About This Edition: A clean, intermediate-level architectural guide covering all 14 Subsections and 70 Official Considerations of the Google Cloud Certified Professional Cloud Security Engineer curriculum, illustrated with Mermaid architecture blueprints and 140 custom-designed concept & architecture diagrams.
Chapter Plan at a Glance
Ch # | Chapter Title | Subsections | Considerations | Custom Diagrams | Core Focus |
|---|---|---|---|---|---|
00 | Overview | — | Mermaid | The Architectural Planes, plain-English guide to in-scope services, and the 10 Core Architectural Principles. | |
01 | 1.1, 1.2, 1.3 | 15 | 30 | Cloud Identity vs. Workspace, GCDS, third-party IdP SAML/OIDC SSO, Workforce Identity Federation, Service Account impersonation, Workload Identity Federation, and 2SV/session controls. | |
02 | 1.4, 1.5 | 11 | 22 | IAM Allow vs. Deny precedence, IAM Conditions, Privileged Access Manager (PAM) JIT elevation, Access Context Manager (ACM), Policy Intelligence Recommender, and Organization Policy constraints. | |
03 | 2.1, 2.2, 2.3 | 14 | 28 | Cloud NGFW Enterprise IPS, Cloud Armor WAF, Identity-Aware Proxy (IAP), Secure Web Proxy, Shared VPC micro-segmentation, VPC Service Controls (ingress/egress/dry-run/bridges), PGA, and Private Service Connect. | |
04 | 3.1, 3.2, 3.3 | 13 | 26 | Sensitive Data Protection (de-identification: FPE, tokenization, masking, bucketing), Secret Manager, CMEK vs. CSEK vs. Cloud HSM vs. Cloud EKM, Confidential Computing, and Vertex AI / Model Armor security. | |
05 | 4.1, 4.2 | 12 | 24 | Artifact Analysis CVE scanning, Binary Authorization attestations, Security Posture Management, Cloud Audit Logs, Log Router sinks, VPC Flow Logs, Packet Mirroring, Cloud IDS, and Security Command Center (SCC) Enterprise. | |
06 | 5.1 | 5 | 10 | Assured Workloads (FedRAMP, CJIS, IL4, EU Data Boundary), Key Access Justifications, Access Transparency vs. Access Approval, PCI-DSS tokenization descoping, HIPAA, and Shared Fate. | |
07 | All Sections | — | — | Side-by-side Look-Alike Tool Comparison Matrix, 5-Step Architecture Decision Checklist, and Top 25 Golden Rules. |
Detailed Table of Contents
Chapter 0: The PCSE Reference Stack & 10 Core Principles
- 0.1 The Master Architectural Map: All In-Scope Services of the PCSE Stack
- 0.2 The 10 Core Architectural Principles
Chapter 1: Identity, Authentication & Federation: Cloud Identity, SSO, Service Accounts & WIF
- Subsection 1.1: Managing Cloud Identity (Section 1: Configuring access)
- Consideration 1.1a: Configuring Google Cloud Directory Sync and implementing single sign-on (SSO) with a third-party identity provider (Diagrams:
pcse-1.1a-1-gcds-is-strictly-one.jpg,pcse-1.1a-2-gcds-mass-deletion.jpg) - Consideration 1.1b: Managing a super administrator account (Diagrams:
pcse-1.1b-1-separate-daily-driver.jpg,pcse-1.1b-2-maintain-to-super-admins.jpg) - Consideration 1.1c: Automating the user lifecycle management process (Diagrams:
pcse-1.1c-1-single-source-of-truth.jpg,pcse-1.1c-2-zero-touch-role-updates.jpg) - Consideration 1.1d: Administering user accounts and groups programmatically (Diagrams:
pcse-1.1d-1-use-admin-sdk-directory.jpg,pcse-1.1d-2-authorize-service.jpg) - Consideration 1.1e: Configuring Workforce Identity Federation (Diagrams:
pcse-1.1e-1-workforce-pool-provider.jpg,pcse-1.1e-2-attribute-mapping.jpg) - Quick Decision Cheat Sheet (Subsection 1.1)
- Subsection 1.2: Managing service accounts (Section 1: Configuring access)
- Consideration 1.2a: Securing and protecting service accounts including default service accounts (Diagrams:
