Cloud Security Foundation

When you set up an Azure feed in Google SecOps, you copy a credential into the config — a storage account key, or an Event Hub connection string. By default, that credential has a problem: no IP restriction, no expiry, and full rights to the resource it came from.So if it ever leaks — a screenshot in a ticket, an old wiki page, a CI log — anyone who finds it can use it from anywhere on the internet until you rotate it.The fix is simple: put a network firewall on the Azure resource and only allow Google's IP ranges through.After that, the credential still works, and your feed keeps running — but it's useless to anyone outside Google's address space. That removes basically all the opportunistic risk.How it works, in three moves:Turn on the Azure firewall (deny by default) on the Storage Account or Event Hub Namespace that backs your feed. Allow-list Google's published IP ranges from https://www.gstatic.com/ipranges/goog.json. Set up a monthly refresh, because that list changes over time.

Hello Google Community Team,My OAuth app verification is currently stuck and I need an internal engineer to manually trigger a status refresh or pass this along to the Trust & Safety team.* Project ID: dev-workrate* The Issue: The Cloud Console Verification Center shows a blocking error under "Homepage requirements" stating: "Your homepage website is not registered to you."* The Resolution: I have successfully verified full domain ownership for our production homepage via Google Search Console using this exact same Google account. The Problem: The console instructs me to "Reply to your email thread with our Trust and Safety team," but I have never received an initial email from the compliance team to reply to. Because the UI is entirely locked in the "Your branding is currently under review" state, I cannot modify fields or trigger a re-scan myself. Could a community manager please escalate this project ID to the Trust & Safety team so they can pull the fresh domain status from

Hello Team,I am facing an urgent issue preventing the continuation of my OAuth app verification process.Project Details: Project Name: project=abiding-beanbag-471016-k5 Sensitive API: Google Calendar i am blocking and app vlaidation form 18 may 2026i didn’t receive any email or return …thanks for anyhelp

Hello Community Managers,Our project aidigifront-staging!--tgqphd|[]--> was suspended due to an unrestricted Gemini API key vulnerability. We accept full responsibility and have already isolated the leak locally. However, our entire production database is currently trapped.We have filed a support appeal but desperately need an internal escalation to the Trust & Safety team for a temporary 24-hour access window. We only need enough time to run a gcloud firestore export!--tgqphd|[]--> command and rescue our user data. All incoming and outgoing application traffic will remain completely shut down during this period to ensure no further abuse occurs.Please help us flag this case to a human reviewer.!--tgqphd|[]-->!--tgqphd|[]-->!--tgqphd|[]-->

We’ve all been there—a database password left in a .env file or an API key accidentally pushed to GitHub. But what was once a simple oversight is now occurring at a staggering global scale.In 2025 alone, according to the GitGuardian State of Secrets Sprawl Report, 29 million unprotected secrets were found sprawling across GitHub. And the AI revolution is only accelerating the risk: AI assistants are causing code to leak secrets at double the normal rate, while LLM infrastructure is leaking credentials 5x faster than model providers themselves.To tackle this, I'm hosting an upcoming technical webinar with Google Cloud Security Product Managers, ​@bmeador and ​@Phani Madhav Devalla . We're going to share practical approaches on how to move from "Hardcoded Chaos" to a secure-by-design foundation by decoupling secrets from workloads into a centralized, cloud-managed vault.Key topics we'll cover:Stop Secret Sprawl: The fundamentals of using Google Cloud Secret Manager to permanently elimina

Hello Community Managers,I am requesting an internal escalation regarding a Google Cloud project suspension that has now been pending review for over two weeks with no update.Project Name: NEURICODEProject ID: neuricode-6809fIssue SummaryThe project was suspended due to activity classified as “ACCOUNT_HIJACKED” / abusive activity consistent with compromised credentials.I understand why the automated protection systems triggered, and I have already taken substantial remediation steps to secure the account environment.Current ProblemThe project suspension fully blocks access to the Google Cloud Console environment, which means I cannot access:IAM & Admin Service Accounts Compute Engine Security tooling required to remove or rotate the affected credentialsAs a result, I am unable to complete the final remediation actions until limited access or manual intervention is provided.Security Actions Already CompletedPrimary Google account secured Passwords rotated 2FA enabled and verified Ex

