Architecting Security

Security Architecture

Design and implement comprehensive security architectures that protect systems, data, and users through layered defense strategies, zero trust principles, and risk-based security controls.

Purpose

Security architecture provides the strategic foundation for building resilient, compliant, and trustworthy systems. This skill guides the design of defense-in-depth layers, zero trust implementations, threat modeling methodologies, and mapping to control frameworks (NIST CSF, CIS Controls, ISO 27001).

Unlike tactical security skills (configuring firewalls, implementing authentication, scanning vulnerabilities), security architecture focuses on strategic planning, comprehensive defense strategies, and governance frameworks.

When to Use This Skill

Use security architecture when:

• Designing security for greenfield systems (new applications, cloud migrations)
• Conducting security audits or risk assessments of existing systems
• Implementing zero trust architecture across enterprise environments
• Establishing security governance programs and compliance frameworks
• Threat modeling applications, APIs, or microservices architectures
• Selecting and mapping security controls to regulatory requirements (SOC 2, HIPAA, PCI DSS)
• Designing cloud security architectures (AWS, GCP, Azure multi-account strategies)
• Addressing supply chain security (SLSA framework, SBOM implementation)

Core Security Architecture Principles

1. Defense in Depth

Implement multiple independent layers of security controls so that if one layer fails, others continue to protect critical assets.

9 Defense Layers (2025 Model):

1. Physical Security: Data center access, environmental controls, hardware security modules (HSMs) 2. Network Perimeter: Next-gen firewalls (NGFW), DDoS protection, web application firewalls (WAF) 3. Network Segmentation: VLANs, VPCs, security groups, micro-segmentation 4. Endpoint Protection: EDR, antivirus, device encryption, patch management 5. Application Layer: Secure coding, WAF, API security, SAST/DAST scanning 6. Data Layer: Encryption (at-rest, in-transit, in-use), DLP, backup/recovery 7. Identity & Access Management: MFA, SSO, RBAC/ABAC, privileged access management (PAM) 8. Behavioral Analytics: UEBA, ML-based anomaly detection, threat intelligence 9. Security Operations: SIEM, SOAR, incident response, continuous monitoring

Key Principle: Each layer provides independent protection. Failure of one layer does not compromise the entire system.

For detailed layer-by-layer implementation patterns, see references/defense-in-depth.md.

2. Zero Trust Architecture

Implement "never trust, always verify" principles where every access request is authenticated, authorized, and continuously validated.

Core Zero Trust Principles:

1. Continuous Verification: Authenticate and authorize every access request (no implicit trust) 2. Least Privilege Access: Grant minimal permissions required, use just-in-time (JIT) access 3. Assume Breach: Design systems expecting compromise, limit blast radius 4. Explicit Verification: Verify user identity (MFA), device health, application integrity, context (location, time, behavior) 5. Micro-Segmentation: Divide networks into small isolated zones, control east-west traffic

Zero Trust Architecture Components:

• Policy Engine: Centralized authorization decision point (allow/deny)
• Identity Provider (IdP): User/machine identity verification (Azure AD, Okta)
• Device Posture Service: Device health checks (MDM, EDR integration)
• Context/Risk Engine: Behavioral analytics, location, time, threat intelligence
• Policy Enforcement Points: Gateways enforcing decisions (ZTNA, API gateways)

For zero trust implementation roadmap and reference architecture, see references/zero-trust-architecture.md.

3. Threat Modeling

Systematically identify, prioritize, and mitigate security threats through structured methodologies.

Primary Methodologies:

STRIDE Threat Categories:

• Spoofing: Attacker impersonates another user/system (Mitigation: MFA, certificate validation)
• Tampering: Unauthorized data modification (Mitigation: Encryption, digital signatures)
• Repudiation: User denies action without proof (Mitigation: Audit logs, non-repudiation)
• Information Disclosure: Confidential data exposure (Mitigation: Encryption, access controls, DLP)
• Denial of Service: System unavailability (Mitigation: Rate limiting, DDoS protection, redundancy)
• Elevation of Privilege: Gaining higher privileges (Mitigation: Least privilege, input validation, patching)

STRIDE Application Process:

1. Model the system using data flow diagrams (DFDs) 2. Identify threats by applying STRIDE to each component/data flow 3. Document threats with STRIDE categories 4. Prioritize threats using DREAD scoring or business impact 5. Design mitigation controls

For detailed threat modeling methodologies, PASTA process, DREAD scoring, and attack trees, see references/threat-modeling.md. For threat modeling examples, see examples/threat-models/.

Security Control Frameworks

Map security controls to industry frameworks to ensure comprehensive coverage and compliance.

NIST Cybersecurity Framework (CSF) 2.0

6 Core Functions:

1. GOVERN (GV): Risk management strategy, policies, supply chain risk management 2. IDENTIFY (ID): Asset inventory, risk assessment, continuous improvement 3. PROTECT (PR): Access control, data security, platform security, infrastructure resilience 4. DETECT (DE): Continuous monitoring, anomaly detection, security event analysis 5. RESPOND (RS): Incident management, analysis, communication, mitigation 6. RECOVER (RC): Recovery planning, execution, post-incident improvement

Usage: Map security controls to NIST CSF categories to ensure coverage of all security functions. Provides risk-based, flexible framework for security programs.

For detailed NIST CSF category mapping and subcategories, see references/nist-csf-mapping.md.

CIS Critical Security Controls v8

18 Controls organized in 3 Implementation Groups:

• IG1 (Basic): 56 safeguards for small organizations (asset inventory, access control, logging, backups)
• IG2 (Intermediate): +74 safeguards for mid-sized organizations with IT security staff
• IG3 (Advanced): +23 safeguards for large enterprises with dedicated security teams

Top Priority Controls (IG1): 1. Inventory and Control of Enterprise Assets 2. Inventory and Control of Software Assets 3. Data Protection 4. Secure Configuration of Enterprise Assets 5. Account Management 6. Access Control Management 7. Continuous Vulnerability Management 8. Audit Log Management

Usage: CIS Controls provide prescriptive, measurable security baseline. Start with IG1, progress to IG2/IG3 as security maturity increases.

For detailed CIS Controls implementation guidance, see references/cis-controls.md.

OWASP Top 10 Risk Mitigation

Map OWASP Top 10 application security risks to architectural controls:

For detailed OWASP Top 10 mitigation strategies and code examples, see references/owasp-top10-mitigation.md.

Architecture Selection Decision Framework

Select appropriate security architecture approach based on system characteristics:

Greenfield (New System):

• Implement Zero Trust from Day 1
• Identity-first architecture (MFA, SSO, RBAC/ABAC)
• Micro-segmentation by default
• Assume breach mentality (limit blast radius)
• Continuous verification and monitoring

Brownfield (Existing System):

• Hybrid: Maintain Defense in Depth + Zero Trust overlay
• Keep existing perimeter controls (firewalls, VPN)
• Layer Zero Trust controls progressively
• Segment critical assets first (data, admin access)
• Modernize identity and access management

Compliance-Driven:

• Map to control frameworks based on requirements:
• General Security: NIST CSF for risk-based approach
• Baseline Hardening: CIS Controls for prescriptive guidance
• Comprehensive ISMS: ISO 27001 for certification
• Industry-Specific: PCI DSS (payments), HIPAA Security Rule (healthcare), FedRAMP (government)

Cloud-Native:

• Use cloud provider reference architectures:
• AWS: Well-Architected Framework (Security Pillar)
• GCP: Security Best Practices, Security Command Center
• Azure: Security Benchmark, Defender for Cloud
• Implement cloud-native security services (CSPM, CWPP)

Hybrid/Multi-Cloud:

• Cloud Security Posture Management (CSPM) for unified policy enforcement
• Cross-cloud visibility and monitoring
• Cloud-agnostic IAM (Okta, Azure AD)

For detailed architecture selection decision trees, see references/defense-in-depth.md and references/zero-trust-architecture.md.

Supply Chain Security

Protect software supply chain from tampering, backdoors, and compromised dependencies.

SLSA Framework

Supply-chain Levels for Software Artifacts (4 levels):

1. SLSA Level 1 - Provenance: Build process generates provenance metadata (not tamper-proof) 2. SLSA Level 2 - Hosted Build: Build on trusted platform (GitHub Actions, Cloud Build) 3. SLSA Level 3 - Hardened Build: Build platform prevents tampering, audit logs 4. SLSA Level 4 - Hermetic, Reproducible: Fully hermetic builds, reproducible, two-party review

Implementation: Start with Level 1 provenance generation, progress to Level 2 (GitHub Actions), then Level 3 (hardened CI/CD with audit logs).

SBOM (Software Bill of Materials)

Generate and maintain inventory of software components and dependencies.

SBOM Standards:

• CycloneDX: OWASP standard (JSON/XML format)
• SPDX: Linux Foundation standard
• SWID: ISO/IEC 19770-2 standard

SBOM Use Cases:

• Vulnerability Management: Quickly identify affected components during CVE disclosures
• License Compliance: Track open-source licenses for legal compliance
• Supply Chain Risk: Visibility into third-party code and dependencies
• Incident Response: Rapid assessment of Log4Shell-type incidents

Dependency Management Best Practices: 1. Generate SBOM automatically in CI/CD pipeline 2. Continuous scanning with tools (Dependabot, Snyk, Trivy, Grype) 3. Automated security patch updates 4. License compliance tracking and approval workflows 5. Pin dependency versions using lock files 6. Minimize dependencies to reduce attack surface

For SLSA implementation guide, SBOM generation examples, and dependency scanning automation, see references/supply-chain-security.md.

Cloud Security Architecture Patterns

AWS Security Architecture

Well-Architected Framework - Security Pillar Principles:

1. Strong identity foundation: Centralize IAM, least privilege, IAM Identity Center (SSO) 2. Enable traceability: CloudTrail, GuardDuty, Security Hub for comprehensive logging 3. Apply security at all layers: Defense in depth across VPC, instances, applications, data 4. Automate security best practices: Infrastructure as Code (Terraform, CloudFormation) 5. Protect data in transit and at rest: TLS 1.3, AWS KMS, encryption everywhere

Key AWS Security Services:

• IAM: AWS IAM, IAM Identity Center (SSO), Cognito (customer identity)
• Detection: GuardDuty (threat detection), Security Hub (centralized findings), Detective (investigation)
• Network: AWS WAF, Shield (DDoS), Network Firewall
• Data: KMS (key management), Secrets Manager, Macie (data classification)
• Compute: Systems Manager (patch management), Inspector (vulnerability scanning)

Multi-Account Strategy: Use AWS Organizations with Security OU (Security Account, Logging Account, Audit Account) and Workload OUs (Production, Non-Production). Apply Service Control Policies (SCPs) for guardrails.

For AWS reference architectures and multi-account security setup, see references/aws-security-architecture.md and examples/architectures/aws-multi-account-security.md.

GCP Security Architecture

Key GCP Security Services:

• IAM: Cloud IAM, Identity Platform (customer identity), Cloud Identity (workforce)
• Detection: Security Command Center (unified dashboard), Chronicle (SIEM), Event Threat Detection
• Network: Cloud Armor (DDoS/WAF), VPC Service Controls (data exfiltration prevention), Cloud Firewall
• Data: Cloud KMS, Secret Manager, Cloud DLP (data loss prevention)
• Compute: Binary Authorization (image signing), Confidential Computing (encryption in use)

Organization Hierarchy: Structure with Organization → Folders (Production, Non-Production, Security) → Projects. Apply IAM policies at folder level for inheritance.

For GCP security architecture patterns and organization setup, see references/gcp-security-architecture.md and examples/architectures/gcp-security-hierarchy.md.

Azure Security Architecture

Key Azure Security Services:

• IAM: Azure AD (Entra ID), Privileged Identity Management (JIT access), Conditional Access
• Detection: Microsoft Defender for Cloud (CSPM/CWPP), Sentinel (SIEM/SOAR), Azure Monitor
• Network: Azure Firewall, Front Door + WAF, DDoS Protection
• Data: Key Vault (secrets, keys, certificates), Information Protection (DLP), Storage encryption
• Compute: Just-in-Time VM Access, Azure Policy (compliance enforcement)

Hub-Spoke Landing Zone: Implement hub VNet (shared services: firewall, VPN, Azure Bastion) with spoke VNets (workloads). Use Management Groups for policy hierarchy.