pcse-1.2a-1-never-use-default.jpg,pcse-1.2a-2-prevent-creation.jpg) - Consideration 1.2b: Identifying scenarios requiring service accounts (Diagrams:
pcse-1.2b-1-vm-serverless-attached.jpg,pcse-1.2b-2-gke-pods-gke-workload.jpg) - Consideration 1.2c: Creating, disabling, and authorizing service accounts (Diagrams:
pcse-1.2c-1-controlling-who-can.jpg,pcse-1.2c-2-zero-downtime-rotation.jpg) - Consideration 1.2d: Securing, auditing, and mitigating usage of service account keys (Diagrams:
pcse-1.2d-1-preventative.jpg,pcse-1.2d-2-auditing-active-vs.jpg) - Consideration 1.2e: Managing and creating short-lived credentials (Diagrams:
pcse-1.2e-1-iam-service-account.jpg,pcse-1.2e-2-service-to-service.jpg) - Consideration 1.2f: Configuring Workload Identity Federation (Diagrams:
pcse-1.2f-1-workload-identity.jpg,pcse-1.2f-2-pinning-ci-cd-pipelines.jpg) - Consideration 1.2g: Managing service account impersonation (Diagrams:
pcse-1.2g-1-required-iam-role-roles.jpg,pcse-1.2g-2-local-developer-cli-adc.jpg) - Quick Decision Cheat Sheet (Subsection 1.2)
- Subsection 1.3: Managing authentication (Section 1: Configuring access)
- Consideration 1.3a: Creating password and session management policy for user accounts (Diagrams:
pcse-1.3a-1-password-management-in.jpg,pcse-1.3a-2-session-control-security.jpg) - Consideration 1.3b: Setting up Security Assertion Markup Language (SAML) and OAuth (Diagrams:
pcse-1.3b-1-saml-sso-configuration.jpg,pcse-1.3b-2-in-admin-console-service.jpg) - Consideration 1.3c: Configuring and enforcing 2-step verification (Diagrams:
pcse-1.3c-1-phishing-resistant-2sv.jpg,pcse-1.3c-2-onboarding-without.jpg) - Quick Decision Cheat Sheet (Subsection 1.3)
Chapter 2: Authorization & Hierarchy Governance: IAM Conditions, Deny Policies, PAM, ACM & Org Policies
- Subsection 1.4: Managing and implementing authorization controls (Section 1: Configuring access)
- Consideration 1.4a: Managing privileged roles and separation of duties using IAM roles and permissions (Diagrams:
pcse-1.4a-1-eliminate-basic-roles.jpg,pcse-1.4a-2-separation-of-duties.jpg) - Consideration 1.4b: Managing IAM and ACL permissions (Diagrams:
pcse-1.4b-1-uniform-bucket-level.jpg,pcse-1.4b-2-fine-grained-object.jpg) - Consideration 1.4c: Granting permissions using IAM conditions and IAM deny policies (Diagrams:
pcse-1.4c-1-iam-conditions-cel-based.jpg,pcse-1.4c-2-time-attributes-request.jpg) - Consideration 1.4d: Defining access control across organization, folder, project, and resource levels using least privilege (Diagrams:
pcse-1.4d-1-grant-at-lowest-possible.jpg,pcse-1.4d-2-grant-cross-cutting.jpg) - Consideration 1.4e: Configuring Access Context Manager (Diagrams:
pcse-1.4e-1-network-geographic.jpg,pcse-1.4e-2-device-policy-attributes.jpg) - Consideration 1.4f: Applying Policy Intelligence (Diagrams:
pcse-1.4f-1-policy-intelligence.jpg,pcse-1.4f-2-iam-recommender-iam.jpg) - Consideration 1.4g: Managing permissions through groups (Diagrams:
pcse-1.4g-1-groups-are-unit-of.jpg,pcse-1.4g-2-iam-identity-groups.jpg) - Consideration 1.4h: Identifying use cases and configuring Privileged Access Manager (Diagrams:
pcse-1.4h-1-eliminating-standing.jpg,pcse-1.4h-2-pam-entitlement-works.jpg) - Quick Decision Cheat Sheet (Subsection 1.4)
- Subsection 1.5: Defining the resource hierarchy (Section 1: Configuring access)
- Consideration 1.5a: Managing folders and projects at scale (Diagrams:
pcse-1.5a-1-structure-folders-by.jpg,pcse-1.5a-2-happens-you-move-project.jpg) - Consideration 1.5b: Managing pre-built or custom organization policies for organization, folders, and projects (Diagrams:
