GCP Network Hardening

Disable creation of the legacy "default" VPC organization-wide via the constraints/compute.skipDefaultNetworkCreation Org Policy constraint, and design every workload network as an explicit custom-mode VPC (typically a Shared VPC host project lent to many service projects in a hub-and-spoke topology). The default VPC ships with auto-mode subnets in every region and a permissive set of pre-baked firewall rules — exactly the surface area an Org-level policy should remove before any project is created (Google Cloud — VPC documentation (accessed 2026-05)). The principle is reinforced in General Network — segmentation: a network the organisation did not consciously design is a network whose blast radius the organisation cannot reason about. Custom-mode (--subnet-mode=custom) is the only acceptable VPC mode for new workloads; auto-mode subnets in every region make egress controls and CIDR planning impossible to enforce consistently.

Remediation — gcloud CLI

# gcloud CLI (latest stable)
# Step 1: enforce the skip-default-network constraint at the organization scope.
cat > default-network-deny.yaml <<'YAML'
name: organizations/ORG_ID/policies/compute.skipDefaultNetworkCreation
spec:
  rules:
  - enforce: true
YAML

gcloud org-policies set-policy default-network-deny.yaml \
  --organization=ORG_ID

# Step 2: inventory existing default VPCs across all projects in the org.
for project in $(gcloud projects list --format='value(projectId)'); do
  gcloud compute networks list --project="$project" \
    --filter='name=default' \
    --format="value(name)" 2>/dev/null \
    | sed "s|^|$project: |"
done

# Step 3: create the explicit per-workload VPC in custom mode (no auto subnets).
gcloud compute networks create vpc-app-prod \
  --project=svc-app-prod \
  --subnet-mode=custom \
  --bgp-routing-mode=regional

# Step 4: create a single explicit subnet in the approved region + CIDR.
gcloud compute networks subnets create snet-app-prod-euw1 \
  --project=svc-app-prod \
  --network=vpc-app-prod \
  --region=europe-west1 \
  --range=10.40.0.0/22 \
  --enable-flow-logs \
  --enable-private-ip-google-access

Remediation — Terraform

# Terraform Google provider ~> 5.0
# Source: Google Cloud docs (accessed 2026-05)
resource "google_org_policy_policy" "skip_default_network" {
  name   = "organizations/${var.org_id}/policies/compute.skipDefaultNetworkCreation"
  parent = "organizations/${var.org_id}"

  spec {
    rules {
      enforce = "TRUE"
    }
  }
}

# Explicit custom-mode VPC in the host project (Shared VPC host pattern).
resource "google_compute_network" "vpc_app_prod" {
  project                 = var.host_project_id
  name                    = "vpc-app-prod"
  auto_create_subnetworks = false
  routing_mode            = "REGIONAL"
}

resource "google_compute_subnetwork" "snet_app_prod_euw1" {
  project                  = var.host_project_id
  name                     = "snet-app-prod-euw1"
  network                  = google_compute_network.vpc_app_prod.id
  region                   = "europe-west1"
  ip_cidr_range            = "10.40.0.0/22"
  private_ip_google_access = true

  log_config {
    aggregation_interval = "INTERVAL_5_SEC"
    flow_sampling        = 0.5
    metadata             = "INCLUDE_ALL_METADATA"
  }
}

Remediation — Config Connector

apiVersion: orgpolicy.cnrm.cloud.google.com/v1beta1
kind: OrgPolicyPolicy
metadata:
  name: skip-default-network
  namespace: config-control
spec:
  resourceRef:
    apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
    kind: Organization
    external: "organizations/ORG_ID"
  spec:
    rules:
    - enforce: true
  name: "organizations/ORG_ID/policies/compute.skipDefaultNetworkCreation"

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="compute.googleapis.com"
          AND ((protoPayload.methodName="v1.compute.networks.insert"
                AND protoPayload.resourceName=~".*/networks/default$")
               OR (protoPayload.methodName="v1.compute.firewalls.insert"
                   AND protoPayload.request.name=~"default-allow-(icmp|internal|rdp|ssh)"))

Equivalent on: AWS · Azure · OCI

No Hierarchical Firewall Policy and no VPC firewall rule in any project of the organization may permit ingress from 0.0.0.0/0 on administrative ports — SSH 22, RDP 3389, SQL Server 1433, PostgreSQL 5432, MySQL 3306, MongoDB 27017, Redis 6379, and any other database or management port the organization uses. Author the canonical deny at organization scope as a Hierarchical Firewall Policy so the invariant survives VPC creation, then layer a VPC-level deny for defence in depth (Google Cloud — Hierarchical Firewall Policies overview (accessed 2026-05)). Anti-conflation: Hierarchical Firewall Policies attach at organization or folder scope and evaluate before VPC firewall rules — a project-level admin cannot override an Org-scope HFP deny. VPC firewall rules attach at network scope and are the per-VPC fallback. Cloud Armor (gcp-net-05) is the L7 WAF at the external HTTPS LB edge and is a complementary inspection plane, not a substitute for L4 firewall policy. CRITICAL because this is the canonical "open the internet to my database" misconfiguration; Shodan-style scanners locate exposures within minutes, and CIS GCP v4.0.0 §3.6 and §3.7 codify the requirement.