For Azure security architecture and hub-spoke design, see references/azure-security-architecture.md and examples/architectures/azure-landing-zone.md.

Identity & Access Management Patterns

Authentication Controls

Multi-Factor Authentication (MFA):

• Types: TOTP (time-based one-time passwords), push notifications, biometrics, hardware tokens (YubiKey, FIDO2)
• Enforcement: Require MFA for all users (workforce and customers), especially privileged accounts
• Passwordless: Transition to WebAuthn, FIDO2, passkeys to eliminate password-based attacks

Single Sign-On (SSO):

• Protocols: SAML 2.0, OAuth 2.0, OpenID Connect (OIDC)
• Benefits: Centralized authentication, reduced password fatigue, improved security posture
• Implementation: Azure AD, Okta, Auth0, Ping Identity

Authorization Controls

Role-Based Access Control (RBAC):

• Users assigned to roles, roles have permissions
• Coarse-grained, simple to implement
• Best for: Organizations with stable role structures

Attribute-Based Access Control (ABAC):

• Fine-grained access based on attributes (user department, resource classification, time, location)
• More flexible than RBAC
• Best for: Complex, dynamic access requirements

Policy-Based Access Control (PBAC):

• Centralized policy engines (Open Policy Agent - OPA, AWS Cedar)
• Policies defined declaratively and versioned
• Best for: Microservices, API gateways, cloud-native architectures

Privileged Access Management (PAM)

Just-in-Time (JIT) Access:

• Temporary elevated privileges for specific tasks
• Time-bound access grants (e.g., 4 hours)
• Reduces standing privileged access

Credential Vaulting:

• Centralized storage of privileged credentials (CyberArk, HashiCorp Vault, Azure Key Vault)
• Automatic password rotation
• Session recording and auditing

For detailed IAM implementation patterns, MFA configuration, and PAM setup, see references/iam-patterns.md.

Security Monitoring & Operations

SIEM (Security Information & Event Management)

Centralize log aggregation, correlation, and alerting for security events.

Leading SIEM Platforms:

• Splunk, Elastic Security, Microsoft Sentinel, Chronicle

SIEM Architecture: 1. Log Collection: Ingest logs from all layers (network, endpoints, applications, cloud) 2. Normalization: Standardize log formats for correlation 3. Correlation: Apply rules to detect patterns (failed logins → brute force attack) 4. Alerting: Notify SOC team of high-priority events 5. Investigation: Provide search and visualization for incident analysis

SOAR (Security Orchestration, Automation & Response)

Automate incident response workflows to reduce mean time to respond (MTTR).

SOAR Capabilities:

• Playbooks: Automated response workflows (block IP, quarantine endpoint, revoke credentials)
• Orchestration: Integrate with security tools (SIEM, EDR, firewall, IAM)
• Case Management: Track incidents, assign to analysts, document resolution

Leading SOAR Platforms:

• Splunk SOAR, Palo Alto Cortex XSOAR, IBM Resilient

Detection Strategies

UEBA (User & Entity Behavior Analytics):

• Machine learning-based anomaly detection
• Detects: Account compromise, insider threats, data exfiltration
• Baseline normal behavior, alert on deviations

Threat Intelligence:

• Integrate threat feeds (MISP, ThreatConnect, ISACs)
• Enrich alerts with threat context (known malicious IPs, IOCs)
• Proactive threat hunting using TTPs (MITRE ATT&CK framework)

For SIEM architecture, SOAR playbook examples, and detection strategies, see references/security-operations.md.

Quick Reference: Control Framework Mapping

Use this table to map risks to appropriate control frameworks:

Integration with Related Skills

Security architecture provides the strategic foundation for tactical security implementations:

• `infrastructure-as-code`: Implement security architecture as code (secure defaults, hardening)
• `kubernetes-operations`: Apply K8s security architecture (RBAC, Pod Security, Network Policies)
• `secret-management`: Architect secrets management (KMS, Vault, rotation strategies)
• `building-ci-pipelines`: Secure CI/CD architecture (SAST/DAST integration, artifact signing)
• `configuring-firewalls`: Implement network perimeter layer of defense-in-depth
• `vulnerability-management`: Integrate vulnerability scanning into security architecture
• `auth-security`: Implement IAM layer details (MFA, RBAC/ABAC, session management)
• `siem-logging`: Implement security monitoring architecture (SIEM, log aggregation)
• `compliance-frameworks`: Map security architecture to compliance requirements

Common Security Architecture Patterns

Pattern 1: Zero Trust Network Access (ZTNA)

Replace VPN with identity-based access to applications.

Architecture: 1. User authenticates to identity provider (Azure AD, Okta) 2. Device posture check validates device health 3. Policy engine evaluates access request (user, device, context) 4. Access granted through secure connector (no network access)

Benefits: Eliminates lateral movement, reduces attack surface, improves user experience

Pattern 2: Defense in Depth for Web Applications

Layer multiple security controls for web application protection.

Layers: 1. DDoS Protection (Cloudflare, AWS Shield) 2. WAF (application firewall, OWASP Top 10 rules) 3. API Gateway (authentication, rate limiting) 4. Application Security (SAST/DAST, secure coding) 5. Database Security (encryption, least privilege) 6. Logging & Monitoring (SIEM, anomaly detection)

Pattern 3: Cloud Security Posture Management (CSPM)

Continuously monitor and enforce security configurations across cloud environments.

Architecture: 1. Asset Discovery: Inventory all cloud resources 2. Configuration Assessment: Compare against security baselines (CIS Benchmarks) 3. Compliance Monitoring: Track regulatory compliance (SOC 2, ISO 27001) 4. Remediation: Automated fixes or guided workflows 5. Drift Detection: Alert on configuration changes

Leading CSPM Tools: Wiz, Orca Security, Prisma Cloud, Microsoft Defender for Cloud

Resources and References

Defense in Depth:

• references/defense-in-depth.md - 9-layer defense model, implementation patterns, failure impact analysis

Zero Trust Architecture:

• references/zero-trust-architecture.md - ZTA principles, reference architecture, implementation roadmap

Threat Modeling:

• references/threat-modeling.md - STRIDE, PASTA, DREAD, Attack Trees methodologies
• examples/threat-models/web-app-stride.md - Web application STRIDE analysis example
• examples/threat-models/api-threat-model.md - REST API threat model example
• examples/threat-models/microservices-threat-model.md - Microservices threat model example

Control Frameworks:

• references/nist-csf-mapping.md - NIST CSF 2.0 functions, categories, subcategories
• references/cis-controls.md - CIS Controls v8, implementation groups, safeguards
• references/owasp-top10-mitigation.md - OWASP Top 10 risks and mitigation strategies

Supply Chain Security:

• references/supply-chain-security.md - SLSA framework, SBOM generation, dependency scanning

Cloud Security:

• references/aws-security-architecture.md - AWS Well-Architected Security Pillar, services, patterns
• references/gcp-security-architecture.md - GCP Security Best Practices, services, organization design
• references/azure-security-architecture.md - Azure Security Benchmark, Defender for Cloud, landing zones

IAM & Operations:

• references/iam-patterns.md - Authentication, authorization, MFA, RBAC/ABAC, PAM
• references/security-operations.md - SIEM, SOAR, UEBA, threat intelligence, incident response

Architecture Examples:

• examples/architectures/aws-multi-account-security.md - AWS Organizations security setup
• examples/architectures/gcp-security-hierarchy.md - GCP folder/project security hierarchy
• examples/architectures/azure-landing-zone.md - Azure hub-spoke landing zone
• examples/architectures/zero-trust-network.md - Zero trust network design

Scripts:

• scripts/threat-model-template.py - Generate STRIDE threat model templates
• scripts/control-gap-analysis.sh - Compare current controls against frameworks
• scripts/sbom-generate.sh - Generate SBOM in CycloneDX format
• scripts/security-checklist.sh - Automated security architecture checklist

Summary

Security architecture requires strategic planning across multiple layers, from physical security to security operations. Implement defense-in-depth for comprehensive protection, adopt zero trust principles for modern cloud environments, use threat modeling to identify risks proactively, and map controls to frameworks for compliance and completeness.

Start with risk assessment to understand threats, select appropriate architecture approach (zero trust for greenfield, hybrid for brownfield), implement layered controls, and continuously monitor and improve security posture.

AWS Multi-Account Security Architecture

Overview

Multi-account AWS architecture provides security isolation, billing separation, and blast radius containment. Organize accounts using AWS Organizations with security controls enforced through Service Control Policies (SCPs).

Architecture Diagram

┌─────────────────────────────────────────────────────────────────────────┐
│                        AWS ORGANIZATION ROOT                             │
│                      (Management Account)                                │
│                                                                           │
│  ┌─────────────────────────────────────────────────────────────────┐   │
│  │ Organization Policies:                                           │   │
│  │ - Require MFA for all users                                      │   │
│  │ - Enforce encryption at rest                                     │   │
│  │ - Deny root user access                                          │   │
│  │ - Restrict regions (compliance)                                  │   │
│  └─────────────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────────────┘
           │
           ├───────────────────┬──────────────────┬──────────────────┐
           │                   │                  │                  │
           ▼                   ▼                  ▼                  ▼
    ┌─────────────┐    ┌─────────────┐    ┌─────────────┐    ┌─────────────┐
    │ Security OU │    │  Workload OU│    │Infrastructure│    │ Suspended OU│
    │             │    │             │    │     OU      │    │             │
    └─────────────┘    └─────────────┘    └─────────────┘    └─────────────┘
           │                   │                  │                  │
           │                   │                  │                  │
    ┌──────┴──────┐     ┌──────┴──────┐    ┌─────┴─────┐           │
    ▼             ▼     ▼             ▼    ▼           ▼           ▼
┌────────┐  ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐
│Security│  │Logging │ │  Prod  │ │  Dev   │ │Shared  │ │Network │ │Quarantine│
│Tooling │  │Account │ │Account │ │Account │ │Services│ │Account │ │Account │
│        │  │        │ │        │ │        │ │        │ │        │ │        │
│GuardDuty│ │CloudTr.│ │        │ │        │ │CI/CD   │ │Transit │ │        │
│SecHub  │  │Config  │ │        │ │        │ │Artifact│ │Gateway │ │        │
│Macie   │  │S3      │ │        │ │        │ │        │ │VPC     │ │        │
└────────┘  └────────┘ └────────┘ └────────┘ └────────┘ └────────┘ └────────┘
     │           │          │          │          │          │
     │           │          │          │          │          │
     └───────────┴──────────┴──────────┴──────────┴──────────┘
                            │
                            ▼
                  ┌──────────────────┐
                  │ Centralized      │
                  │ Security Logging │
                  │                  │
                  │ - CloudTrail     │
                  │ - VPC Flow Logs  │
                  │ - GuardDuty      │
                  │ - Security Hub   │
                  │ - Config         │
                  └──────────────────┘

Organizational Unit (OU) Design

Security OU

Contains accounts dedicated to security tooling and centralized logging.

Security Tooling Account:

• AWS Security Hub (aggregator)
• Amazon GuardDuty (threat detection)
• Amazon Macie (data discovery)
• AWS IAM Access Analyzer
• AWS Firewall Manager
• Amazon Detective (investigation)

Logging Account:

• Centralized CloudTrail logs (organization trail)
• AWS Config aggregator
• VPC Flow Logs aggregation
• S3 bucket policies preventing deletion
• Lifecycle policies for cost optimization
• Cross-region replication for DR

SCPs Applied:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenySecurityLogDeletion",
      "Effect": "Deny",
      "Action": [
        "s3:DeleteBucket",
        "s3:DeleteObject",
        "s3:DeleteObjectVersion",
        "logs:DeleteLogGroup",
        "logs:DeleteLogStream"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": [
            "us-east-1",
            "us-west-2"
          ]
        }
      }
    }
  ]
}

Workload OU

Contains production and non-production application accounts.

