Identity & Access Management (IAM)

IAM is the foundation of GCP security. Every exam question involving "who can access what" comes back to IAM.

Core Principles

• Principle of least privilege: Grant the minimum permissions needed. Prefer predefined roles over primitive roles (Owner, Editor, Viewer).
• Service accounts: Used by applications and pipelines. Each should have its own SA with only the permissions it needs. Avoid using the default compute SA.
• IAM Conditions: Time-based or resource-attribute-based access (e.g., "only allow access during business hours" or "only to resources with specific labels").
• Organization policies: Org-level constraints like "disable public access to GCS buckets" or "restrict resource locations to specific regions."

BigQuery-Specific IAM

• bigquery.dataViewer — Read data (SELECT) but not export or copy.
• bigquery.dataEditor — Read + write data (INSERT, UPDATE, DELETE).
• bigquery.jobUser — Run queries (required in addition to data access roles).
• Authorized Views: Grant access to a view without granting access to underlying tables. The view's query runs with the dataset's permissions, not the user's.
• Row-level security: Filter policies that restrict which rows a user can see based on their identity.
• Column-level security: Policy tags on columns, enforced via Data Catalog. Users need the Fine-Grained Reader role on the policy tag to see the column data.

VPC Service Controls

VPC-SC creates a security perimeter around GCP resources to prevent data exfiltration — even by users with valid IAM permissions. This is the key differentiator from IAM alone.

How It Works

• Service perimeter: Defines which projects and services are "inside" the perimeter. API calls that would move data outside the perimeter are blocked.
• Restricted services: Services added to the perimeter (BigQuery, GCS, etc.) cannot communicate with resources outside the perimeter.
• Ingress rules: Allow specific external identities to access resources inside the perimeter (e.g., contractors can query BigQuery).
• Egress rules: Allow specific internal service accounts to send data to specific external projects (e.g., export aggregated data to a partner).
• Access levels: Define conditions under which perimeter access is granted (IP range, device policy, identity).

VPC-SC vs. IAM

IAM controls who can do what to a resource. VPC-SC controls where data can flow. Even if a user has bigquery.dataViewer, VPC-SC can prevent them from copying query results to a project outside the perimeter. They work together — IAM for authorization, VPC-SC for perimeter defense.

Encryption

Encryption at Rest

• Google-managed (default): All data encrypted with AES-256. No configuration needed. Keys managed entirely by Google.
• Customer-managed encryption keys (CMEK): You create and control keys in Cloud KMS. Google uses your key to encrypt data. You can rotate, disable, or destroy keys. Required when you need auditability or regulatory control over encryption keys.
• Customer-supplied encryption keys (CSEK): You provide the key with each API call. Google never stores the key. Only supported for GCS and Compute Engine disks. Maximum control but maximum operational burden.

Encryption in Transit

All data moving between GCP services is encrypted in transit by default (TLS 1.2+). For data moving between your on-prem network and GCP, use Cloud VPN or Cloud Interconnect with encryption.

Cloud DLP (Data Loss Prevention)

Cloud DLP discovers, classifies, and protects sensitive data across GCP and beyond.

Key Operations

• Inspection: Scan data in BigQuery, GCS, or Datastore for PII, PHI, financial data, and 150+ built-in detectors (SSN, credit cards, email addresses, etc.).
• De-identification: Transform sensitive data using techniques like masking, tokenization, bucketing, date shifting, or format-preserving encryption.
• Re-identification: Reverse tokenization for authorized users using a stored crypto key.

De-identification Techniques

• Masking: Replace characters with a fixed character (e.g., ***-**-6789). Simple but irreversible.
• Tokenization (crypto-based): Replace with a token using a crypto key. Reversible. Preserves referential integrity.
• Bucketing: Replace exact values with ranges (e.g., age 34 → "30-40"). Good for analytics that don't need exact values.
• Date shifting: Shift dates by a random offset within a range. Preserves intervals between dates for the same entity.

Data Governance & Catalog

Dataplex

Unified data governance service that organizes data across GCS, BigQuery, and other sources into logical "lakes" and "zones." Provides automated data quality checks, metadata management, and data lineage.

Data Catalog

Metadata management and discovery service. Automatically catalogs BigQuery and Pub/Sub assets. Supports custom entries, tags, and tag templates for business metadata. Integrates with policy tags for column-level security in BigQuery.