Remediation — gcloud CLI

# gcloud CLI (latest stable)
# Step 1: create the Hierarchical Firewall Policy at organization scope.
gcloud compute firewall-policies create ORG_NO_ADMIN_INGRESS \
  --organization=ORG_ID \
  --short-name=org-no-admin-ingress \
  --description="Org-wide deny: 0.0.0.0/0 -> admin ports"

# Step 2: deny 0.0.0.0/0 -> admin TCP ports at priority 100 (low-numbered = earlier).
gcloud compute firewall-policies rules create 100 \
  --firewall-policy=ORG_NO_ADMIN_INGRESS \
  --organization=ORG_ID \
  --action=deny \
  --direction=INGRESS \
  --layer4-configs=tcp:22,tcp:3389,tcp:1433,tcp:3306,tcp:5432,tcp:27017,tcp:6379 \
  --src-ip-ranges=0.0.0.0/0 \
  --enable-logging \
  --description="Deny Internet -> admin / DB ports (org-wide invariant)"

# Step 3: attach the policy to the organization (or to specific folders).
gcloud compute firewall-policies associations create \
  --firewall-policy=ORG_NO_ADMIN_INGRESS \
  --organization=ORG_ID \
  --name=org-root-association

# Audit: list every VPC firewall rule across the org that still allows 0.0.0.0/0 on admin ports.
for project in $(gcloud projects list --format='value(projectId)'); do
  gcloud compute firewall-rules list --project="$project" \
    --filter='direction=INGRESS AND disabled=false AND sourceRanges:0.0.0.0/0' \
    --format="value(name,allowed,sourceRanges)" 2>/dev/null \
    | sed "s|^|$project: |"
done

Remediation — Terraform

# Terraform Google provider ~> 5.0
# Source: Google Cloud docs (accessed 2026-05)
resource "google_compute_firewall_policy" "org_no_admin_ingress" {
  parent      = "organizations/${var.org_id}"
  short_name  = "org-no-admin-ingress"
  description = "Org-wide deny: 0.0.0.0/0 -> admin ports"
}

resource "google_compute_firewall_policy_rule" "deny_internet_admin_ports" {
  firewall_policy = google_compute_firewall_policy.org_no_admin_ingress.id
  priority        = 100
  direction       = "INGRESS"
  action          = "deny"
  enable_logging  = true
  description     = "Deny Internet -> admin / DB ports (CIS GCP v4.0.0 3.6 + 3.7)"

  match {
    src_ip_ranges = ["0.0.0.0/0"]

    layer4_configs {
      ip_protocol = "tcp"
      ports       = ["22", "3389", "1433", "3306", "5432", "27017", "6379"]
    }
  }
}

resource "google_compute_firewall_policy_association" "org_root" {
  firewall_policy = google_compute_firewall_policy.org_no_admin_ingress.id
  attachment_target = "organizations/${var.org_id}"
  name = "org-root-association"
}

# Defence in depth: VPC-scope deny for the workload VPC.
resource "google_compute_firewall" "vpc_deny_admin_from_internet" {
  project   = var.host_project_id
  name      = "deny-internet-to-admin-ports"
  network   = google_compute_network.vpc_app_prod.name
  direction = "INGRESS"
  priority  = 100

  deny {
    protocol = "tcp"
    ports    = ["22", "3389", "1433", "3306", "5432", "27017", "6379"]
  }

  source_ranges = ["0.0.0.0/0"]

  log_config {
    metadata = "INCLUDE_ALL_METADATA"
  }
}

Remediation — Config Connector

apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeFirewall
metadata:
  name: deny-ssh-rdp-internet
  namespace: config-control
spec:
  networkRef:
    name: prod-vpc
  direction: INGRESS
  priority: 65534
  denied:
  - protocol: tcp
    ports: ["22", "3389"]
  sourceRanges:
  - "0.0.0.0/0"

Remediation — Pulumi (TypeScript)

import * as gcp from "@pulumi/gcp";

// Explicit-deny SSH/RDP from the public internet — paired with allow-list rules for
// IAP TCP forwarding (35.235.240.0/20) when bastion access is required.
const denyAdminInternet = new gcp.compute.Firewall("deny-ssh-rdp-internet", {
    name: "deny-ssh-rdp-internet",
    network: prodVpc.id,
    direction: "INGRESS",
    priority: 65534,
    denies: [{ protocol: "tcp", ports: ["22", "3389"] }],
    sourceRanges: ["0.0.0.0/0"],
});