Production Account:

• Production workloads only
• Strict change control
• Enhanced monitoring
• Automated backups
• Encryption enforced

Development/Staging Accounts:

• Lower environment workloads
• Testing and experimentation
• Cost controls via budgets
• Automatic resource cleanup

SCPs Applied:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "RequireEncryption",
      "Effect": "Deny",
      "Action": [
        "s3:PutObject",
        "ec2:RunInstances",
        "rds:CreateDBInstance"
      ],
      "Resource": "*",
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    },
    {
      "Sid": "DenyProdChangesOutsideWindow",
      "Effect": "Deny",
      "Action": [
        "ec2:*",
        "rds:*",
        "lambda:*"
      ],
      "Resource": "*",
      "Condition": {
        "DateGreaterThan": {"aws:CurrentTime": "2024-01-01T17:00:00Z"},
        "DateLessThan": {"aws:CurrentTime": "2024-01-01T09:00:00Z"},
        "StringEquals": {"aws:RequestedRegion": "us-east-1"}
      }
    }
  ]
}

Infrastructure OU

Contains shared infrastructure and networking accounts.

Shared Services Account:

• Centralized CI/CD pipelines
• Artifact repositories (ECR, CodeArtifact)
• Shared AMI builder
• Secrets management
• Certificate management (ACM)

Network Account:

• AWS Transit Gateway
• VPC peering connections
• AWS Direct Connect
• Route53 private hosted zones
• Network Firewall
• AWS Network Firewall policies

SCPs Applied:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyNetworkChanges",
      "Effect": "Deny",
      "Action": [
        "ec2:DeleteTransitGateway*",
        "ec2:DeleteVpc",
        "ec2:DeleteInternetGateway"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:PrincipalArn": "arn:aws:iam::*:role/NetworkAdminRole"
        }
      }
    }
  ]
}

Suspended OU

Contains accounts for quarantine and decommissioning.

Quarantine Account:

• Compromised resource isolation
• Forensics analysis
• Incident response workspace
• No internet access
• All services disabled except forensics tools

SCP Applied:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyAllExceptForensics",
      "Effect": "Deny",
      "NotAction": [
        "ec2:Describe*",
        "s3:GetObject",
        "s3:ListBucket",
        "cloudtrail:LookupEvents",
        "logs:FilterLogEvents"
      ],
      "Resource": "*"
    }
  ]
}

Service Control Policies (SCPs)

Global Security Baseline

Apply to all accounts in the organization:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyRootUser",
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "aws:PrincipalArn": "arn:aws:iam::*:root"
        }
      }
    },
    {
      "Sid": "RequireIMDSv2",
      "Effect": "Deny",
      "Action": "ec2:RunInstances",
      "Resource": "arn:aws:ec2:*:*:instance/*",
      "Condition": {
        "StringNotEquals": {
          "ec2:MetadataHttpTokens": "required"
        }
      }
    },
    {
      "Sid": "DenyRegionRestriction",
      "Effect": "Deny",
      "NotAction": [
        "iam:*",
        "organizations:*",
        "route53:*",
        "cloudfront:*",
        "support:*"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:RequestedRegion": [
            "us-east-1",
            "us-west-2",
            "eu-west-1"
          ]
        }
      }
    },
    {
      "Sid": "RequireEncryptionAtRest",
      "Effect": "Deny",
      "Action": [
        "s3:PutObject",
        "ec2:CreateVolume",
        "rds:CreateDBInstance"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "s3:x-amz-server-side-encryption": "AES256",
          "ec2:Encrypted": "true",
          "rds:StorageEncrypted": "true"
        }
      }
    },
    {
      "Sid": "DenySecurityServiceDisable",
      "Effect": "Deny",
      "Action": [
        "guardduty:DeleteDetector",
        "securityhub:DisableSecurityHub",
        "config:DeleteConfigurationRecorder",
        "cloudtrail:StopLogging",
        "macie2:DisableMacie"
      ],
      "Resource": "*"
    }
  ]
}

Cost Control SCP (Development Accounts)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyExpensiveInstances",
      "Effect": "Deny",
      "Action": "ec2:RunInstances",
      "Resource": "arn:aws:ec2:*:*:instance/*",
      "Condition": {
        "ForAnyValue:StringNotLike": {
          "ec2:InstanceType": [
            "t3.*",
            "t3a.*",
            "t4g.*"
          ]
        }
      }
    }
  ]
}

Cross-Account Access Patterns

Centralized IAM Identity Center (AWS SSO)

Permission Sets:

# ReadOnlyAccess
PermissionSet:
  Name: ReadOnlyAccess
  ManagedPolicies:
    - arn:aws:iam::aws:policy/ReadOnlyAccess
  SessionDuration: PT4H

# DeveloperAccess
PermissionSet:
  Name: DeveloperAccess
  ManagedPolicies:
    - arn:aws:iam::aws:policy/PowerUserAccess
  InlinePolicy:
    Statement:
      - Effect: Deny
        Action:
          - iam:*
          - organizations:*
        Resource: "*"
  SessionDuration: PT8H

# AdminAccess
PermissionSet:
  Name: AdminAccess
  ManagedPolicies:
    - arn:aws:iam::aws:policy/AdministratorAccess
  SessionDuration: PT1H
  RequireMFA: true

Cross-Account IAM Roles

Assumption Pattern:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111111111111:role/TrustedRole"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "unique-external-id-12345"
        },
        "IpAddress": {
          "aws:SourceIp": [
            "10.0.0.0/8",
            "172.16.0.0/12"
          ]
        },
        "Bool": {
          "aws:MultiFactorAuthPresent": "true"
        }
      }
    }
  ]
}

Service-to-Service Pattern:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "222222222222"
        },
        "ArnLike": {
          "aws:SourceArn": "arn:aws:lambda:us-east-1:222222222222:function/allowed-function"
        }
      }
    }
  ]
}

Centralized Logging Architecture

CloudTrail Organization Trail

Configuration:

{
  "Name": "OrganizationTrail",
  "IsOrganizationTrail": true,
  "IsMultiRegionTrail": true,
  "IncludeGlobalServiceEvents": true,
  "EnableLogFileValidation": true,
  "EventSelectors": [
    {
      "ReadWriteType": "All",
      "IncludeManagementEvents": true,
      "DataResources": [
        {
          "Type": "AWS::S3::Object",
          "Values": ["arn:aws:s3:::*/sensitive-data/*"]
        },
        {
          "Type": "AWS::Lambda::Function",
          "Values": ["arn:aws:lambda:*:*:function/*"]
        }
      ]
    }
  ],
  "InsightSelectors": [
    {
      "InsightType": "ApiCallRateInsight"
    },
    {
      "InsightType": "ApiErrorRateInsight"
    }
  ]
}

S3 Bucket Policy (Logging Account):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AWSCloudTrailAclCheck",
      "Effect": "Allow",
      "Principal": {
        "Service": "cloudtrail.amazonaws.com"
      },
      "Action": "s3:GetBucketAcl",
      "Resource": "arn:aws:s3:::org-cloudtrail-logs"
    },
    {
      "Sid": "AWSCloudTrailWrite",
      "Effect": "Allow",
      "Principal": {
        "Service": "cloudtrail.amazonaws.com"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::org-cloudtrail-logs/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-acl": "bucket-owner-full-control"
        }
      }
    },
    {
      "Sid": "DenyUnencryptedObjectUploads",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::org-cloudtrail-logs/*",
      "Condition": {
        "StringNotEquals": {
          "s3:x-amz-server-side-encryption": "AES256"
        }
      }
    },
    {
      "Sid": "DenyInsecureTransport",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::org-cloudtrail-logs",
        "arn:aws:s3:::org-cloudtrail-logs/*"
      ],
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}

VPC Flow Logs

Centralized Collection:

# Enable VPC Flow Logs for all VPCs across accounts
aws ec2 create-flow-logs \
  --resource-type VPC \
  --resource-ids vpc-xxxxx \
  --traffic-type ALL \
  --log-destination-type s3 \
  --log-destination arn:aws:s3:::org-vpc-flow-logs \
  --log-format '${srcaddr} ${dstaddr} ${srcport} ${dstport} ${protocol} ${packets} ${bytes} ${start} ${end} ${action} ${log-status} ${vpc-id} ${subnet-id} ${instance-id} ${tcp-flags} ${type} ${pkt-srcaddr} ${pkt-dstaddr} ${region} ${az-id} ${sublocation-type} ${sublocation-id}'

Athena Query Setup:

CREATE EXTERNAL TABLE IF NOT EXISTS vpc_flow_logs (
  srcaddr string,
  dstaddr string,
  srcport int,
  dstport int,
  protocol int,
  packets bigint,
  bytes bigint,
  start_time bigint,
  end_time bigint,
  action string,
  log_status string,
  vpc_id string,
  subnet_id string,
  instance_id string,
  tcp_flags int,
  type string,
  pkt_srcaddr string,
  pkt_dstaddr string,
  region string,
  az_id string,
  sublocation_type string,
  sublocation_id string
)
PARTITIONED BY (year string, month string, day string)
ROW FORMAT DELIMITED
FIELDS TERMINATED BY ' '
LOCATION 's3://org-vpc-flow-logs/AWSLogs/'
TBLPROPERTIES ("skip.header.line.count"="1");

AWS Security Hub

Aggregator Configuration:

import boto3

securityhub = boto3.client('securityhub', region_name='us-east-1')

# Enable Security Hub in aggregator account
securityhub.enable_security_hub(
    EnableDefaultStandards=True
)

# Enable standards
securityhub.batch_enable_standards(
    StandardsSubscriptionRequests=[
        {'StandardsArn': 'arn:aws:securityhub:us-east-1::standards/aws-foundational-security-best-practices/v/1.0.0'},
        {'StandardsArn': 'arn:aws:securityhub:us-east-1::standards/cis-aws-foundations-benchmark/v/1.4.0'},
        {'StandardsArn': 'arn:aws:securityhub:us-east-1::standards/pci-dss/v/3.2.1'}
    ]
)

# Create aggregator
securityhub.create_finding_aggregator(
    RegionLinkingMode='ALL_REGIONS'
)

Amazon GuardDuty

Organization Configuration:

import boto3

guardduty = boto3.client('guardduty', region_name='us-east-1')

# Create detector in delegated admin account
detector_response = guardduty.create_detector(
    Enable=True,
    FindingPublishingFrequency='FIFTEEN_MINUTES',
    DataSources={
        'S3Logs': {'Enable': True},
        'Kubernetes': {
            'AuditLogs': {'Enable': True}
        },
        'MalwareProtection': {
            'ScanEc2InstanceWithFindings': {
                'EbsVolumes': {'Enable': True}
            }
        }
    }
)

detector_id = detector_response['DetectorId']

# Enable for organization
guardduty.enable_organization_admin_account(
    AdminAccountId='333333333333'  # Security Tooling account
)

# Auto-enable for new accounts
guardduty.update_organization_configuration(
    DetectorId=detector_id,
    AutoEnable=True,
    DataSources={
        'S3Logs': {'AutoEnable': True},
        'Kubernetes': {
            'AuditLogs': {'AutoEnable': True}
        },
        'MalwareProtection': {
            'ScanEc2InstanceWithFindings': {
                'EbsVolumes': {'AutoEnable': True}
            }
        }
    }
)

Network Security Architecture

Transit Gateway Design

┌──────────────┐     ┌──────────────┐     ┌──────────────┐
│  Prod VPC    │     │  Dev VPC     │     │ Shared VPC   │
│ 10.0.0.0/16  │     │ 10.1.0.0/16  │     │ 10.2.0.0/16  │
└──────┬───────┘     └──────┬───────┘     └──────┬───────┘
       │                    │                    │
       │    ┌───────────────┴────────────────┐   │
       └────┤   AWS Transit Gateway          ├───┘
            │   Route Tables:                │
            │   - Prod (isolated)            │
            │   - Non-Prod (shared)          │
            │   - Egress (internet-bound)    │
            └───────────────┬────────────────┘
                            │
                            ▼
                  ┌──────────────────┐
                  │ Network Firewall │
                  │ - IDS/IPS         │
                  │ - DPI             │
                  │ - Domain filtering│
                  └──────────────────┘

Security Groups Strategy

Tiered Application Pattern:

{
  "SecurityGroups": {
    "ALB": {
      "Ingress": [
        {"Protocol": "tcp", "Port": 443, "Source": "0.0.0.0/0"}
      ],
      "Egress": [
        {"Protocol": "tcp", "Port": 8080, "Destination": "sg-app-tier"}
      ]
    },
    "AppTier": {
      "Ingress": [
        {"Protocol": "tcp", "Port": 8080, "Source": "sg-alb"}
      ],
      "Egress": [
        {"Protocol": "tcp", "Port": 5432, "Destination": "sg-db-tier"}
      ]
    },
    "DBTier": {
      "Ingress": [
        {"Protocol": "tcp", "Port": 5432, "Source": "sg-app-tier"}
      ],
      "Egress": []
    }
  }
}

