This course explores how to secure your deployment pipelines on GCP. We will cover the four main techniques to securely build and deploy containers using Google Cloud and you will follow along with guided demonstrations from Google Cloud Platform so that you get a practical understanding of the techniques covered.
If you have any feedback relating to this course, please contact us at support@cloudacademy.com.
Learning Objectives
By completing this course, you will understand:
- The advantages of using Google managed base images
- How to detect security vulnerabilities in containers using Container Analysis
- How to create and enforce GKE deployment policies using Binary Authorization
- How to unauthorized changes to production using IAM
Intended Audience
This course is intended for:
- Infrastructure/Release engineers interested in the basics of building a secure CI/CD pipeline in GCP
- Security professionals who want to familiarize themselves with some of the common security tools Google provides for container deployment
- Anyone taking the Google “Professional Cloud DevOps Engineer” certification exam
Prerequisites
To get the most out of this course, you should be familiar with:
- Building CI/CD pipelines
- Building containers and deploying them to Kubernetes
- Setting up IAM roles and policies
Because different circumstances demand different access policies, there is no one-size-fits-all solution, however, there are some general guidelines. Number one, minimal permissions for your users. Always grant roles at the smallest scope needed. For example, if a user only needs access to publish Pub/Sub topics, grant the publisher role to the user for that topic. You can use the IAM Recommender to detect what permissions a user has not used in the last 90 days.
Also, you wanna avoid assigning basic roles in production environments. The IAM basic roles, such as Owner, Editor, Viewer can include thousands of permissions across multiple services. You should, instead, use predefined roles or, better yet, create custom roles that meet your needs.
For example, granting the Owner role to a member will allow them to access and modify almost all resources, including modifying IAM policies. This amount of privilege is potentially very risky. Grant the Owner role only when merely universal access is required. Users who are granted the service account user role, for a service account, can access all the resources to which that service account has access. Therefore, be cautious when granting the service account user role to a user.
Number two, minimal permissions for your services. Permissions are not just for users, every component of an application should be treated as a separate trust boundary. Each service that requires a different permission should have a separate service account for each of the services. That also means that each step of your pipeline should be assigned the least privilege.
Integration steps should not be able to deploy code, and deployment steps should not be able to build code or access your code repository. Number three, log and audit everything. Audit all changes to productions. Regularly audit any changes to your IAM policies, and, also, you want to audit those who have the ability to change your IAM policies. Using these best practices will ensure that your secure deployment pipeline will result in a secure production environment.
Daniel began his career as a Software Engineer, focusing mostly on web and mobile development. After twenty years of dealing with insufficient training and fragmented documentation, he decided to use his extensive experience to help the next generation of engineers.
Daniel has spent his most recent years designing and running technical classes for both Amazon and Microsoft. Today at Cloud Academy, he is working on building out an extensive Google Cloud training library.
When he isn’t working or tinkering in his home lab, Daniel enjoys BBQing, target shooting, and watching classic movies.