pcse-1.5b-1-pre-built-organization.jpg,pcse-1.5b-2-custom-organization.jpg) - Consideration 1.5c: Using the resource hierarchy for access control and permissions inheritance (Diagrams:
pcse-1.5c-1-additive-union-of-iam.jpg,pcse-1.5c-2-principle-of-least.jpg) - Quick Decision Cheat Sheet (Subsection 1.5)
- Subsection 2.1: Designing and configuring perimeter security (Section 2: Securing communications and establishing boundary protection)
- Consideration 2.1a: Configuring network perimeter controls including Cloud NGFW, IAP, load balancers, and Certificate Authority Service (Diagrams:
pcse-2.1a-1-hierarchical-firewall.jpg,pcse-2.1a-2-arch-networking-firewall.jpg) - Consideration 2.1b: Setting up application layer inspection on Cloud NGFW (layer 7) (Diagrams:
pcse-2.1b-1-ngfw-enterprise.jpg,pcse-2.1b-2-decrypting-tls-traffic.jpg) - Consideration 2.1c: Differentiating between private and public IP addressing (Diagrams:
pcse-2.1c-1-eliminate-public-ips-on.jpg,pcse-2.1c-2-enabling-connectivity.jpg) - Consideration 2.1d: Configuring web application firewalls such as Google Cloud Armor (Diagrams:
pcse-2.1d-1-owasp-top-10-mitigation.jpg,pcse-2.1d-2-rate-limiting-throttle.jpg) - Consideration 2.1e: Deploying Secure Web Proxy (Diagrams:
pcse-2.1e-1-secure-web-proxy-swp.jpg,pcse-2.1e-2-core-swp-capabilities-in.jpg) - Consideration 2.1f: Configuring Cloud DNS security settings (Diagrams:
pcse-2.1f-1-public-zones-enable.jpg,pcse-2.1f-2-vpc-outbound-dns-dns.jpg) - Consideration 2.1g: Continually monitoring and restricting configured APIs (Diagrams:
pcse-2.1g-1-least-privilege-api.jpg,pcse-2.1g-2-auditing-deactivating.jpg) - Quick Decision Cheat Sheet (Subsection 2.1)
- Subsection 2.2: Configuring boundary segmentation (Section 2: Securing communications and establishing boundary protection)
- Consideration 2.2a: Configuring security properties of VPC networks, VPC peering, Shared VPC, and firewall rules (Diagrams:
pcse-2.2a-1-default-vpc-firewall.jpg,pcse-2.2a-2-shared-vpc-separation-of.jpg) - Consideration 2.2b: Configuring network isolation and data encapsulation for N-tier applications (Diagrams:
pcse-2.2b-1-service-account-secure.jpg,pcse-2.2b-2-gke-pod-to-pod.jpg) - Consideration 2.2c: Identifying use cases and configuring VPC Service Controls (Diagrams:
pcse-2.2c-1-vpc-service-controls-vpc.jpg,pcse-2.2c-2-core-vpc-sc-mechanisms.jpg) - Quick Decision Cheat Sheet (Subsection 2.2)
- Subsection 2.3: Establishing private connectivity (Section 2: Securing communications and establishing boundary protection)
- Consideration 2.3a: Designing and configuring private connectivity between VPC networks and Google Cloud projects (Diagrams:
pcse-2.3a-1-shared-vpc-vpc-network.jpg,pcse-2.3a-2-shared-vpc-vpc-peering.jpg) - Consideration 2.3b: Designing and configuring private connectivity and encryption between data centers and VPC networks (Diagrams:
pcse-2.3b-1-ha-vpn-99-99.jpg,pcse-2.3b-2-encrypting-interconnect.jpg) - Consideration 2.3c: Establishing private connectivity between VPC and Google APIs using Private Google Access and Private Service Connect (Diagrams:
pcse-2.3c-1-enabling-private-access.jpg,pcse-2.3c-2-dns-configuration.jpg) - Consideration 2.3d: Using Cloud NAT to enable outbound traffic (Diagrams:
pcse-2.3d-1-outbound-only-by-design.jpg,pcse-2.3d-2-manual-static-ip.jpg) - Quick Decision Cheat Sheet (Subsection 2.3)
Chapter 4: Data Protection, Cryptography & AI Security: SDP (DLP), CMEK/HSM/EKM, Confidential VM & Model Armor
- Subsection 3.1: Protecting sensitive data and preventing data loss (Section 3: Ensuring data protection)