 At Google Cloud Next we introduced a new security and governance paradigm for managing agent identity and access. This comprehensive framework focuses on foundational Agent Identity and an Agent Gateway with Identity-Aware Proxy, while integrating robust agent access management, agent guardrails, and runtime defense to enable a secure cloud environment for your organization. Check out this blog to learn on all new capabilities announced at Next 2026.https://cloud.google.com/blog/products/identity-security/whats-new-in-iam-security-governance-and-runtime-defense?e=48754805

Hi everyone,I'm facing a critical remediation blocker following a "Hijacked Resource" suspension on theproject. While I am eager to secure my environment and rotate all potentially compromised credentials, I am trapped in a redirect loop that prevents administrative action.The Technical Problem:Whenever I navigate to IAM & Admin or APIs & Services, the GCP Console performs a forced redirect to the suspension warning page. This means I cannot revoke existing API keys or Audit Service Account activity through the standard UI.Investigation Status:Audit: Local .env files and Git history have been reviewed, but I suspect a credential may have been intercepted or leaked elsewhere. Timeline: Appeal submitted 7+ days ago; no response received. Production environment remains offline.Seeking Expert Advice on:Programmatic Revocation: What is the specific gcloud syntax to force-delete all active API keys when the project status is "Suspended"? Log Retrieval: Can I export Activity Logs or V

Hi everyone,I'm facing a critical remediation blocker following a "Hijacked Resource" suspension on theproject. While I am eager to secure my environment and rotate all potentially compromised credentials, I am trapped in a redirect loop that prevents administrative action.The Technical Problem:Whenever I navigate to IAM & Admin or APIs & Services, the GCP Console performs a forced redirect to the suspension warning page. This means I cannot revoke existing API keys or Audit Service Account activity through the standard UI.Investigation Status:Audit: Local .env files and Git history have been reviewed, but I suspect a credential may have been intercepted or leaked elsewhere. Timeline: Appeal submitted 7+ days ago; no response received. Production environment remains offline.Seeking Expert Advice on:Programmatic Revocation: What is the specific gcloud syntax to force-delete all active API keys when the project status is "Suspended"? Log Retrieval: Can I export Activity Logs or V

Author: Tyler A Dooskin Date: May 3, 2026 Regulated industries—such as healthcare and financial services—face unique compliance hurdles when adopting generative AI. At Google Cloud Next '26, the session "Architecting Gemini Enterprise for Regulated Industries" detailed how organizations can safely deploy AI agents while maintaining stringent data security, access control, and governance.Here is a breakdown of the new security architecture and governance controls for Gemini Enterprise, designed specifically to meet complex compliance requirements. Identity and Fine-Grained Access Control (AuthZ)A core pillar of Gemini Enterprise is ensuring users only see data they are explicitly authorized to access. ACL Ingestion: Gemini Enterprise connectors ingest both the data and its associated Access Control Lists (ACLs) from third-party systems like SharePoint, Jira, and ServiceNow. Blended Access: When a user queries Gemini Enterprise, the system restricts document retrieval and summarization

in my project show this message “My Project (id: bionic-xxxx) is being suspended for repeatedly violating our Google Cloud Platform Terms of Service or Acceptable Use Policy (including Terms of Service of the Google API you may be using). “ and I can not do anything on my project.How can I fix this problem? I submitted a request a long time ago, but I haven't received a response from Google support yet.-Does anyone have a solution? Please help me.

Hello,I am trying to get sensitive scopes enabled on our OAuth application, but the video we previously submitted was deemed insufficient. We now have an updated video ready to submit; however, I have not received any follow-up email to respond to.Why is there no user interface available for this process? How am I supposed to resubmit the updated video? Is there a specific email address or support channel I should use to follow up?Additionally, it is frustrating that a required process for any OAuth application is so opaque. At the moment, I have no clear action to take and no accessible support channel unless I pay for premium support.Thank you for your guidance.