Compliance and Governance

AWS Config Rules

Organization Conformance Packs:

ConformancePackName: OrganizationSecurityBaseline
ConformancePackInputParameters:
  - ParameterName: RequiredTags
    ParameterValue: "Environment,Owner,CostCenter"

Resources:
  - ConfigRule:
      ConfigRuleName: encrypted-volumes
      Source:
        Owner: AWS
        SourceIdentifier: ENCRYPTED_VOLUMES
      Scope:
        ComplianceResourceTypes:
          - AWS::EC2::Volume

  - ConfigRule:
      ConfigRuleName: s3-bucket-public-read-prohibited
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_PUBLIC_READ_PROHIBITED

  - ConfigRule:
      ConfigRuleName: iam-password-policy
      Source:
        Owner: AWS
        SourceIdentifier: IAM_PASSWORD_POLICY
      InputParameters:
        RequireUppercaseCharacters: true
        RequireLowercaseCharacters: true
        RequireSymbols: true
        RequireNumbers: true
        MinimumPasswordLength: 14
        PasswordReusePrevention: 24
        MaxPasswordAge: 90

Backup Strategy

AWS Backup Organization Policy:

{
  "plans": {
    "ProductionBackupPlan": {
      "regions": ["us-east-1", "us-west-2"],
      "rules": {
        "DailyBackup": {
          "schedule_expression": "cron(0 5 ? * * *)",
          "start_window_minutes": 60,
          "target_backup_vault_name": "ProductionVault",
          "lifecycle": {
            "move_to_cold_storage_after_days": 30,
            "delete_after_days": 365
          },
          "copy_actions": [
            {
              "destination_backup_vault_arn": "arn:aws:backup:us-west-2:444444444444:backup-vault:ProductionVaultDR",
              "lifecycle": {
                "delete_after_days": 365
              }
            }
          ]
        }
      },
      "selections": {
        "ProductionResources": {
          "iam_role_arn": "arn:aws:iam::444444444444:role/AWSBackupRole",
          "resources": [
            "arn:aws:ec2:*:*:volume/*",
            "arn:aws:rds:*:*:db:*",
            "arn:aws:dynamodb:*:*:table/*"
          ],
          "conditions": {
            "tags": {
              "Environment": "Production"
            }
          }
        }
      }
    }
  }
}

Incident Response Preparation

Automated Quarantine

Lambda Function (EventBridge Rule Trigger):

import boto3
import json

ec2 = boto3.client('ec2')
sns = boto3.client('sns')

def lambda_handler(event, context):
    """
    Quarantine compromised EC2 instance based on GuardDuty finding.
    """
    # Extract instance ID from GuardDuty finding
    finding = event['detail']
    instance_id = finding['resource']['instanceDetails']['instanceId']

    # Create forensics snapshot
    volumes = ec2.describe_instance_attribute(
        InstanceId=instance_id,
        Attribute='blockDeviceMapping'
    )

    for volume in volumes['BlockDeviceMappings']:
        volume_id = volume['Ebs']['VolumeId']
        ec2.create_snapshot(
            VolumeId=volume_id,
            Description=f'Forensics snapshot - GuardDuty finding',
            TagSpecifications=[
                {
                    'ResourceType': 'snapshot',
                    'Tags': [
                        {'Key': 'Forensics', 'Value': 'true'},
                        {'Key': 'SourceInstance', 'Value': instance_id}
                    ]
                }
            ]
        )

    # Apply quarantine security group
    ec2.modify_instance_attribute(
        InstanceId=instance_id,
        Groups=['sg-quarantine']
    )

    # Notify security team
    sns.publish(
        TopicArn='arn:aws:sns:us-east-1:333333333333:SecurityAlerts',
        Subject=f'Instance Quarantined: {instance_id}',
        Message=json.dumps(finding, indent=2)
    )

    return {
        'statusCode': 200,
        'body': json.dumps(f'Instance {instance_id} quarantined successfully')
    }

Key Security Metrics

Monitor these metrics across the organization:

1. Access Metrics:

• Failed login attempts per account
• Root user usage (should be zero)
• MFA coverage percentage
• Unused IAM credentials (>90 days)

2. Compliance Metrics:

• Config rule compliance rate
• Security Hub security score
• Unencrypted resources count
• Public-facing resources

3. Threat Detection:

• GuardDuty findings by severity
• Mean time to remediation (MTTR)
• Repeat findings count
• Security Hub critical findings

4. Network Security:

• Unprotected security groups
• VPC Flow Logs enabled percentage
• Network Firewall blocks per hour
• Unusual traffic patterns

Implementation Checklist

• [ ] Create AWS Organization structure
• [ ] Define OU hierarchy and account placement
• [ ] Configure Service Control Policies (SCPs)
• [ ] Enable AWS IAM Identity Center (SSO)
• [ ] Create permission sets for least privilege
• [ ] Deploy organization CloudTrail
• [ ] Enable GuardDuty organization-wide
• [ ] Configure Security Hub aggregator
• [ ] Deploy AWS Config conformance packs
• [ ] Implement centralized logging (S3 buckets)
• [ ] Configure VPC Flow Logs for all VPCs
• [ ] Deploy Transit Gateway (if applicable)
• [ ] Configure AWS Backup organization policy
• [ ] Create incident response runbooks
• [ ] Deploy automated quarantine mechanisms
• [ ] Establish security metrics dashboard
• [ ] Configure alerting and notifications
• [ ] Document cross-account access patterns
• [ ] Train teams on multi-account operations
• [ ] Conduct tabletop incident response exercise

References

• AWS Organizations Best Practices
• AWS Security Reference Architecture
• CIS AWS Foundations Benchmark
• AWS Multi-Account Strategy

Azure Landing Zone Security Architecture

Overview

Azure Landing Zone provides a secure, scalable foundation for enterprise Azure deployments. Organize resources using management groups with governance enforced through Azure Policy and role-based access control (RBAC).

Architecture Diagram

┌─────────────────────────────────────────────────────────────────────────┐
│                    TENANT ROOT GROUP                                     │
│                 (Contoso Organization)                                   │
│                                                                           │
│  ┌─────────────────────────────────────────────────────────────────┐   │
│  │ Tenant-Level Policies:                                           │   │
│  │ - Require tags (Environment, Owner, CostCenter)                  │   │
│  │ - Allowed locations (East US 2, West US 2, West Europe)         │   │
│  │ - Require encryption in transit and at rest                      │   │
│  │ - Diagnostic settings for all resources                          │   │
│  └─────────────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────────────┘
           │
           ├────────────────┬──────────────────┬──────────────────┐
           │                │                  │                  │
           ▼                ▼                  ▼                  ▼
    ┌─────────────┐  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐
    │  Platform   │  │  Landing    │  │ Decommission│  │   Sandbox   │
    │             │  │   Zones     │  │             │  │             │
    └─────────────┘  └─────────────┘  └─────────────┘  └─────────────┘
           │                │                │                │
           │                │                │                │
    ┌──────┴───┬───────┐   │         ┌──────┴──────┐        │
    ▼          ▼       ▼   │         ▼             ▼        ▼
┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐   ┌────────┐ ┌────────┐
│Identity│ │Manage. │ │Connect.│ │ Corp   │   │Quarant.│ │Sandbox │
│        │ │        │ │        │ │        │   │        │ │Sub     │
│Entra ID│ │Log     │ │Hub VNet│ │ Prod   │   │        │ │        │
│Priv. ID│ │Analytics│ │Firewall│ │ Dev    │   │        │ │Full    │
│        │ │Sentinel│ │VPN/ER  │ │ Test   │   │        │ │Access  │
└────────┘ └────────┘ └────────┘ └────────┘   └────────┘ └────────┘
                           │           │
                           └───────────┴──────────┐
                                                  ▼
                                        ┌──────────────────┐
                                        │  Hub-Spoke VNet  │
                                        │                  │
                                        │ - Azure Firewall │
                                        │ - VPN Gateway    │
                                        │ - Bastion        │
                                        │ - DDoS Protection│
                                        └──────────────────┘

Management Group Hierarchy

Platform Management Group

Contains shared platform services and centralized operations.

Identity Subscription:

• Microsoft Entra ID (Azure AD)
• Entra ID Privileged Identity Management (PIM)
• Entra ID Identity Protection
• Conditional Access policies
• Domain controllers (if hybrid)
• Azure AD Connect (if hybrid)

Management Subscription:

• Azure Monitor Log Analytics workspace
• Microsoft Sentinel (SIEM)
• Azure Automation accounts
• Azure Policy compliance dashboard
• Cost Management + Billing
• Azure Backup vaults

Connectivity Subscription:

• Hub virtual network
• Azure Firewall / NVA
• VPN Gateway / ExpressRoute
• Azure Bastion
• Network Watcher
• DDoS Protection Plan
• Private DNS zones

Policies Applied:

{
  "properties": {
    "displayName": "Platform Security Baseline",
    "policyType": "Custom",
    "mode": "All",
    "parameters": {},
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Network/networkSecurityGroups"
          },
          {
            "count": {
              "field": "Microsoft.Network/networkSecurityGroups/securityRules[*]",
              "where": {
                "allOf": [
                  {
                    "field": "Microsoft.Network/networkSecurityGroups/securityRules[*].access",
                    "equals": "Allow"
                  },
                  {
                    "field": "Microsoft.Network/networkSecurityGroups/securityRules[*].direction",
                    "equals": "Inbound"
                  },
                  {
                    "field": "Microsoft.Network/networkSecurityGroups/securityRules[*].sourceAddressPrefix",
                    "in": ["*", "Internet", "0.0.0.0/0"]
                  }
                ]
              }
            },
            "greater": 0
          }
        ]
      },
      "then": {
        "effect": "deny"
      }
    }
  }
}

Landing Zones Management Group

Contains application workloads organized by environment and compliance requirements.

Corporate Landing Zone:

• Production workloads
• On-premises connectivity required
• Spoke VNet peered to hub
• Managed identities enforced
• Private endpoints mandatory

Online Landing Zone:

• Internet-facing applications
• Public endpoints allowed
• Web Application Firewall required
• DDoS protection enabled
• Enhanced monitoring

Policies Applied:

{
  "properties": {
    "displayName": "Require Private Endpoints for Storage",
    "policyType": "Custom",
    "mode": "Indexed",
    "parameters": {},
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Storage/storageAccounts"
          },
          {
            "field": "Microsoft.Storage/storageAccounts/networkAcls.defaultAction",
            "notEquals": "Deny"
          }
        ]
      },
      "then": {
        "effect": "deny"
      }
    }
  }
}

Decommissioned Management Group

Contains subscriptions being sunset or quarantined.

Quarantine Subscription:

• Compromised resource isolation
• All network access blocked
• Forensics tooling only
• Read-only access for security team

Policies Applied:

{
  "properties": {
    "displayName": "Deny All Resource Creation",
    "policyType": "Custom",
    "mode": "All",
    "parameters": {},
    "policyRule": {
      "if": {
        "field": "type",
        "notIn": [
          "Microsoft.Security/assessments",
          "Microsoft.Security/complianceResults"
        ]
      },
      "then": {
        "effect": "deny"
      }
    }
  }
}

Sandbox Management Group

Provides innovation space with relaxed policies.