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="compute.googleapis.com"
          AND protoPayload.methodName=~"v1.compute.(firewalls|firewallPolicies).*"
          AND protoPayload.request.sourceRanges="0.0.0.0/0"
          AND (protoPayload.request.allowed.ports="22"
               OR protoPayload.request.allowed.ports="3389")

Equivalent on: AWS · Azure · OCI

Enable Private Google Access on every workload subnet and route Google API consumption through the private.googleapis.com (199.36.153.8/30) or restricted.googleapis.com (199.36.153.4/30, used in conjunction with VPC Service Controls perimeters) anycast endpoints, so private-IP-only VMs reach Google APIs without traversing the public internet (Google Cloud — Private Google Access documentation (accessed 2026-05)). Pair PGA with Org Policy constraints/compute.vmExternalIpAccess to deny external IP assignment on workload VMs by default; PGA is what makes that denial operationally viable. The principle is reinforced in General Network — private connectivity: traffic to managed services should never cross the public internet when a private path exists. Anti-conflation: PGA is per-subnet, free, and applies to consumption of Google-managed APIs from existing VMs; Private Service Connect (gcp-net-04) creates explicit private-IP endpoints inside the VPC for Google or third-party services and is the publication-mode complement. restricted.googleapis.com is specifically the entry endpoint for VPC SC perimeters; cross-link: VPC Service Controls (Phase 5; owned by the IAM page and not re-authored here). HIGH PREVENTIVE because PGA + the external-IP-deny Org Policy together remove the public-IP attack surface from workload VMs entirely while preserving their ability to reach Cloud Storage, BigQuery, and the other Google APIs they need.

Remediation — gcloud CLI

# gcloud CLI (latest stable)
# Step 1: enable Private Google Access on the workload subnet.
gcloud compute networks subnets update snet-app-prod-euw1 \
  --project=svc-app-prod \
  --region=europe-west1 \
  --enable-private-ip-google-access

# Step 2: enforce the no-external-IP Org Policy at organization scope.
cat > deny-external-ip.yaml <<'YAML'
name: organizations/ORG_ID/policies/compute.vmExternalIpAccess
spec:
  rules:
  - values:
      deniedValues: ["all"]
YAML

gcloud org-policies set-policy deny-external-ip.yaml \
  --organization=ORG_ID

# Step 3: create the Cloud DNS private zone that resolves googleapis.com to the
# private.googleapis.com range, so workloads don't need explicit code changes.
gcloud dns managed-zones create googleapis-com-private \
  --project=svc-app-prod \
  --description="Private resolution of googleapis.com -> 199.36.153.8/30" \
  --dns-name=googleapis.com. \
  --networks=vpc-app-prod \
  --visibility=private

gcloud dns record-sets create '*.googleapis.com.' \
  --project=svc-app-prod \
  --zone=googleapis-com-private \
  --type=A \
  --ttl=300 \
  --rrdatas=199.36.153.8,199.36.153.9,199.36.153.10,199.36.153.11

Remediation — Terraform

# Terraform Google provider ~> 5.0
# Source: Google Cloud docs (accessed 2026-05)
# Subnet with PGA enabled (boolean flips PGA on for the whole subnet).
resource "google_compute_subnetwork" "app_pga" {
  project                  = var.host_project_id
  name                     = "snet-app-prod-euw1"
  network                  = google_compute_network.vpc_app_prod.id
  region                   = "europe-west1"
  ip_cidr_range            = "10.40.0.0/22"
  private_ip_google_access = true
}

# Org Policy: deny external IPs on workload VMs.
resource "google_org_policy_policy" "deny_external_ip" {
  name   = "organizations/${var.org_id}/policies/compute.vmExternalIpAccess"
  parent = "organizations/${var.org_id}"

  spec {
    rules {
      values {
        denied_values = ["all"]
      }
    }
  }
}

# Cloud DNS private zone: resolve googleapis.com to private.googleapis.com range.
resource "google_dns_managed_zone" "googleapis_private" {
  project     = var.host_project_id
  name        = "googleapis-com-private"
  dns_name    = "googleapis.com."
  description = "Private resolution of googleapis.com -> 199.36.153.8/30"
  visibility  = "private"

  private_visibility_config {
    networks {
      network_url = google_compute_network.vpc_app_prod.id
    }
  }
}

resource "google_dns_record_set" "googleapis_wildcard" {
  project      = var.host_project_id
  managed_zone = google_dns_managed_zone.googleapis_private.name
  name         = "*.googleapis.com."
  type         = "A"
  ttl          = 300
  rrdatas      = ["199.36.153.8", "199.36.153.9", "199.36.153.10", "199.36.153.11"]
}