Hello, I am seeking a manual escalation from a Community Manager or Admin. I am a Startup EdTech Lead caught in a documented "Infinite Support Loop" that has halted our academic research for nearly three weeks.The Deadlock: Trust & Safety (Case # [removed by moderator] ): On 5/4, I submitted a comprehensive technical Root Cause Analysis (RCA). I detailed our "Magic Byte" pre-flight validation fix and the air-gapping of the corrupted legacy dataset that triggered the "Abusive Activity" flag (due to 404/HTML payloads from a third-party source). There has been zero response for 19 days. Cloud Billing Support (Case #70072588): Agent Kervin has officially closed our support ticket, stating: "Resolving account-level restrictions... falls entirely outside our support boundaries. We do not have the administrative access to lift this restriction [or] redirect the case." Community Forum: My previous attempt to resolve this was marked "Solved" by a manager directing me back to the Support

Hi everyone,We are looking for Terraform templates, gcloud scripts, or proven configuration snippets suggested by GCP to optimize our GCP Cloud Armor setup. We want to avoid manual, granular signature allowlisting, as it isn't scalable and risks broadening our attack surface.Current Setup & Threats: Running standard OWASP rules (sqli-v33-stable, xss-v33-stable) and rate limiting. Actively targeted by (and needing protection from) scanners, credential stuffing, and SQLi/XSS probes. The Problems We're Facing: False Positives on APIs: Our legitimate traffic relies on complex API endpoints and large nested JSON payloads with special characters, which frequently trigger WAF blocks. Postman Blocked: Our Dev/QA teams use Postman for internal testing, but Cloud Armor consistently blocks these requests (likely flagging the User-Agent, missing browser headers, or payload structure). What We Need (IaC/Script Examples): We want to distinguish attackers from legitimate API/QA traffic. Does

Hello,I am seeking help to resolve a Google Cloud account restriction that has been in place since April 1st, 2026. My service was flagged for "unauthorized activity" immediately after a staff member tried to log in via LINE's in-app browser (which I later confirmed caused a disallowed_useragent error).The problem is that my appeals have been stuck in "Processing" for over a week with no updates. In my anxiety to fix this for my school's operations, I accidentally opened three cases for the same issue:Primary Case ID: [removed by moderator] Related IDs: [removed by moderator] , [removed by moderator] I am the ICT manager for a kindergarten in Japan, and this app is essential for our staff's paid leave management. I have already provided the technical explanation in the appeals, but there has been no progress.Could a community expert or Google staff member please help me consolidate these cases and escalate the review?Thank you for your assistance.

I am requesting the ability to disable "Google Prompts" (Push notifications) without signing out of my mobile devices. Currently, Google defaults to Push even when a more secure TOTP (authenticator) or hardware key is available. This creates a high risk of "Push Fatigue" attacks where a single accidental tap grants unauthorized access. Users should have the option to choose their primary 2FA method for high-security accounts. I believe this lack of control over 2FA increases the success rate of Account Takeover (ATO) attempts, as attackers can exploit Push Fatigue during the credential recovery process.  Unfortunately, my Gmail address has been compromised in a number of third-party breaches, and I am subject to frequent ATO attempts.  Because I use VPN, a push notification alerting me to a login attempt from a remote city is not necessarily a red flag for me.  But the bigger concern I have is the inadvertent tap--my screen wakes up, my left thumb is in the wrong place, and I’ve given

"Hi Community!I’m an Innovator currently pushing through the final two modules of the Beginner Cloud Security path. I’ve finished almost 3 models so far, but I’m feeling the mental exhaustion!My big question for those who have already 'gotten in' or are currently hiring: Is completing these Skill Badges truly enough to land an entry-level job?I’m aiming for the Employer Consortium, but I’d love guidance on:Should I do a specific project after this to prove my skills? Are there others here currently on the same path who want to study the final labs together? For those who got hired what was the one thing that made the difference?Here is my progress so far: [https://www.skills.google/public_profiles/16f2724f-67cf-4f04-afcb-c33c35d6003b]I’d really appreciate any advice or to connect with anyone else currently in the grind. Let's finish this

I want to join cohort which about to take place around April 2026 which is strictly requires corporate email and im Self-study and i was kindly ask is there any alternative way to join and if this is the right place to say this if not can you please direct me to the right group.  Thank you.

