The security team must ensure that authorized developers and automated pipelines working within the environment cannot exfiltrate raw assets to external Google Cloud resources outside the organization. Additionally, access to Google APIs from on-premises workstations must be strictly constrained to private network paths without exposing traffic to the public internet. Which TWO security controls should you implement to satisfy these requirements?
- Define a VPC Service Controls perimeter surrounding the project containing the Cloud Storage buckets and BigQuery datasets.Answer
- BGrant primitive Owner roles to service accounts while using Cloud IAM conditional policies to restrict bucket access by IP address.
- Configure Private Google Access for on-premises hosts by routing traffic destined for restricted.googleapis.com over Cloud VPN or Cloud Interconnect.Answer
- DEstablish VPC Network Peering between all internal VPCs and external partner VPCs to form a transitive network perimeter without service perimeters.
Answer
The architectural requirements are met by establishing a VPC Service Controls perimeter around the project resources to prevent exfiltration, and configuring Private Google Access for on-premises hosts via restricted.googleapis.com over hybrid connectivity.
Combining VPC Service Controls with Private Google Access for on-premises hosts using the restricted VIP creates a complete defense-in-depth perimeter. VPC Service Controls ensures that even authorized credentials cannot copy Cloud Storage or BigQuery data into projects outside the security perimeter. Routing on-premises requests via Cloud Interconnect or VPN to restricted.googleapis.com ensures all API calls stay on private network paths and comply with perimeter restrictions.
Step-by-Step Solution
Key Concept
Perimeter Security & Data Exfiltration Prevention