- Consideration 3.1a: Configuring Sensitive Data Protection for discovering and redacting PII including pseudonymization and format-preserving encryption (Diagrams:
pcse-3.1a-1-inspection-templates.jpg,pcse-3.1a-2-de-identification-matrix.jpg) - Consideration 3.1b: Restricting access to Google Cloud data services such as BigQuery, Cloud Storage, and Cloud SQL (Diagrams:
pcse-3.1b-1-bigquery-multi-layered.jpg,pcse-3.1b-2-authorized-views.jpg) - Consideration 3.1c: Securing secrets using Secret Manager (Diagrams:
pcse-3.1c-1-strict-iam-separation-of.jpg,pcse-3.1c-2-application-workload.jpg) - Consideration 3.1d: Protecting and managing compute instance metadata (Diagrams:
pcse-3.1d-1-never-store-secrets-in.jpg,pcse-3.1d-2-disable-legacy-metadata.jpg) - Quick Decision Cheat Sheet (Subsection 3.1)
- Subsection 3.2: Managing encryption at rest, in transit, and in use (Section 3: Ensuring data protection)
- Consideration 3.2a: Identifying use cases for default encryption, CMEK, and Cloud External Key Manager (Diagrams:
pcse-3.2a-1-default-encryption.jpg,pcse-3.2a-2-customer-managed.jpg) - Consideration 3.2b: Determining when to use software and hardware keys (Diagrams:
pcse-3.2b-1-kms-software-protection.jpg,pcse-3.2b-2-hsm-hsm-protection-level.jpg) - Consideration 3.2c: Creating and managing encryption keys including rotation, revocation, and imports (Diagrams:
pcse-3.2c-1-granting-service-agent.jpg,pcse-3.2c-2-symmetric-vs-asymmetric.jpg) - Consideration 3.2d: Applying encryption methods to appropriate use cases (Diagrams:
pcse-3.2d-1-envelope-encryption.jpg,pcse-3.2d-2-symmetric-vs-asymmetric.jpg) - Consideration 3.2e: Configuring Cloud Storage lifecycle policies (Diagrams:
pcse-3.2e-1-object-lifecycle.jpg,pcse-3.2e-2-delete.jpg) - Consideration 3.2f: Enabling Confidential Computing (Diagrams:
pcse-3.2f-1-confidential-computing.jpg,pcse-3.2f-2-zero-application-code.jpg) - Quick Decision Cheat Sheet (Subsection 3.2)
- Subsection 3.3: Securing AI workloads (Section 3: Ensuring data protection)
- Consideration 3.3a: Implementing security and privacy controls for AI/ML systems to prevent exploitation of data or models (Diagrams:
pcse-3.3a-1-pre-training-data.jpg,pcse-3.3a-2-mitigating-membership.jpg) - Consideration 3.3b: Determining security requirements for IaaS-hosted and PaaS-hosted training models (Diagrams:
pcse-3.3b-1-securing-vertex-ai.jpg,pcse-3.3b-2-disable-public-ip.jpg) - Consideration 3.3c: Implementing security controls for Vertex AI (Diagrams:
pcse-3.3c-1-preventing-data.jpg,pcse-3.3c-2-defending-against-prompt.jpg) - Quick Decision Cheat Sheet (Subsection 3.3)
Chapter 5: DevSecOps Automation, Security Telemetry & Detection: Binary Authorization, Audit Logs & SCC
- Subsection 4.1: Automating infrastructure and application security (Section 4: Managing operations)
- Consideration 4.1a: Automating vulnerability scanning for CVEs in CI/CD pipelines (Diagrams:
pcse-4.1a-1-artifact-analysis.jpg,pcse-4.1a-2-vulnerability-based.jpg) - Consideration 4.1b: Configuring Binary Authorization for securing GKE or Cloud Run (Diagrams:
pcse-4.1b-1-policy-evaluation-binary.jpg,pcse-4.1b-2-default-gke-binary.jpg) - Consideration 4.1c: Automating VM and container image hardening, maintenance, and patch management (Diagrams:
pcse-4.1c-1-shielded-vms-shielded.jpg,pcse-4.1c-2-secure-boot-compute-vm.jpg) - Consideration 4.1d: Managing policy and drift detection at scale using posture management and custom policies (Diagrams:
pcse-4.1d-1-preventive-vs-detective.jpg,pcse-4.1d-2-custom-organization.jpg) - Quick Decision Cheat Sheet (Subsection 4.1)
- Subsection 4.2: Configuring logging, monitoring, and detection (Section 4: Managing operations)