Remediation — Config Connector

apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeSubnetwork
metadata:
  name: prod-subnet-pga
  namespace: config-control
spec:
  region: us-central1
  ipCidrRange: "10.0.16.0/20"
  networkRef:
    name: prod-vpc
  privateIpGoogleAccess: true

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="compute.googleapis.com"
          AND (protoPayload.methodName=~"v1.compute.serviceAttachments.(insert|patch)"
               OR (protoPayload.methodName="v1.compute.forwardingRules.insert"
                   AND protoPayload.request.target=~".*serviceAttachments.*"))

Equivalent on: AWS · Azure · OCI

Front Google-managed and third-party services with Private Service Connect endpoints — explicit private-IP forwarding rules inside the consuming VPC that target a service attachment for the upstream service. PSC supersedes the legacy Private Service Access (VPC peering) model for new designs and is the only access pattern that fully removes the upstream service's public-IP exposure from the consuming VPC's perspective (Google Cloud — Private Service Connect documentation (accessed 2026-05)). The principle is reinforced in General Network — zero trust: never traverse a network you do not control. Anti-pattern to flag: Private Service Access (VPC peering to a Google-managed producer VPC) was the original private connectivity pattern for managed services like Cloud SQL and Memorystore; it works but the consuming VPC's route table absorbs the producer's CIDR, transitive peering is constrained, and the model does not scale to per-service granular access. PSC creates one forwarding rule per consumer-to-service binding, eliminates transitive peering questions, and supports IAM at the service-attachment level. Anti-conflation with PGA: PGA is the consumption mode for any VM with a private IP and a route to the anycast googleapis.com range; PSC is the publication mode for explicit per-service endpoints in your VPC. They can coexist: PGA for the broad set of Google APIs, PSC for specific high-value services where IAM at the endpoint is required.

Remediation — gcloud CLI

# gcloud CLI (latest stable)
# Variant A: global PSC endpoint for Google APIs (all-apis bundle).
gcloud compute addresses create psc-google-apis \
  --project=svc-app-prod \
  --global \
  --purpose=PRIVATE_SERVICE_CONNECT \
  --addresses=10.40.255.2 \
  --network=vpc-app-prod

gcloud compute forwarding-rules create psc-google-apis \
  --project=svc-app-prod \
  --global \
  --network=vpc-app-prod \
  --address=psc-google-apis \
  --target-google-apis-bundle=all-apis

# Variant B: per-service PSC endpoint for a published service attachment
# (e.g. a partner SaaS or another team's Cloud SQL instance).
gcloud compute forwarding-rules create psc-vendor-api \
  --project=svc-app-prod \
  --region=europe-west1 \
  --network=vpc-app-prod \
  --subnet=snet-psc-euw1 \
  --target-service-attachment=projects/vendor-prod/regions/europe-west1/serviceAttachments/vendor-api

Remediation — Terraform

# Terraform Google provider ~> 5.0
# Source: Google Cloud docs (accessed 2026-05)
# Variant A: global PSC endpoint for the all-apis Google bundle.
resource "google_compute_global_address" "psc_google_apis" {
  project      = var.host_project_id
  name         = "psc-google-apis"
  purpose      = "PRIVATE_SERVICE_CONNECT"
  address_type = "INTERNAL"
  address      = "10.40.255.2"
  network      = google_compute_network.vpc_app_prod.id
}

resource "google_compute_global_forwarding_rule" "psc_google_apis" {
  project               = var.host_project_id
  name                  = "psc-google-apis"
  target                = "all-apis"
  network               = google_compute_network.vpc_app_prod.id
  ip_address            = google_compute_global_address.psc_google_apis.id
  load_balancing_scheme = ""
}

# Variant B: per-service PSC consumer endpoint.
resource "google_compute_forwarding_rule" "psc_vendor_api" {
  project               = var.host_project_id
  name                  = "psc-vendor-api"
  region                = "europe-west1"
  network               = google_compute_network.vpc_app_prod.id
  subnetwork            = google_compute_subnetwork.snet_psc_euw1.id
  target                = var.vendor_service_attachment
  load_balancing_scheme = ""
}

Remediation — Config Connector

apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeSubnetwork
metadata:
  name: prod-subnet-pga-strict
  namespace: config-control
spec:
  region: us-central1
  ipCidrRange: "10.0.32.0/20"
  networkRef:
    name: prod-vpc
  privateIpGoogleAccess: true
  purpose: PRIVATE

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="compute.googleapis.com"
          AND protoPayload.methodName="v1.compute.subnetworks.patch"
          AND protoPayload.request.privateIpGoogleAccess=false