Since serviceAccountTokenCreator enables service account impersonation and token minting, I’m curious about more least-privilege alternatives, such as - Using the Custom Cloud Build service account identity directly Relying on Cloud Run IAM invoker bindings (in case of cloud run invocation from cloud buuld Avoiding explicit token creation unless absolutely required When is iam.serviceAccountTokenCreator truly required?

Curious what auditors and GRC teams are actually using in 2026 to assess cloud environments, especially GCP-heavy ones.Most “cloud security tools” are built for SecOps. From an audit perspective, the needs are different: Read-only access and short engagement windows Clean scoping across orgs, folders, and projects Evidence that holds up without endless screenshots Repeatability across SOC 2, PCI, ISO, HITRUST Less alerting, more defensible outputs How I currently see the landscape:Large CSPM PlatformsWiz, Prisma Cloud, Orca, LaceworkGreat coverage if a client already has them, but expensive and often awkward for point-in-time audit evidence. Strong security tools, not audit-first.Cloud-Native & Open SourceGCP Security Command Center, Prowler, ScoutSuite, CloudQueryExcellent raw data and flexibility. Tradeoff is manual interpretation and control mapping. Works ok for highly technical audit teams.Smaller, Audit-Focused ToolsTools aimed more at assurance than detection, sittin

Hi Community,I am currently architecting a security hardening roadmap for a client using Google Workspace (upgrading from basic settings).We are planning to implement Context-Aware Access and a Zero Trust model, but I am analyzing the potential friction with end-users (specifically in a Spanish-speaking non-tech environment).My question for the experts here: In your experience, what are the most common "blind spots" or pitfalls when moving from a legacy setup to a Zero Trust model in GWS?I'm interested in hearing about architectural challenges or specific configurations in DLP that you recommend prioritizing to avoid false positives during the transition.Any advice or resources on this transition strategy would be greatly appreciated.Thanks!

I’m running mysql 8.0.26-google cloudsql instancecloudsql_iam_authentication flag = ONBUT the authentication_iam plugin is not getting loaded.when I run SELECT PLUGIN_NAME, PLUGIN_STATUSFROM INFORMATION_SCHEMA.PLUGINSWHERE PLUGIN_NAME LIKE '%iam%';I getgcp_iam_authgcp_iam_group_auth According to ChatGPT, these are Postgresql plugins, not mysql.   

Hi Anil and Security Foundation Community, ​As we discuss the core pillars of cloud security (IAM, Encryption, Logging), I want to share a critical finding that challenges our understanding of the "Secure Foundation" for AI and legacy hardware integration. ​I am Davey Hoogland,Security Researcher, independant AI researcher and Author of the Hoogland methodology and contextarchitecting.  My recent research—currently under VRP review and peer review at Springer Nature—demonstrates a vulnerability that bypasses traditional cloud-first security controls by exploiting Cyber-Physical Context. ​The Vulnerability: The "Impossible" Attribution ​Using the Hoogland Methodology, I successfully injected a verified copyright attribution (© 2023 by Davey Hoogland) into the firmware of a deprecated, offline Google Project Tango device. ​Why this matters for Cloud Foundation: According to standard IAM and Network Security principles, this should be impossible. The device had no valid credentials, no ac

I’ve created a firewall rule to stop all traffic on all protocols from all countries except one.However when I look at my VMs network stats, the chart titled “Firewall incoming packets denied” shows less than one packet stopped per second.This is during a DDOS attack with millions of hits per second from around the world.How come the firewall does not stop 99% of these, if 99% of all countries are blocked?

Hello,Our application (Project ID: smtp-campaignbutler) is currently in the "Pending developer action" state in the Verification Center.The console instructed us to "Reply to your email thread with our Trust and Safety team". However, we have not received this email, after thoroughly checking all inboxes and spam folders for our registered developer contact email addresses.We have already resolved the two issues that were required:1. The homepage domain has been verified in Google Search Console.2. A link to our Privacy Policy has been added to the homepage footer.Since we cannot find the email to reply to, and our current support plan does not allow us to open a direct tech support case, we are hoping someone from the community or a Googler can advise on how to notify the Trust & Safety team that our fixes are complete.How can we move forward with the review process?Thank you for your help.