- Consideration 4.2a: Configuring and analyzing network logs such as Cloud NGFW, VPC flow logs, Packet Mirroring, Cloud IDS, and Log Analytics (Diagrams:
pcse-4.2a-1-to-choose-vpc-flow.jpg,pcse-4.2a-2-to-choose-packet.jpg) - Consideration 4.2b: Designing an effective logging strategy (Diagrams:
pcse-4.2b-1-centralize-first.jpg,pcse-4.2b-2-control-ingestion-costs.jpg) - Consideration 4.2c: Logging, monitoring, responding to, and remediating security incidents (Diagrams:
pcse-4.2c-1-event-driven-automated.jpg,pcse-4.2c-2-forensic-evidence.jpg) - Consideration 4.2d: Designing secure access to logs (Diagrams:
pcse-4.2d-1-roles-logging-viewer-vs.jpg,pcse-4.2d-2-logs-viewer-roles.jpg) - Consideration 4.2e: Exporting logs to external security systems (Diagrams:
pcse-4.2e-1-real-time-streaming-to.jpg,pcse-4.2e-2-operations-logging.jpg) - Consideration 4.2f: Configuring and analyzing Cloud Audit Logs and data access logs (Diagrams:
pcse-4.2f-1-audit-log-categories.jpg,pcse-4.2f-2-exempting-noisy-service.jpg) - Consideration 4.2g: Configuring log exports using log sinks and aggregated sinks (Diagrams:
pcse-4.2g-1-destination-selection.jpg,pcse-4.2g-2-storage-archive-storage.jpg) - Consideration 4.2h: Configuring and monitoring Security Command Center (Diagrams:
pcse-4.2h-1-scc-capabilities-tiers.jpg,pcse-4.2h-2-security-health.jpg) - Quick Decision Cheat Sheet (Subsection 4.2)
Chapter 6: Regulatory Compliance & Sovereignty: Assured Workloads, Access Approval & Audit Descoping
- Subsection 5.1: Adhering to regulatory and industry standards requirements for the cloud (Section 5: Supporting compliance requirements)
- Consideration 5.1a: Determining technical needs relative to compute, data, network, and storage (Diagrams:
pcse-5.1a-1-storage-immutability-sec.jpg,pcse-5.1a-2-database-rpo-rto.jpg) - Consideration 5.1b: Evaluating the shared responsibility model (Diagrams:
pcse-5.1b-1-who-patches-shared.jpg,pcse-5.1b-2-compute-engine-iaas.jpg) - Consideration 5.1c: Configuring cloud security controls to support compliance such as Assured Workloads and regionalization (Diagrams:
pcse-5.1c-1-assured-workloads.jpg,pcse-5.1c-2-access-transparency-vs.jpg) - Consideration 5.1d: Determining the Google Cloud environment in regulatory scope (Diagrams:
pcse-5.1d-1-minimizing-audit-scope.jpg,pcse-5.1d-2-hipaa-business-associate.jpg) - Consideration 5.1e: Mapping compliance requirements to Google Cloud services and controls (Diagrams:
pcse-5.1e-1-mapping-compliance.jpg,pcse-5.1e-2-sensitive-data.jpg) - Quick Decision Cheat Sheet (Subsection 5.1)
Chapter 7: Master Look-Alike Tool Comparison & Decision Playbook
- 7.1 The Master Look-Alike Tool Comparison Matrix
- 7.2 The 5-Step Architecture Decision Checklist
- 7.3 Top 25 Golden Rules for Final Review
Generating the Custom Illustrations (pcse-image-prompts.json)
All 140 custom image prompts and output filenames for this book are stored in pcse-image-prompts.json (and mirrored in openai-image-gen/out/9008-openai-prompts-pcse-book.json). To generate the illustrations using openai-image-gen/images-from-prompts.py, run:
cd openai-image-gen uv run images-from-prompts.py -file ../books/pcse-architecture-takeaways/pcse-image-prompts.json -simple -quality medium
AwesomeGCP.com Learning
The approach taken is a question-led learning approach: you explore realistic project scenarios where you need to make decisions or take actions to achieve business goals within specific constraints. Instead of passive learning, you are challenged to think and work through the options to master the Professional Cloud Security Engineer (PCSE) certification!