Equivalent on: AWS · Azure · OCI

Front internet-facing web traffic with an external HTTPS Load Balancer and attach a Cloud Armor security policy carrying the preconfigured WAF rule sets — ModSecurity CRS 3.x for SQL injection (sqli-v33-stable), cross-site scripting (xss-v33-stable), local file inclusion (lfi-v33-stable), remote file inclusion (rfi-v33-stable), remote code execution (rce-v33-stable), scanner-detection, and protocol-anomaly — and integrate reCAPTCHA Enterprise for bot mitigation on credential-bearing endpoints (Google Cloud — Cloud Armor security policy overview (accessed 2026-05)). Cloud Armor evaluates at the LB edge across Google's global PoP fleet, inspecting HTTP and HTTPS payloads — URI, headers, body, cookies, query strings — and is therefore an L7 control. Anti-conflation: Cloud Armor is the L7 WAF at the LB edge; Hierarchical Firewall Policies and VPC firewall rules (gcp-net-02) operate at L4 in the network plane. WAF cannot help with a volumetric SYN flood any more than L4 firewalls can stop an SQLi attempt in a well-formed HTTPS request. They are layered, not alternative. Adaptive Protection (gcp-net-06) is a different feature configured on the same security policy resource. HIGH PREVENTIVE because managed rules block known-exploit-pattern traffic at the edge before it ever reaches the application's parsing logic.

Remediation — gcloud CLI

# gcloud CLI (latest stable)
# Step 1: create the security policy.
gcloud compute security-policies create armor-prod \
  --project=svc-edge-prod \
  --description="Cloud Armor prod policy: preconfigured WAF + adaptive protection"

# Step 2: add preconfigured WAF rules in deny-403 mode.
for waf in sqli-v33-stable xss-v33-stable lfi-v33-stable rfi-v33-stable rce-v33-stable scannerdetection-v33-stable protocolattack-v33-stable; do
  prio=$((1000 + RANDOM % 9000))
  gcloud compute security-policies rules create "$prio" \
    --project=svc-edge-prod \
    --security-policy=armor-prod \
    --expression="evaluatePreconfiguredWaf('$waf')" \
    --action=deny-403 \
    --description="WAF: $waf"
done

# Step 3: attach the policy to the external HTTPS LB backend service.
gcloud compute backend-services update bes-app-prod \
  --project=svc-edge-prod \
  --global \
  --security-policy=armor-prod

Remediation — Terraform

# Terraform Google provider ~> 5.0
# Source: Google Cloud docs (accessed 2026-05)
resource "google_compute_security_policy" "armor_prod" {
  project     = var.edge_project_id
  name        = "armor-prod"
  description = "Cloud Armor prod policy: preconfigured WAF + adaptive protection"

  # Preconfigured WAF rule set — ModSecurity CRS 3.x family.
  dynamic "rule" {
    for_each = toset([
      "sqli-v33-stable",
      "xss-v33-stable",
      "lfi-v33-stable",
      "rfi-v33-stable",
      "rce-v33-stable",
      "scannerdetection-v33-stable",
      "protocolattack-v33-stable",
    ])
    content {
      action      = "deny(403)"
      priority    = 1000 + index([
        "sqli-v33-stable", "xss-v33-stable", "lfi-v33-stable", "rfi-v33-stable",
        "rce-v33-stable", "scannerdetection-v33-stable", "protocolattack-v33-stable",
      ], rule.value)
      description = "WAF: ${rule.value}"

      match {
        expr {
          expression = "evaluatePreconfiguredWaf('${rule.value}')"
        }
      }
    }
  }

  # Default rule (priority 2147483647).
  rule {
    action   = "allow"
    priority = 2147483647
    match {
      versioned_expr = "SRC_IPS_V1"
      config {
        src_ip_ranges = ["*"]
      }
    }
    description = "Default allow"
  }
}

resource "google_compute_backend_service" "app_prod" {
  project         = var.edge_project_id
  name            = "bes-app-prod"
  protocol        = "HTTPS"
  security_policy = google_compute_security_policy.armor_prod.id

  backend {
    group = google_compute_instance_group_manager.app.instance_group
  }

  health_checks = [google_compute_health_check.app.id]
}

Remediation — Config Connector

apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeSecurityPolicy
metadata:
  name: cloud-armor-waf
  namespace: config-control
spec:
  description: "Cloud Armor WAF — pre-configured rules"
  rule:
  - action: deny(403)
    priority: 1000
    match:
      expr:
        expression: "evaluatePreconfiguredExpr('sqli-v33-stable')"
  - action: deny(403)
    priority: 1001
    match:
      expr:
        expression: "evaluatePreconfiguredExpr('xss-v33-stable')"
  - action: allow
    priority: 2147483647
    match:
      versionedExpr: SRC_IPS_V1
      config:
        srcIpRanges: ["*"]