Sandbox Subscriptions:

• Full service access
• Cost limits enforced via budgets
• Automatic resource cleanup (30 days)
• No production data allowed
• No connectivity to corporate network

Policies Applied:

{
  "properties": {
    "displayName": "Enforce Budget Limits",
    "policyType": "Custom",
    "mode": "All",
    "parameters": {
      "budgetAmount": {
        "type": "Integer",
        "metadata": {
          "displayName": "Monthly Budget",
          "description": "Maximum monthly spend in USD"
        },
        "defaultValue": 1000
      }
    },
    "policyRule": {
      "if": {
        "field": "type",
        "equals": "Microsoft.Resources/subscriptions"
      },
      "then": {
        "effect": "deployIfNotExists",
        "details": {
          "type": "Microsoft.Consumption/budgets",
          "roleDefinitionIds": [
            "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
          ],
          "deployment": {
            "properties": {
              "mode": "incremental",
              "template": {
                "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                "contentVersion": "1.0.0.0",
                "resources": [
                  {
                    "type": "Microsoft.Consumption/budgets",
                    "apiVersion": "2021-10-01",
                    "name": "SandboxBudget",
                    "properties": {
                      "category": "Cost",
                      "amount": "[parameters('budgetAmount')]",
                      "timeGrain": "Monthly",
                      "timePeriod": {
                        "startDate": "[concat(utcNow('yyyy-MM'), '-01')]"
                      },
                      "notifications": {
                        "Actual_80_Percent": {
                          "enabled": true,
                          "operator": "GreaterThan",
                          "threshold": 80,
                          "contactEmails": ["sandbox-admins@contoso.com"]
                        }
                      }
                    }
                  }
                ]
              }
            }
          }
        }
      }
    }
  }
}

Azure Policy Initiatives

Security Baseline Initiative

Comprehensive security controls applied at tenant root:

{
  "properties": {
    "displayName": "Contoso Security Baseline",
    "policyType": "Custom",
    "description": "Enforce organization-wide security controls",
    "metadata": {
      "category": "Security"
    },
    "parameters": {},
    "policyDefinitions": [
      {
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/404c3081-a854-4457-ae30-26a93ef643f9",
        "parameters": {}
      },
      {
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/a1181c5f-672a-477a-979a-7d58aa086233",
        "parameters": {}
      },
      {
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/013e242c-8828-4970-87b3-ab247555486d",
        "parameters": {}
      },
      {
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/7d7be79c-23ba-4033-84dd-45e2a5ccdd67",
        "parameters": {}
      },
      {
        "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/0961003e-5a0a-4549-abde-af6a37f2724d",
        "parameters": {}
      }
    ]
  }
}

Key Policies Included:

1. Secure transfer to storage accounts should be enabled (404c3081) 2. Audit VMs without managed disks (a1181c5f) 3. Deploy Diagnostic Settings for Network Security Groups (013e242c) 4. Function apps should only be accessible over HTTPS (7d7be79c) 5. Require a tag and its value on resources (0961003e)

Compliance Initiative (CIS Benchmark)

{
  "properties": {
    "displayName": "CIS Microsoft Azure Foundations Benchmark v1.4.0",
    "policyType": "BuiltIn",
    "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/c3f5c4d9-9a1d-4a99-85c0-7f93e384d5c5",
    "parameters": {
      "effect": {
        "value": "Audit"
      }
    }
  }
}

Custom Network Security Initiative

{
  "properties": {
    "displayName": "Network Security Controls",
    "policyType": "Custom",
    "policyDefinitions": [
      {
        "policyDefinitionId": "/subscriptions/xxx/providers/Microsoft.Authorization/policyDefinitions/deny-public-ip",
        "parameters": {
          "effect": {
            "value": "Deny"
          }
        }
      },
      {
        "policyDefinitionId": "/subscriptions/xxx/providers/Microsoft.Authorization/policyDefinitions/require-nsg-on-subnet",
        "parameters": {
          "effect": {
            "value": "Audit"
          }
        }
      },
      {
        "policyDefinitionId": "/subscriptions/xxx/providers/Microsoft.Authorization/policyDefinitions/allowed-nsg-rules-only",
        "parameters": {
          "allowedPorts": {
            "value": [443, 22]
          }
        }
      }
    ]
  }
}

Hub-Spoke Network Security

Hub VNet Design

┌─────────────────────────────────────────────────────────────┐
│              Hub VNet (10.0.0.0/16)                         │
│                                                              │
│  ┌──────────────────┐  ┌──────────────────┐                │
│  │ GatewaySubnet    │  │ AzureFirewall    │                │
│  │ 10.0.0.0/24      │  │ Subnet           │                │
│  │                  │  │ 10.0.1.0/26      │                │
│  │ - VPN Gateway    │  │                  │                │
│  │ - ExpressRoute   │  │ - Firewall       │                │
│  └──────────────────┘  │ - Public IP      │                │
│                        └──────────────────┘                │
│                                                              │
│  ┌──────────────────┐  ┌──────────────────┐                │
│  │ AzureBastion     │  │ Management       │                │
│  │ Subnet           │  │ Subnet           │                │
│  │ 10.0.2.0/27      │  │ 10.0.3.0/24      │                │
│  │                  │  │                  │                │
│  │ - Bastion Host   │  │ - Jump Boxes     │                │
│  └──────────────────┘  │ - Monitoring VMs │                │
│                        └──────────────────┘                │
└─────────────────────────────────────────────────────────────┘
                          │
        ┌─────────────────┴─────────────────┐
        │                                   │
        ▼                                   ▼
┌──────────────────┐              ┌──────────────────┐
│ Spoke VNet 1     │              │ Spoke VNet 2     │
│ (Production)     │              │ (Development)    │
│ 10.1.0.0/16      │              │ 10.2.0.0/16      │
│                  │              │                  │
│ - App Subnet     │              │ - App Subnet     │
│ - Data Subnet    │              │ - Data Subnet    │
│ - Private Endpts │              │ - Private Endpts │
└──────────────────┘              └──────────────────┘

Azure Firewall Configuration

Network Rules:

{
  "properties": {
    "ruleCollections": [
      {
        "name": "AllowOutboundHTTPS",
        "priority": 100,
        "action": {
          "type": "Allow"
        },
        "rules": [
          {
            "name": "AllowHTTPS",
            "protocols": ["TCP"],
            "sourceAddresses": ["10.1.0.0/16", "10.2.0.0/16"],
            "destinationAddresses": ["*"],
            "destinationPorts": ["443"]
          }
        ]
      },
      {
        "name": "AllowDNS",
        "priority": 110,
        "action": {
          "type": "Allow"
        },
        "rules": [
          {
            "name": "AllowDNSQueries",
            "protocols": ["UDP"],
            "sourceAddresses": ["10.1.0.0/16", "10.2.0.0/16"],
            "destinationAddresses": ["168.63.129.16"],
            "destinationPorts": ["53"]
          }
        ]
      }
    ]
  }
}

Application Rules:

{
  "properties": {
    "ruleCollections": [
      {
        "name": "AllowAzureServices",
        "priority": 200,
        "action": {
          "type": "Allow"
        },
        "rules": [
          {
            "name": "AllowAzureMonitor",
            "protocols": [
              {
                "protocolType": "Https",
                "port": 443
              }
            ],
            "targetFqdns": [
              "*.ods.opinsights.azure.com",
              "*.oms.opinsights.azure.com",
              "*.monitoring.azure.com"
            ],
            "sourceAddresses": ["10.1.0.0/16", "10.2.0.0/16"]
          },
          {
            "name": "AllowWindowsUpdate",
            "protocols": [
              {
                "protocolType": "Http",
                "port": 80
              },
              {
                "protocolType": "Https",
                "port": 443
              }
            ],
            "targetFqdns": [
              "*.windowsupdate.microsoft.com",
              "*.update.microsoft.com"
            ],
            "sourceAddresses": ["10.1.0.0/16"]
          }
        ]
      }
    ]
  }
}

Threat Intelligence:

{
  "properties": {
    "threatIntelMode": "Alert",
    "threatIntelWhitelist": {
      "fqdns": ["trusted-partner.com"],
      "ipAddresses": ["20.30.40.50"]
    }
  }
}

VNet Peering Security

{
  "properties": {
    "allowVirtualNetworkAccess": true,
    "allowForwardedTraffic": true,
    "allowGatewayTransit": true,
    "useRemoteGateways": false,
    "remoteVirtualNetwork": {
      "id": "/subscriptions/xxx/resourceGroups/hub-network-rg/providers/Microsoft.Network/virtualNetworks/hub-vnet"
    }
  }
}

Microsoft Defender for Cloud Integration

Enable All Defender Plans

# Enable Defender for Cloud Standard tier
Set-AzSecurityPricing -Name "VirtualMachines" -PricingTier "Standard"
Set-AzSecurityPricing -Name "SqlServers" -PricingTier "Standard"
Set-AzSecurityPricing -Name "AppServices" -PricingTier "Standard"
Set-AzSecurityPricing -Name "StorageAccounts" -PricingTier "Standard"
Set-AzSecurityPricing -Name "SqlServerVirtualMachines" -PricingTier "Standard"
Set-AzSecurityPricing -Name "KubernetesService" -PricingTier "Standard"
Set-AzSecurityPricing -Name "ContainerRegistry" -PricingTier "Standard"
Set-AzSecurityPricing -Name "KeyVaults" -PricingTier "Standard"
Set-AzSecurityPricing -Name "Dns" -PricingTier "Standard"
Set-AzSecurityPricing -Name "Arm" -PricingTier "Standard"
Set-AzSecurityPricing -Name "OpenSourceRelationalDatabases" -PricingTier "Standard"
Set-AzSecurityPricing -Name "Containers" -PricingTier "Standard"

# Configure auto-provisioning
Set-AzSecurityAutoProvisioningSetting -Name "default" -EnableAutoProvision

Defender for Servers Configuration

{
  "properties": {
    "pricingTier": "Standard",
    "subPlan": "P2",
    "extensions": [
      {
        "name": "MDE",
        "isEnabled": "True"
      },
      {
        "name": "AgentlessVmScanning",
        "isEnabled": "True"
      },
      {
        "name": "FileSensitivity",
        "isEnabled": "True"
      }
    ]
  }
}

Security Alerts Automation

{
  "type": "Microsoft.Security/automations",
  "apiVersion": "2019-01-01-preview",
  "name": "HighSeverityAlertAutomation",
  "location": "eastus2",
  "properties": {
    "description": "Trigger incident response for high severity alerts",
    "isEnabled": true,
    "scopes": [
      {
        "description": "All subscriptions",
        "scopePath": "/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
      }
    ],
    "sources": [
      {
        "eventSource": "Alerts",
        "ruleSets": [
          {
            "rules": [
              {
                "propertyJPath": "properties.metadata.severity",
                "propertyType": "String",
                "expectedValue": "High",
                "operator": "Equals"
              }
            ]
          }
        ]
      }
    ],
    "actions": [
      {
        "actionType": "LogicApp",
        "logicAppResourceId": "/subscriptions/xxx/resourceGroups/security-automation/providers/Microsoft.Logic/workflows/IncidentResponseWorkflow",
        "uri": "https://prod-xx.eastus2.logic.azure.com:443/workflows/xxx/triggers/manual/paths/invoke"
      }
    ]
  }
}

Microsoft Entra ID Configuration

Conditional Access Policies

Require MFA for All Users:

{
  "displayName": "Require MFA for all users",
  "state": "enabled",
  "conditions": {
    "users": {
      "includeUsers": ["All"],
      "excludeGroups": ["BreakGlassAccounts"]
    },
    "applications": {
      "includeApplications": ["All"]
    },
    "locations": {
      "includeLocations": ["All"]
    }
  },
  "grantControls": {
    "operator": "OR",
    "builtInControls": ["mfa"]
  }
}

Block Legacy Authentication:

{
  "displayName": "Block legacy authentication",
  "state": "enabled",
  "conditions": {
    "users": {
      "includeUsers": ["All"],
      "excludeGroups": ["LegacyAppExceptions"]
    },
    "applications": {
      "includeApplications": ["All"]
    },
    "clientAppTypes": [
      "exchangeActiveSync",
      "other"
    ]
  },
  "grantControls": {
    "operator": "OR",
    "builtInControls": ["block"]
  }
}

Require Compliant Device for Admins:

{
  "displayName": "Require compliant device for admins",
  "state": "enabled",
  "conditions": {
    "users": {
      "includeRoles": [
        "62e90394-69f5-4237-9190-012177145e10",
        "194ae4cb-b126-40b2-bd5b-6091b380977d"
      ]
    },
    "applications": {
      "includeApplications": ["All"]
    }
  },
  "grantControls": {
    "operator": "OR",
    "builtInControls": ["compliantDevice", "domainJoinedDevice"]
  }
}

Privileged Identity Management (PIM)

Role Assignment:

{
  "properties": {
    "roleDefinitionId": "/subscriptions/xxx/providers/Microsoft.Authorization/roleDefinitions/8e3af657-a8ff-443c-a75c-2fe8c4bcb635",
    "principalId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "requestType": "AdminAssign",
    "scheduleInfo": {
      "startDateTime": "2024-01-01T00:00:00Z",
      "expiration": {
        "type": "AfterDuration",
        "duration": "PT8H"
      }
    },
    "condition": "@Resource[Microsoft.Storage/storageAccounts/blobServices/containers:name] StringEquals 'production-data'",
    "conditionVersion": "2.0"
  }
}

PIM Settings:

{
  "properties": {
    "userMemberSettings": {
      "permanentEligibleSettings": {
        "approvalRequired": false
      },
      "expiringEligibleSettings": {
        "maximumGrantPeriod": "P365D"
      },
      "permanentActiveSettings": {
        "approvalRequired": true,
        "approvers": [
          {
            "id": "/subscriptions/xxx/resourceGroups/xxx/providers/Microsoft.ManagedIdentity/userAssignedIdentities/pim-approver"
          }
        ]
      },
      "activationSettings": {
        "maximumGrantPeriod": "PT8H",
        "approvalRequired": true,
        "requireMFA": true,
        "requireJustification": true,
        "requireTicketInfo": true
      }
    }
  }
}

Centralized Logging with Microsoft Sentinel

Log Analytics Workspace Design

# Create Log Analytics workspace
New-AzOperationalInsightsWorkspace `
  -ResourceGroupName "security-logging-rg" `
  -Name "contoso-sentinel-workspace" `
  -Location "eastus2" `
  -Sku "PerGB2018" `
  -RetentionInDays 90

# Enable Sentinel
Set-AzSentinelOnboardingState `
  -ResourceGroupName "security-logging-rg" `
  -WorkspaceName "contoso-sentinel-workspace" `
  -CustomerManagedKey $false

Data Connectors

{
  "kind": "AzureActiveDirectory",
  "properties": {
    "tenantId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "dataTypes": {
      "alerts": {
        "state": "enabled"
      }
    }
  }
}

{
  "kind": "AzureSecurityCenter",
  "properties": {
    "subscriptionId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "dataTypes": {
      "alerts": {
        "state": "enabled"
      }
    }
  }
}

Analytics Rules

Suspicious Sign-In Activity:

SigninLogs
| where TimeGenerated > ago(1h)
| where ResultType != "0"
| summarize
    FailureCount = count(),
    DistinctIPCount = dcount(IPAddress),
    FirstFailure = min(TimeGenerated),
    LastFailure = max(TimeGenerated)
    by UserPrincipalName, AppDisplayName
| where FailureCount > 10 or DistinctIPCount > 5
| extend
    Severity = iff(FailureCount > 50, "High", "Medium"),
    Description = strcat("User ", UserPrincipalName, " had ", FailureCount, " failed sign-ins")

Anomalous Resource Creation:

AzureActivity
| where TimeGenerated > ago(1h)
| where OperationNameValue endswith "write"
| where ActivityStatusValue == "Success"
| summarize
    ResourceCount = count(),
    ResourceTypes = make_set(ResourceType)
    by Caller, CallerIpAddress
| where ResourceCount > 20
| extend
    Severity = "Medium",
    Description = strcat(Caller, " created ", ResourceCount, " resources from ", CallerIpAddress)

Playbooks (Logic Apps)

Isolation Playbook:

{
  "definition": {
    "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
    "actions": {
      "Parse_Alert": {
        "type": "ParseJson",
        "inputs": {
          "content": "@triggerBody()?['Entities']",
          "schema": {
            "type": "object",
            "properties": {
              "ResourceId": {"type": "string"}
            }
          }
        }
      },
      "Get_VM_Details": {
        "type": "ApiConnection",
        "inputs": {
          "host": {
            "connection": {
              "name": "@parameters('$connections')['azurevm']['connectionId']"
            }
          },
          "method": "get",
          "path": "/subscriptions/@{encodeURIComponent(variables('subscriptionId'))}/resourceGroups/@{encodeURIComponent(variables('resourceGroup'))}/providers/Microsoft.Compute/virtualMachines/@{encodeURIComponent(variables('vmName'))}"
        },
        "runAfter": {
          "Parse_Alert": ["Succeeded"]
        }
      },
      "Apply_Quarantine_NSG": {
        "type": "ApiConnection",
        "inputs": {
          "host": {
            "connection": {
              "name": "@parameters('$connections')['azurenetworksecuritygroups']['connectionId']"
            }
          },
          "method": "put",
          "path": "/subscriptions/@{encodeURIComponent(variables('subscriptionId'))}/resourceGroups/@{encodeURIComponent(variables('resourceGroup'))}/providers/Microsoft.Network/networkInterfaces/@{encodeURIComponent(variables('nicName'))}",
          "body": {
            "properties": {
              "networkSecurityGroup": {
                "id": "/subscriptions/xxx/resourceGroups/security-rg/providers/Microsoft.Network/networkSecurityGroups/quarantine-nsg"
              }
            }
          }
        },
        "runAfter": {
          "Get_VM_Details": ["Succeeded"]
        }
      },
      "Create_Incident": {
        "type": "ApiConnection",
        "inputs": {
          "host": {
            "connection": {
              "name": "@parameters('$connections')['azuresentinel']['connectionId']"
            }
          },
          "method": "put",
          "path": "/Incidents",
          "body": {
            "properties": {
              "title": "VM Isolated - @{variables('vmName')}",
              "severity": "High",
              "status": "New"
            }
          }
        },
        "runAfter": {
          "Apply_Quarantine_NSG": ["Succeeded"]
        }
      }
    }
  }
}

Diagnostic Settings

Subscription-Level Diagnostics

{
  "properties": {
    "workspaceId": "/subscriptions/xxx/resourceGroups/security-logging-rg/providers/Microsoft.OperationalInsights/workspaces/contoso-sentinel-workspace",
    "logs": [
      {
        "category": "Administrative",
        "enabled": true
      },
      {
        "category": "Security",
        "enabled": true
      },
      {
        "category": "Alert",
        "enabled": true
      },
      {
        "category": "Policy",
        "enabled": true
      }
    ]
  }
}

Resource-Level Diagnostics (Azure Policy)

{
  "properties": {
    "displayName": "Deploy Diagnostic Settings for Storage Accounts",
    "policyType": "Custom",
    "mode": "Indexed",
    "parameters": {
      "workspaceId": {
        "type": "String",
        "metadata": {
          "displayName": "Log Analytics workspace"
        }
      }
    },
    "policyRule": {
      "if": {
        "field": "type",
        "equals": "Microsoft.Storage/storageAccounts"
      },
      "then": {
        "effect": "deployIfNotExists",
        "details": {
          "type": "Microsoft.Insights/diagnosticSettings",
          "existenceCondition": {
            "allOf": [
              {
                "field": "Microsoft.Insights/diagnosticSettings/logs[*].enabled",
                "equals": "true"
              }
            ]
          },
          "roleDefinitionIds": [
            "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
          ],
          "deployment": {
            "properties": {
              "mode": "incremental",
              "template": {
                "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                "contentVersion": "1.0.0.0",
                "parameters": {
                  "resourceName": {
                    "type": "string"
                  },
                  "workspaceId": {
                    "type": "string"
                  }
                },
                "resources": [
                  {
                    "type": "Microsoft.Storage/storageAccounts/providers/diagnosticSettings",
                    "apiVersion": "2021-05-01-preview",
                    "name": "[concat(parameters('resourceName'), '/Microsoft.Insights/default')]",
                    "properties": {
                      "workspaceId": "[parameters('workspaceId')]",
                      "metrics": [
                        {
                          "category": "Transaction",
                          "enabled": true
                        }
                      ]
                    }
                  }
                ]
              },
              "parameters": {
                "resourceName": {
                  "value": "[field('name')]"
                },
                "workspaceId": {
                  "value": "[parameters('workspaceId')]"
                }
              }
            }
          }
        }
      }
    }
  }
}

Key Security Metrics

Monitor these metrics across the Azure environment:

1. Identity Metrics:

• Failed sign-in attempts per user
• MFA coverage percentage
• Privileged role activations
• Conditional Access policy effectiveness

2. Compliance Metrics:

• Azure Policy compliance rate
• Defender for Cloud secure score
• Non-compliant resources count
• Security recommendations by severity

3. Network Metrics:

• Azure Firewall threat intel hits
• DDoS attack attempts
• NSG rule violations
• Private endpoint coverage

4. Detection Metrics:

• Sentinel alert volume by severity
• Mean time to detect (MTTD)
• Mean time to respond (MTTR)
• False positive rate

Implementation Checklist

• [ ] Design management group hierarchy
• [ ] Create platform subscriptions (Identity, Management, Connectivity)
• [ ] Deploy hub virtual network
• [ ] Configure Azure Firewall
• [ ] Create Azure Policy initiatives
• [ ] Assign policies at appropriate scopes
• [ ] Configure Microsoft Entra ID (Azure AD)
• [ ] Deploy Conditional Access policies
• [ ] Enable Privileged Identity Management
• [ ] Deploy Log Analytics workspace
• [ ] Enable Microsoft Sentinel
• [ ] Configure diagnostic settings (subscription and resource)
• [ ] Enable Defender for Cloud on all subscriptions
• [ ] Create landing zone subscriptions
• [ ] Deploy spoke virtual networks
• [ ] Configure VNet peering
• [ ] Create security automation playbooks
• [ ] Establish security monitoring dashboard
• [ ] Configure alert notifications
• [ ] Document deployment procedures
• [ ] Train operations teams

References

• Azure Landing Zone Architecture
• Azure Security Benchmark
• Microsoft Entra ID Best Practices
• Microsoft Sentinel Best Practices
• CIS Microsoft Azure Foundations Benchmark

GCP Security Hierarchy Architecture

Overview

Google Cloud Platform (GCP) security architecture uses resource hierarchy for organizational structure and governance. Apply security controls through IAM policies, Organization Policies, and VPC Service Controls to enforce defense-in-depth.

Architecture Diagram

┌─────────────────────────────────────────────────────────────────────────┐
│                    ORGANIZATION (example.com)                            │
│                     Organization ID: 123456789                           │
│                                                                           │
│  ┌─────────────────────────────────────────────────────────────────┐   │
│  │ Organization Policies:                                           │   │
│  │ - Require OS Login on all VMs                                    │   │
│  │ - Disable service account key creation                           │   │
│  │ - Restrict public IP on Cloud SQL                                │   │
│  │ - Require encryption with CMEK                                   │   │
│  │ - Domain restricted sharing (example.com only)                   │   │
│  └─────────────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────────────┘
           │
           ├───────────────────┬──────────────────┬──────────────────┐
           │                   │                  │                  │
           ▼                   ▼                  ▼                  ▼
    ┌─────────────┐    ┌─────────────┐    ┌─────────────┐    ┌─────────────┐
    │Infrastructure│    │  Workloads  │    │   Sandbox   │    │ Deprecated  │
    │   Folder    │    │   Folder    │    │   Folder    │    │   Folder    │
    └─────────────┘    └─────────────┘    └─────────────┘    └─────────────┘
           │                   │                │                  │
           │                   │                │                  │
    ┌──────┴──────┐     ┌──────┴──────┐        │                  │
    ▼             ▼     ▼             ▼        ▼                  ▼
┌────────┐  ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐      ┌────────┐
│Security│  │Network │ │ Prod   │ │  Dev   │ │Sandbox │      │Quarant.│
│Project │  │Project │ │Project │ │Project │ │Project │      │Project │
│        │  │        │ │        │ │        │ │        │      │        │
│SCC     │  │Shared  │ │App     │ │App     │ │Testing │      │Isolated│
│Cloud   │  │VPC     │ │Data    │ │Data    │ │Budget  │      │        │
│Logging │  │Cloud   │ │        │ │        │ │30-day  │      │        │
│        │  │Armor   │ │        │ │        │ │cleanup │      │        │
└────────┘  └────────┘ └────────┘ └────────┘ └────────┘      └────────┘
                │           │
                │           │
                └───────────┴──────────────┐
                                           ▼
                                 ┌──────────────────┐
                                 │ Shared VPC       │
                                 │ (Host Project)   │
                                 │                  │
                                 │ - Firewall Rules │
                                 │ - Cloud NAT      │
                                 │ - Cloud Router   │
                                 │ - Private Google │
                                 │   Access         │
                                 └──────────────────┘

Resource Hierarchy Design

Organization Level

Root node containing all GCP resources for the domain.

