![Types of Audit Trail Log entries for GCP Usage IAM FOR VIEWING
Admin Activity + API calls
+ Other administrative actions [that
modify the configuration or metadata of
resources]
- Enable by default
- Can not disable
- Free
- Project viewer
- Logging / Log Viewer
Data Access + API calls [ that read the configuration /
metadata of resources ]
+ user-driven API calls [ make changes
to user-provided resource data ]
• Disable by default
• Charged by
Google
• Project/Owner
• Logging/Private Logs
Viewer
System Event + Google Cloud administrative actions [
that modify the configuration of
resources ]
(( generated by Google systems; they
are not driven by direct user action ))
- Enable by default
- Can not disable
- Free
- Project viewer
- Logging / Log Viewer
2. GCP Best Practice (Logging & Monitoring)
J. Audit Logging](https://image.slidesharecdn.com/gcpbestpractices-200719034010/85/GCP-Best-Practices-for-SRE-Team-13-320.jpg)
GCP Best Practices for SRE Team
- 1. GCP Best Practices For Cloud Journey Bảo Huỳnh Site Reliability Engineering 27-March-2020
- 2. 1. GCP Walk Through 2. GCP Best practice (for all) 3. GCP Best practice (GKE operation) 4. Sample Organization report (Mudah) 5. Q&A Agenda
- 3. 1. GCP Walk Through
- 4. 2. GCP Best Practice (Org. setup) A. Separate Resource Hierarchy - Different Level for management - Separate projects for billing control
- 5. 2. GCP Best Practice (Org. setup)
- 6. B. IAC for cloud resources creation 2. GCP Best Practice (Org. setup)
- 7. C. Export & analyze billing - Export to BigQuery - Visualize with Data Studio 2. GCP Best Practice (Billing Mgmt.)
- 8. D. Cost usage control - Setting Quotas for each resources - Alert on budget billing 2. GCP Best Practice (Billing Mgmt.)
- 9. 2. GCP Best Practice (Logging & Monitoring)
- 10. E. Logging with Stackdriver Export to LogSink for future usage Support below LogSink: - On-prem LogStore - Cloud Pub/Sub - GCS - BigQuery 2. GCP Best Practice (Logging & Monitoring)
- 11. 2. GCP Best Practice (Logging & Monitoring) F. Monitoring with Stackdriver Metrics Exposure Alerting Rules based on Metrics
- 12. 2. GCP Best Practice (Logging & Monitoring) J. Audit Logging Answer 4W question: What Who When Where
- 13. Types of Audit Trail Log entries for GCP Usage IAM FOR VIEWING Admin Activity + API calls + Other administrative actions [that modify the configuration or metadata of resources] - Enable by default - Can not disable - Free - Project viewer - Logging / Log Viewer Data Access + API calls [ that read the configuration / metadata of resources ] + user-driven API calls [ make changes to user-provided resource data ] • Disable by default • Charged by Google • Project/Owner • Logging/Private Logs Viewer System Event + Google Cloud administrative actions [ that modify the configuration of resources ] (( generated by Google systems; they are not driven by direct user action )) - Enable by default - Can not disable - Free - Project viewer - Logging / Log Viewer 2. GCP Best Practice (Logging & Monitoring) J. Audit Logging
- 14. Type Target Applied Level Identity and Accessiblity Management (IAM) All identities in GCP - User - Group - ServiceAccount Projects Orgranization Policy GCP Resources Orgranization Projects 2. GCP Best Practice (IAM & Policies)
- 15. 2. GCP Best Practice (IAM & Policies) Identities and Accessibility Management - Assign only limited access to resources - Assign users into different group => then assign group with IAM - NOT allow any bucket-level access, only access by object-level
- 16. 2. GCP Best Practice (IAM & Policies) Organization Policies - providing the ability to set restrictions on specific resources to determine how they can be configured and used. Vietnamese Translate - Áp constraints lên các resource (VM, CloudFunction, GCS,..) - Để: quy định các resource này ĐƯỢC configure & sử dụng ntn bởi user Example: ● Define a constraint to restrict virtual machine instances from having an external IP address. ● Define a constraint to allow cloud function could use ingress setting (from user)
- 17. ● Enforce MFA on employee's account ● Use Cloud Identity / GSuite to manage account for organization 2. GCP Best Practice (Security)
- 18. ● Private IP Cluster ● Different NodePool for different types of Application ● Enable Stackdriver Logging & Monitoring for service observalibilty ● Security + Avoid running as Root (instead using SecurityContext) + Enable NetworkPolicy (Ingress/Egress/From/To) for each NS ● Isolation application (in each namespaces) if possible + Apply security + Enable Quota for Resources (per Namespace) maxpod * limit CPU/Memory => Each application don’t starve out resources of other apps => cost control 3. GCP Best Practice (GKE Operation)
- 19. ● Report based on current GCP’s resources of Mudah ● Recommendation given by GCP experts ● Follow GCP best practices from Google for cloud operation. 4. Sample Organization Report
- 20. Questions & a little Answers