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="compute.googleapis.com"
          AND ((protoPayload.methodName="v1.compute.securityPolicies.patch"
                AND protoPayload.request.rules.action="preview")
               OR (protoPayload.methodName="v1.compute.backendServices.patch"
                   AND protoPayload.request.securityPolicy=""))

Equivalent on: AWS · Azure · OCI

Enable Cloud Armor Adaptive Protection on the security policy fronting internet-facing external HTTPS LBs, and consider the Cloud Armor Managed Protection Plus (Enterprise tier subscription) entitlement for DDoS Rapid Response engagement. Cloud Armor Standard is automatic and free at the Google platform level — it provides always-on L3/L4 volumetric mitigation across every Google Cloud LB. Adaptive Protection layers ML-driven L7 anomaly detection on top: it baselines per-backend-service traffic patterns, surfaces alerts when sustained anomalies appear, and emits suggested mitigation rules the operator can promote into the active security policy with one command (Google Cloud — Cloud Armor Adaptive Protection overview (accessed 2026-05)). Anti-conflation: Adaptive Protection and the preconfigured WAF rules in gcp-net-05 are distinct features on the same security policy resource — WAF deals with known-pattern requests (one request can match), Adaptive Protection deals with anomalous distributions across many requests (only a sustained attack matches). MEDIUM RESPONSIVE because Adaptive Protection's value-add over Standard is in the mitigation feedback loop during a sustained L7 attack, not in preventing volumetric traffic from ever arriving — Standard absorbs the bulk of L3/L4 volumetric attacks by default.

Remediation — gcloud CLI

# gcloud CLI (latest stable)
# Enable Adaptive Protection (L7 DDoS defence) on the existing security policy.
gcloud compute security-policies update armor-prod \
  --project=svc-edge-prod \
  --enable-layer7-ddos-defense \
  --layer7-ddos-defense-rule-visibility=STANDARD

# Verify the configuration.
gcloud compute security-policies describe armor-prod \
  --project=svc-edge-prod \
  --format='value(adaptiveProtectionConfig)'

# When Adaptive Protection emits a suggested rule via Cloud Monitoring, promote it
# into the active policy at a chosen priority. Example: deny a flagged source set.
gcloud compute security-policies rules create 500 \
  --project=svc-edge-prod \
  --security-policy=armor-prod \
  --src-ip-ranges="203.0.113.0/24,198.51.100.0/24" \
  --action=deny-403 \
  --description="Adaptive Protection suggested rule promoted 2026-05-23"

Remediation — Terraform

# Terraform Google provider ~> 5.0
# Source: Google Cloud docs (accessed 2026-05)
# Extend the existing armor-prod policy with Adaptive Protection.
resource "google_compute_security_policy" "armor_prod_with_adaptive" {
  project     = var.edge_project_id
  name        = "armor-prod"
  description = "Cloud Armor prod policy: preconfigured WAF + adaptive protection"

  adaptive_protection_config {
    layer_7_ddos_defense_config {
      enable          = true
      rule_visibility = "STANDARD"
    }
  }

  # Preconfigured WAF rules continue here (collapsed for brevity; see gcp-net-05).
  rule {
    action   = "allow"
    priority = 2147483647
    match {
      versioned_expr = "SRC_IPS_V1"
      config {
        src_ip_ranges = ["*"]
      }
    }
    description = "Default allow"
  }
}

# Cloud Monitoring alert on Adaptive Protection signals.
resource "google_monitoring_alert_policy" "adaptive_protection" {
  project      = var.edge_project_id
  display_name = "Cloud Armor Adaptive Protection alert"
  combiner     = "OR"

  conditions {
    display_name = "Adaptive Protection attack alert"
    condition_threshold {
      filter          = "resource.type=\"network_security_policy\" AND metric.type=\"networksecurity.googleapis.com/https/request_count\""
      duration        = "60s"
      comparison      = "COMPARISON_GT"
      threshold_value = 0
    }
  }

  notification_channels = var.security_oncall_channels
}

Remediation — Config Connector

apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeSecurityPolicy
metadata:
  name: cloud-armor-adaptive-ddos
  namespace: config-control
spec:
  description: "Cloud Armor Adaptive Protection (L7 DDoS)"
  adaptiveProtectionConfig:
    layer7DdosDefenseConfig:
      enable: true
  rule:
  - action: allow
    priority: 2147483647
    match:
      versionedExpr: SRC_IPS_V1
      config:
        srcIpRanges: ["*"]

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="compute.googleapis.com"
          AND protoPayload.methodName="v1.compute.securityPolicies.patch"
          AND protoPayload.request.adaptiveProtectionConfig.layer7DdosDefenseConfig.enable=false