Organization Policies Applied:

# Require OS Login
constraints/compute.requireOsLogin:
  enforce: true

# Disable service account key creation
constraints/iam.disableServiceAccountKeyCreation:
  enforce: true

# Restrict VM external IPs
constraints/compute.vmExternalIpAccess:
  listPolicy:
    deniedValues:
      - "*"
    allowedValues:
      - "projects/network-project/zones/us-central1-a/instances/bastion"

# Domain restricted sharing
constraints/iam.allowedPolicyMemberDomains:
  listPolicy:
    allowedValues:
      - "C01234567"  # example.com organization ID

# Require CMEK encryption
constraints/gcp.restrictNonCmekServices:
  listPolicy:
    deniedValues:
      - "compute.googleapis.com"
      - "storage.googleapis.com"

# Skip default network creation
constraints/compute.skipDefaultNetworkCreation:
  enforce: true

# Disable automatic IAM grants for default service accounts
constraints/iam.automaticIamGrantsForDefaultServiceAccounts:
  enforce: true

Organization IAM Bindings:

bindings:
  - role: roles/resourcemanager.organizationAdmin
    members:
      - group:gcp-organization-admins@example.com
    condition:
      title: "Require context-aware access"
      expression: |
        device.is_corp_managed &&
        device.encryption_status == "ENCRYPTED"

  - role: roles/securitycenter.admin
    members:
      - group:security-team@example.com

  - role: roles/logging.configWriter
    members:
      - serviceAccount:logging-sa@security-project.iam.gserviceaccount.com

  - role: roles/viewer
    members:
      - group:all-employees@example.com
    condition:
      title: "Read-only during business hours"
      expression: |
        request.time.getHours("America/Los_Angeles") >= 8 &&
        request.time.getHours("America/Los_Angeles") < 18

Infrastructure Folder

Contains shared infrastructure and platform services.

Security Project:

• Security Command Center (SCC)
• Cloud Asset Inventory
• Access Transparency logs
• Cloud Audit Logs (organization sink)
• Cloud KMS for CMEK
• Certificate Authority Service
• Security Health Analytics

Network Project (Shared VPC Host):

• Shared VPC network
• Cloud Armor policies
• Cloud CDN
• Cloud Load Balancing
• Cloud NAT
• Cloud Interconnect
• Private Service Connect

Folder Policies:

# Require VPC Service Controls
constraints/compute.restrictVpcPeering:
  listPolicy:
    allowedValues:
      - "under:organizations/123456789/folders/infrastructure"

# Require uniform bucket-level access
constraints/storage.uniformBucketLevelAccess:
  enforce: true

Workloads Folder

Contains production and non-production application projects.

Production Environment:

• Service projects (Shared VPC)
• Binary Authorization required
• Enhanced audit logging
• Change approval required
• High availability SLA

Development/Staging:

• Service projects (Shared VPC)
• Relaxed deployment policies
• Cost controls via budgets
• Automatic resource cleanup (dev)

Folder Policies:

# Restrict public IPs on Cloud SQL
constraints/sql.restrictPublicIp:
  enforce: true

# Require Binary Authorization
constraints/binaryauthorization.requireAttestations:
  listPolicy:
    allowedValues:
      - "projects/security-project/attestors/production-attestor"

# Disable default service account usage
constraints/iam.disableServiceAccountKeyUpload:
  enforce: true

# Require labels
constraints/gcp.resourceLocations:
  listPolicy:
    allowedValues:
      - "in:us-locations"
      - "in:eu-locations"

Sandbox Folder

Provides innovation space with relaxed controls.

Sandbox Projects:

• Full API access
• Budget limits enforced
• No production data
• No connectivity to corporate network
• Automatic deletion after 90 days

Folder Policies:

# Budget enforcement
constraints/compute.vmExternalIpAccess:
  listPolicy:
    allowedValues:
      - "*"

# Restrict expensive VM types
constraints/compute.vmMachineTypes:
  listPolicy:
    deniedValues:
      - "n2-*"
      - "c2-*"
      - "m1-*"
    allowedValues:
      - "e2-*"
      - "n1-standard-1"
      - "n1-standard-2"

Deprecated Folder

Contains projects being decommissioned or quarantined.

Quarantine Project:

• All APIs disabled except logging
• No external connectivity
• Read-only access for security team
• Forensics tooling enabled

Folder Policies:

# Deny all API usage except logging
constraints/serviceuser.services:
  listPolicy:
    deniedValues:
      - "*"
    allowedValues:
      - "logging.googleapis.com"
      - "cloudresourcemanager.googleapis.com"

VPC Service Controls

Security Perimeter Design

┌─────────────────────────────────────────────────────────────┐
│              VPC SERVICE CONTROL PERIMETER                   │
│                   (Production Perimeter)                     │
│                                                               │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐      │
│  │ Prod Project │  │ Data Project │  │ ML Project   │      │
│  │              │  │              │  │              │      │
│  │ - Compute    │  │ - BigQuery   │  │ - Vertex AI  │      │
│  │ - GKE        │  │ - Cloud SQL  │  │ - AI Platform│      │
│  └──────────────┘  └──────────────┘  └──────────────┘      │
│                                                               │
│  Restricted Services:                                        │
│  - storage.googleapis.com                                    │
│  - bigquery.googleapis.com                                   │
│  - compute.googleapis.com                                    │
│                                                               │
│  Ingress Rules:                                              │
│  - Allow from corporate IP ranges                            │
│  - Allow from Cloud Identity (via Access Levels)            │
│                                                               │
│  Egress Rules:                                               │
│  - Allow to Google APIs only                                 │
│  - Deny to internet                                          │
│                                                               │
└─────────────────────────────────────────────────────────────┘

Perimeter Configuration:

name: "accessPolicies/123456/servicePerimeters/production_perimeter"
title: "Production Perimeter"
description: "VPC SC perimeter for production workloads"
perimeterType: "PERIMETER_TYPE_REGULAR"

status:
  resources:
    - "projects/123456789"  # prod-project
    - "projects/234567890"  # data-project
    - "projects/345678901"  # ml-project

  restrictedServices:
    - "storage.googleapis.com"
    - "bigquery.googleapis.com"
    - "compute.googleapis.com"
    - "container.googleapis.com"
    - "sqladmin.googleapis.com"

  accessLevels:
    - "accessPolicies/123456/accessLevels/corp_access"
    - "accessPolicies/123456/accessLevels/secure_device_access"

  vpcAccessibleServices:
    enableRestriction: true
    allowedServices:
      - "RESTRICTED-SERVICES"
      - "logging.googleapis.com"
      - "monitoring.googleapis.com"

  ingressPolicies:
    - ingressFrom:
        sources:
          - accessLevel: "accessPolicies/123456/accessLevels/corp_access"
        identities:
          - "serviceAccount:ci-cd-sa@ci-cd-project.iam.gserviceaccount.com"
      ingressTo:
        operations:
          - serviceName: "storage.googleapis.com"
            methodSelectors:
              - method: "google.storage.objects.create"
              - method: "google.storage.objects.get"
        resources:
          - "*"

  egressPolicies:
    - egressFrom:
        identities:
          - "serviceAccount:app-sa@prod-project.iam.gserviceaccount.com"
      egressTo:
        operations:
          - serviceName: "bigquery.googleapis.com"
        resources:
          - "projects/234567890"

Access Levels:

# Corporate network access
name: "accessPolicies/123456/accessLevels/corp_access"
title: "Corporate Access"
basic:
  conditions:
    - ipSubnetworks:
        - "203.0.113.0/24"  # Corporate office
        - "198.51.100.0/24"  # VPN range
      devicePolicy:
        requireCorpOwned: true
        requireScreenlock: true
      regions:
        - "US"
        - "EU"

# Secure device access (BeyondCorp)
name: "accessPolicies/123456/accessLevels/secure_device_access"
title: "Secure Device Access"
basic:
  conditions:
    - devicePolicy:
        requireCorpOwned: true
        requireAdminApproval: true
        requireScreenlock: true
        osConstraints:
          - osType: "DESKTOP_CHROME_OS"
            minimumVersion: "100.0.0"
          - osType: "DESKTOP_WINDOWS"
            minimumVersion: "10.0.19041"
      regions:
        - "US"
      members:
        - "user:alice@example.com"
        - "group:engineers@example.com"

IAM Policy Inheritance

Hierarchy Example

Organization
├── IAM: roles/viewer → group:all-employees@example.com
│
└── Folder: Infrastructure
    ├── IAM: roles/compute.networkAdmin → group:network-admins@example.com
    │
    └── Project: network-project
        ├── IAM (inherited): roles/viewer → group:all-employees@example.com
        ├── IAM (inherited): roles/compute.networkAdmin → group:network-admins@example.com
        └── IAM: roles/compute.instanceAdmin → serviceAccount:app-sa@app-project.iam.gserviceaccount.com

Policy Inheritance Rules:

1. Policies are inherited down the hierarchy 2. Child resources cannot remove inherited permissions 3. Child resources can add additional permissions 4. Most permissive policy wins 5. Deny policies (IAM Deny) override allow policies

IAM Deny Policies

Prevent Principal Deletion:

name: "policies/prevent-principal-deletion"
displayName: "Prevent deletion of critical service accounts"
rules:
  - denyRule:
      deniedPrincipals:
        - principalSet: "//iam.googleapis.com/projects/123456789/serviceAccounts/*"
      deniedPermissions:
        - "iam.serviceAccounts.delete"
      exceptionPrincipals:
        - "principal://goog/subject/security-admin@example.com"

Prevent Data Exfiltration:

name: "policies/prevent-data-exfiltration"
displayName: "Prevent external bucket access"
rules:
  - denyRule:
      deniedPrincipals:
        - "principalSet://goog/public:all"
      deniedPermissions:
        - "storage.objects.get"
        - "storage.objects.list"
      denialCondition:
        expression: |
          resource.name.startsWith("projects/_/buckets/sensitive-") &&
          !principal.in(["domain:example.com"])

Service Account Best Practices

Workload Identity for GKE:

# Kubernetes Service Account
apiVersion: v1
kind: ServiceAccount
metadata:
  name: app-ksa
  namespace: production
  annotations:
    iam.gke.io/gcp-service-account: app-sa@prod-project.iam.gserviceaccount.com

# Bind KSA to GSA
gcloud iam service-accounts add-iam-policy-binding \
  app-sa@prod-project.iam.gserviceaccount.com \
  --role roles/iam.workloadIdentityUser \
  --member "serviceAccount:prod-project.svc.id.goog[production/app-ksa]"

Short-Lived Credentials:

from google.auth import impersonated_credentials
from google.auth.transport import requests

# Source credentials (user or SA)
source_credentials, project = google.auth.default()

# Impersonate target service account
target_scopes = ['https://www.googleapis.com/auth/cloud-platform']
target_credentials = impersonated_credentials.Credentials(
    source_credentials=source_credentials,
    target_principal='app-sa@prod-project.iam.gserviceaccount.com',
    target_scopes=target_scopes,
    lifetime=3600  # 1 hour max
)

# Use credentials
auth_request = requests.Request()
target_credentials.refresh(auth_request)

Security Command Center

Enable SCC Premium

# Enable Security Command Center API
gcloud services enable securitycenter.googleapis.com

# Configure SCC
gcloud scc settings update \
  --organization=123456789 \
  --enable-asset-discovery \
  --enable-security-health-analytics \
  --enable-event-threat-detection \
  --enable-container-threat-detection \
  --enable-web-security-scanner

Security Health Analytics

Custom Detectors:

# Detect public GCS buckets
name: "organizations/123456789/securityHealthAnalyticsSettings/customModules/public-bucket-detector"
displayName: "Public GCS Bucket Detector"
enablementState: ENABLED
customConfig:
  predicate:
    expression: |
      resource.type == "storage.googleapis.com/Bucket" &&
      resource.data.iamConfiguration.publicAccessPrevention == "UNSPECIFIED"
  resourceSelector:
    resourceTypes:
      - "storage.googleapis.com/Bucket"
  severity: HIGH
  description: "Detects Cloud Storage buckets without public access prevention"
  recommendation: "Enable Public Access Prevention on the bucket"

Event Threat Detection

Custom Threat Rules:

# Detect privilege escalation
name: "organizations/123456789/eventThreatDetectionSettings/customModules/privilege-escalation"
displayName: "Privilege Escalation Detection"
enablementState: ENABLED
customConfig:
  predicate:
    expression: |
      event.type == "google.iam.admin.v1.SetIamPolicy" &&
      event.data.policyDelta.bindingDeltas.exists(
        delta, delta.role.startsWith("roles/owner") ||
               delta.role.startsWith("roles/editor")
      )
  severity: CRITICAL
  description: "Detects IAM policy changes granting Owner or Editor roles"

Continuous Exports to SIEM

# Create BigQuery export
gcloud scc bq-exports create prod-scc-export \
  --organization=123456789 \
  --dataset=projects/security-project/datasets/scc_findings \
  --description="Export SCC findings to BigQuery"

# Create Pub/Sub export
gcloud scc notifications create security-alerts \
  --organization=123456789 \
  --pubsub-topic=projects/security-project/topics/scc-findings \
  --description="Real-time SCC findings" \
  --filter="severity=\"HIGH\" OR severity=\"CRITICAL\""

Binary Authorization

Attestation Policy

name: "projects/prod-project/policy"
globalPolicyEvaluationMode: ENABLE
defaultAdmissionRule:
  evaluationMode: REQUIRE_ATTESTATION
  enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG
  requireAttestationsBy:
    - "projects/security-project/attestors/vulnerability-scanner"
    - "projects/security-project/attestors/code-review"
kubernetesNamespaceAdmissionRules:
  production:
    evaluationMode: REQUIRE_ATTESTATION
    enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG
    requireAttestationsBy:
      - "projects/security-project/attestors/vulnerability-scanner"
      - "projects/security-project/attestors/code-review"
      - "projects/security-project/attestors/qa-approval"
  development:
    evaluationMode: ALWAYS_ALLOW
    enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG

Attestor Configuration

# Vulnerability scanner attestor
name: "projects/security-project/attestors/vulnerability-scanner"
description: "Container vulnerability scan approval"
userOwnedGrafeasNote:
  noteReference: "projects/security-project/notes/vulnerability-scan-note"
  publicKeys:
    - pkixPublicKey:
        publicKeyPem: |
          -----BEGIN PUBLIC KEY-----
          MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...
          -----END PUBLIC KEY-----
        signatureAlgorithm: RSA_SIGN_PKCS1_4096_SHA512

CI/CD Attestation

import base64
from google.cloud import containeranalysis_v1
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding

def create_attestation(project_id, note_id, image_url, private_key_path):
    """
    Create Binary Authorization attestation after vulnerability scan.
    """
    client = containeranalysis_v1.ContainerAnalysisClient()
    grafeas_client = client.get_grafeas_client()

    note_name = f"projects/{project_id}/notes/{note_id}"
    artifact_url = f"https://{image_url}"

    # Create occurrence (attestation)
    occurrence = {
        "resource_uri": artifact_url,
        "note_name": note_name,
        "attestation": {
            "attestation": {
                "serialized_payload": base64.b64encode(
                    artifact_url.encode()
                ).decode(),
            }
        }
    }

    # Sign attestation
    with open(private_key_path, 'rb') as key_file:
        private_key = serialization.load_pem_private_key(
            key_file.read(),
            password=None
        )

    signature = private_key.sign(
        artifact_url.encode(),
        padding.PKCS1v15(),
        hashes.SHA512()
    )

    occurrence["attestation"]["attestation"]["signatures"] = [
        {
            "public_key_id": "vulnerability-scanner-key-1",
            "signature": base64.b64encode(signature).decode()
        }
    ]

    # Create occurrence
    created = grafeas_client.create_occurrence(
        parent=f"projects/{project_id}",
        occurrence=occurrence
    )

    print(f"Attestation created: {created.name}")
    return created

Cloud Audit Logs

Organization-Level Log Sink

# Create organization log sink to BigQuery
gcloud logging sinks create org-audit-logs-sink \
  bigquery.googleapis.com/projects/security-project/datasets/audit_logs \
  --organization=123456789 \
  --include-children \
  --log-filter='logName:"cloudaudit.googleapis.com"'

# Grant sink service account permissions
gcloud projects add-iam-policy-binding security-project \
  --member="serviceAccount:o123456789-XXXXXX@gcp-sa-logging.iam.gserviceaccount.com" \
  --role="roles/bigquery.dataEditor"

Data Access Audit Configuration

auditConfigs:
  - service: "allServices"
    auditLogConfigs:
      - logType: "ADMIN_READ"
      - logType: "DATA_READ"
      - logType: "DATA_WRITE"

  - service: "storage.googleapis.com"
    auditLogConfigs:
      - logType: "ADMIN_READ"
      - logType: "DATA_READ"
      - logType: "DATA_WRITE"
        exemptedMembers:
          - "serviceAccount:logging-sa@security-project.iam.gserviceaccount.com"

  - service: "bigquery.googleapis.com"
    auditLogConfigs:
      - logType: "ADMIN_READ"
      - logType: "DATA_READ"
        logType: "DATA_WRITE"

Audit Log Analysis

-- Detect privilege escalation
SELECT
  timestamp,
  protoPayload.authenticationInfo.principalEmail,
  protoPayload.methodName,
  protoPayload.resourceName,
  JSON_EXTRACT(protoPayload.request, '$.policy.bindings') AS new_bindings
FROM
  `security-project.audit_logs.cloudaudit_googleapis_com_activity_*`
WHERE
  protoPayload.methodName = 'google.iam.admin.v1.SetIamPolicy'
  AND JSON_EXTRACT(protoPayload.request, '$.policy.bindings') LIKE '%roles/owner%'
  AND timestamp > TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 24 HOUR)
ORDER BY timestamp DESC;

-- Detect data exfiltration attempts
SELECT
  timestamp,
  protoPayload.authenticationInfo.principalEmail,
  protoPayload.resourceName,
  COUNT(*) as access_count
FROM
  `security-project.audit_logs.cloudaudit_googleapis_com_data_access_*`
WHERE
  protoPayload.serviceName = 'storage.googleapis.com'
  AND protoPayload.methodName = 'storage.objects.get'
  AND protoPayload.resourceName LIKE '%sensitive-%'
  AND timestamp > TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 1 HOUR)
GROUP BY 1, 2, 3
HAVING access_count > 100
ORDER BY access_count DESC;

Network Security

Firewall Rules Hierarchy

# Deny all ingress (base rule)
name: "deny-all-ingress"
priority: 65535
direction: INGRESS
action: DENY
targetTags: []
sourceRanges:
  - "0.0.0.0/0"

# Allow SSH from IAP
name: "allow-ssh-iap"
priority: 1000
direction: INGRESS
action: ALLOW
sourceRanges:
  - "35.235.240.0/20"  # IAP range
allowed:
  - IPProtocol: tcp
    ports:
      - "22"
targetTags:
  - "allow-ssh"

# Allow internal traffic
name: "allow-internal"
priority: 1100
direction: INGRESS
action: ALLOW
sourceRanges:
  - "10.128.0.0/9"  # Internal VPC range
allowed:
  - IPProtocol: tcp
    ports:
      - "0-65535"
  - IPProtocol: udp
    ports:
      - "0-65535"
  - IPProtocol: icmp

Cloud Armor Security Policies

# DDoS and WAF protection
name: "cloud-armor-policy"
description: "WAF and DDoS protection for public endpoints"
rules:
  - priority: 0
    description: "Default rule"
    action: "allow"
    match:
      versionedExpr: "SRC_IPS_V1"
      config:
        srcIpRanges:
          - "*"

  - priority: 10
    description: "Block known bad IPs"
    action: "deny(403)"
    match:
      versionedExpr: "SRC_IPS_V1"
      config:
        srcIpRanges:
          - "192.0.2.0/24"

  - priority: 20
    description: "Rate limit per IP"
    action: "rate_based_ban"
    rateLimitOptions:
      conformAction: "allow"
      exceedAction: "deny(429)"
      enforceOnKey: "IP"
      rateLimitThreshold:
        count: 100
        intervalSec: 60
      banDurationSec: 600

  - priority: 30
    description: "Block SQL injection"
    action: "deny(403)"
    match:
      expr:
        expression: |
          evaluatePreconfiguredExpr('sqli-stable',
            ['owasp-crs-v030001-id942251-sqli',
             'owasp-crs-v030001-id942420-sqli',
             'owasp-crs-v030001-id942431-sqli'])

  - priority: 40
    description: "Block XSS"
    action: "deny(403)"
    match:
      expr:
        expression: |
          evaluatePreconfiguredExpr('xss-stable',
            ['owasp-crs-v030001-id941150-xss',
             'owasp-crs-v030001-id941320-xss'])

Private Google Access

# Enable Private Google Access for subnet
name: "private-subnet"
network: "projects/network-project/global/networks/shared-vpc"
region: "us-central1"
ipCidrRange: "10.128.0.0/20"
privateIpGoogleAccess: true

# Configure Private Service Connect
pscConnection:
  network: "projects/network-project/global/networks/shared-vpc"
  serviceAttachments:
    - "projects/SERVICE_PROJECT/regions/us-central1/serviceAttachments/all-apis"
  ipAddress: "10.128.10.10"

Cloud KMS and Encryption

Key Hierarchy

Key Ring: production-keyring (us-central1)
├── Database Encryption Key
│   ├── Purpose: ENCRYPT_DECRYPT
│   ├── Rotation: 90 days
│   └── Versions: 3 active
│
├── Application Secrets Key
│   ├── Purpose: ENCRYPT_DECRYPT
│   ├── Rotation: 30 days
│   └── Versions: 5 active
│
└── Signing Key
    ├── Purpose: ASYMMETRIC_SIGN
    ├── Algorithm: RSA_SIGN_PKCS1_4096_SHA256
    └── Versions: 1 active

Key Configuration:

# Create key ring
name: "projects/security-project/locations/us-central1/keyRings/production-keyring"

# Create crypto key
name: "projects/security-project/locations/us-central1/keyRings/production-keyring/cryptoKeys/database-key"
purpose: "ENCRYPT_DECRYPT"
versionTemplate:
  algorithm: "GOOGLE_SYMMETRIC_ENCRYPTION"
  protectionLevel: "HSM"
rotationPeriod: "7776000s"  # 90 days
nextRotationTime: "2024-04-01T00:00:00Z"

CMEK for Cloud SQL:

# Create Cloud SQL instance with CMEK
gcloud sql instances create prod-db \
  --tier=db-n1-standard-4 \
  --region=us-central1 \
  --disk-encryption-key=projects/security-project/locations/us-central1/keyRings/production-keyring/cryptoKeys/database-key \
  --disk-encryption-key-keyring=production-keyring \
  --disk-encryption-key-location=us-central1

Key Security Metrics

Monitor these metrics across GCP:

1. IAM Metrics:

• Service account key age
• Overly permissive roles (Owner, Editor)
• Unused service accounts
• External members in IAM policies

2. Compliance Metrics:

• Organization policy violations
• SCC findings by severity
• Asset inventory changes
• Non-compliant resources

3. Network Metrics:

• Firewall rule hits
• Cloud Armor blocks
• VPC SC perimeter violations
• Public IP usage

4. Threat Detection:

• Event Threat Detection findings
• Anomalous API usage
• Failed authentication attempts
• Data exfiltration attempts

Implementation Checklist

• [ ] Create organization and verify domain ownership
• [ ] Design folder hierarchy
• [ ] Apply organization policies
• [ ] Create infrastructure projects (security, network)
• [ ] Deploy Shared VPC network
• [ ] Configure firewall rules
• [ ] Enable Security Command Center Premium
• [ ] Configure VPC Service Controls perimeters
• [ ] Define access levels
• [ ] Create workload projects
• [ ] Attach service projects to Shared VPC
• [ ] Configure Cloud KMS and create keys
• [ ] Enable CMEK for data services
• [ ] Configure organization audit log sinks
• [ ] Deploy Binary Authorization
• [ ] Create attestors and policies
• [ ] Configure Cloud Armor policies
• [ ] Enable Private Google Access
• [ ] Establish security monitoring dashboard
• [ ] Configure alerting (Pub/Sub → Cloud Functions)
• [ ] Document architecture and procedures

References

• GCP Resource Hierarchy
• Organization Policy Constraints
• VPC Service Controls
• Security Command Center
• Binary Authorization
• CIS Google Cloud Platform Foundation Benchmark