Equivalent on: AWS · Azure · OCI

Enable DNSSEC signing on every public Cloud DNS managed zone the organisation owns. DNSSEC binds each DNS record to a cryptographic signature that validating resolvers (and intermediate caches) check, defeating cache-poisoning and on-path response-rewrite attacks (Google Cloud — Cloud DNS DNSSEC documentation (accessed 2026-05)). The principle is reinforced in General Network — DNS security. Cloud DNS auto-rotates the Zone Signing Key (ZSK); the Key Signing Key (KSK) is read with gcloud dns dns-keys list and the resulting DS record must be lodged at the parent registrar to complete the delegation chain. Two GCP-specific constraints to flag in advance: (1) DNSSEC applies to public Cloud DNS zones only — Cloud DNS private zones do not support DNSSEC and never will, because the validation chain assumes a public root and a key signing key tied to ICANN's root trust anchor; (2) algorithm choice — RSASHA256 (algo 8) is the safe default; ECDSAP256SHA256 (algo 13) yields smaller signatures and faster validation but historical resolver-side support is mixed in legacy enterprise resolvers. CIS GCP v4.0.0 §3.3, §3.4, and §3.5 codify the DNSSEC + algorithm requirements.

Remediation — gcloud CLI

# gcloud CLI (latest stable)
# Step 1: enable DNSSEC on a public managed zone (creates KSK + ZSK; signs records).
gcloud dns managed-zones update example-com \
  --project=svc-dns-prod \
  --dnssec-state=on \
  --ksk-algorithm=rsasha256 \
  --zsk-algorithm=rsasha256 \
  --denial-of-existence=nsec3

# Step 2: read the DS record values to lodge at the parent registrar.
gcloud dns dns-keys list \
  --project=svc-dns-prod \
  --zone=example-com \
  --format='table(keyTag,type,algorithm,digests[0].digest)'

# Audit: list every public managed zone in the org that does NOT have DNSSEC enabled.
for project in $(gcloud projects list --format='value(projectId)'); do
  gcloud dns managed-zones list --project="$project" \
    --filter='visibility=public AND dnssecConfig.state!=on' \
    --format="value(name)" 2>/dev/null \
    | sed "s|^|$project: |"
done

Remediation — Terraform

# Terraform Google provider ~> 5.0
# Source: Google Cloud docs (accessed 2026-05)
resource "google_dns_managed_zone" "example_com" {
  project     = var.dns_project_id
  name        = "example-com"
  dns_name    = "example.com."
  description = "Public zone for example.com (DNSSEC-signed)"
  visibility  = "public"

  dnssec_config {
    state         = "on"
    non_existence = "nsec3"

    default_key_specs {
      algorithm  = "rsasha256"
      key_length = 2048
      key_type   = "keySigning"
      kind       = "dns#dnsKeySpec"
    }

    default_key_specs {
      algorithm  = "rsasha256"
      key_length = 1024
      key_type   = "zoneSigning"
      kind       = "dns#dnsKeySpec"
    }
  }
}

# Cloud Monitoring alert on a sustained DNSSEC validation-failure rate
# (signal that the parent DS record is stale or rotation went wrong).
resource "google_monitoring_alert_policy" "dnssec_validation_failures" {
  project      = var.dns_project_id
  display_name = "Cloud DNS DNSSEC validation failures"
  combiner     = "OR"

  conditions {
    display_name = "Validation failure rate"
    condition_threshold {
      filter          = "resource.type=\"dns_query\" AND metric.type=\"dns.googleapis.com/query/response_count\" AND metric.label.\"response_code\"=\"SERVFAIL\""
      duration        = "300s"
      comparison      = "COMPARISON_GT"
      threshold_value = 100
    }
  }

  notification_channels = var.security_oncall_channels
}

Remediation — Config Connector

apiVersion: dns.cnrm.cloud.google.com/v1beta1
kind: DNSManagedZone
metadata:
  name: prod-zone
  namespace: config-control
spec:
  dnsName: "example.com."
  dnssecConfig:
    state: "on"
    defaultKeySpecs:
    - algorithm: rsasha256
      keyLength: 2048
      keyType: keySigning
    - algorithm: rsasha256
      keyLength: 1024
      keyType: zoneSigning

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="dns.googleapis.com"
          AND protoPayload.methodName=~".*ManagedZones.(update|patch)"
          AND (protoPayload.request.dnssecConfig.state="off"
               OR protoPayload.request.dnssecConfig.state="transfer")

Equivalent on: AWS · Azure · OCI

Provide internet egress to private-IP-only workload VMs via Cloud NAT attached to a Cloud Router in each region, deny external IPs at the Org Policy layer (constraints/compute.vmExternalIpAccess, also referenced in gcp-net-03), and enforce egress filtering through Hierarchical Firewall Policy egress rules plus — where URL-/FQDN-level egress filtering is required — Secure Web Proxy or a third-party managed NGFW (Palo Alto VM-Series, Fortinet FortiGate) in front of Cloud NAT (Google Cloud — Cloud NAT documentation (accessed 2026-05)). The general principle — workloads talk only to destinations they need — is documented at General Network — egress control. Anti-conflation: Cloud NAT does NAT-for-egress only — it does not inspect, filter by URL, or terminate TLS. Hierarchical Firewall Policies and VPC firewall rules (gcp-net-02) supply L4 destination policy. Secure Web Proxy (currently in preview-to-GA progression at the time of writing — re-verify cloud.google.com) and managed NGFW deployments add L7 URL / FQDN filtering and IDPS. Cloud NAT + HFP egress + Secure Web Proxy together are the GCP analog of the Azure Firewall Premium hub pattern. HIGH PREVENTIVE because egress filtering is the single largest exfiltration-path mitigation GCP exposes once east-west is constrained — it is the missing complement to Private Service Connect, which only covers Google-managed and explicitly-published service traffic.

Remediation — gcloud CLI

# gcloud CLI (latest stable)
# Step 1: enforce the no-external-IP Org Policy (reaffirmed from gcp-net-03).
gcloud org-policies set-policy deny-external-ip.yaml \
  --organization=ORG_ID

# Step 2: create the Cloud Router that anchors Cloud NAT in the workload region.
gcloud compute routers create router-prod-euw1 \
  --project=svc-app-prod \
  --network=vpc-app-prod \
  --region=europe-west1

# Step 3: create the Cloud NAT gateway with logging enabled (errors-only or all).
gcloud compute routers nats create nat-prod-euw1 \
  --project=svc-app-prod \
  --router=router-prod-euw1 \
  --router-region=europe-west1 \
  --auto-allocate-nat-external-ips \
  --nat-all-subnet-ip-ranges \
  --enable-logging \
  --log-filter=ERRORS_ONLY

# Step 4: HFP egress rule — default-deny + explicit allowlist at org scope.
gcloud compute firewall-policies rules create 9000 \
  --firewall-policy=ORG_NO_ADMIN_INGRESS \
  --organization=ORG_ID \
  --action=deny \
  --direction=EGRESS \
  --layer4-configs=tcp:0-65535,udp:0-65535 \
  --dest-ip-ranges=0.0.0.0/0 \
  --enable-logging \
  --description="Egress default-deny; allowlist rules at lower priorities"

Remediation — Terraform

# Terraform Google provider ~> 5.0
# Source: Google Cloud docs (accessed 2026-05)
resource "google_compute_router" "prod_euw1" {
  project = var.host_project_id
  name    = "router-prod-euw1"
  network = google_compute_network.vpc_app_prod.id
  region  = "europe-west1"
}

resource "google_compute_router_nat" "prod_euw1" {
  project                            = var.host_project_id
  name                               = "nat-prod-euw1"
  router                             = google_compute_router.prod_euw1.name
  region                             = google_compute_router.prod_euw1.region
  nat_ip_allocate_option             = "AUTO_ONLY"
  source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES"

  log_config {
    enable = true
    filter = "ERRORS_ONLY"
  }

  min_ports_per_vm = 64
}

# HFP egress rule: default-deny at org scope (priority 9000).
resource "google_compute_firewall_policy_rule" "egress_default_deny" {
  firewall_policy = google_compute_firewall_policy.org_no_admin_ingress.id
  priority        = 9000
  direction       = "EGRESS"
  action          = "deny"
  enable_logging  = true
  description     = "Egress default-deny; allowlist rules at lower priorities"

  match {
    dest_ip_ranges = ["0.0.0.0/0"]

    layer4_configs {
      ip_protocol = "tcp"
    }
    layer4_configs {
      ip_protocol = "udp"
    }
  }
}

Remediation — Config Connector

apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeRouterNAT
metadata:
  name: prod-cloud-nat
  namespace: config-control
spec:
  region: us-central1
  routerRef:
    name: prod-router
  natIpAllocateOption: MANUAL_ONLY
  natIps:
  - external: "projects/PROJECT_ID/regions/us-central1/addresses/nat-egress-ip"
  sourceSubnetworkIpRangesToNat: ALL_SUBNETWORKS_ALL_IP_RANGES
  logConfig:
    enable: true
    filter: ALL

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="compute.googleapis.com"
          AND ((protoPayload.methodName="v1.compute.routers.patch"
                AND NOT protoPayload.request.nats.name=~".*")
               OR (protoPayload.methodName="v1.compute.instances.insert"
                   AND protoPayload.request.networkInterfaces.accessConfigs.natIP=~".*"))

Equivalent on: AWS · Azure · OCI