Apply this filter to the logs (under operations from the cluster management screen). Default audit logs go back 180 days. resource.type=”gke_cluster” protoPayload.authorizationInfo.permission=”container.clusters.create” resource.labels.cluster_name=”your-cluster-name” Default audit logs go…
While only an OWNER can create service accounts, an EDITOR too can manipulate existing service accounts. If a project contains service accounts , the Editor roles grant permission…
By default, when you create a public cluster, GKE assigns an external IP address (external endpoint) to the control plane and provisions public nodes. This means that any…
Overview If you created a GKE service that allows external access, you will be surprised to see a few firewall rules (at the VPC level) created automatically for…
Use Case – serve content to users who are not authenticated Cloud CDN can cache content that doesn’t require authenticated users.
Use Case – To Route GCP Logs to external sinks (e.g. Splunk) The only sink you can use here is pub sub. Install the logging agent to capture…
Use Case – monitor for failed SSH attempts and alert based on failures Log based alerts would be needed – there is no built in metric for failed…
Use Case – Disallow deletion of bucket objects, regardless of IAM access Retention policy will lock the bucket (or object in a bucket) and not allow deletion, regardless…
High level service accounts (Folders, projects and Org level) should be few SAs. No keys allowed. The AD groups (containing human users) should be defined for these with…
GCP Service Account Impersonation Explained | Secure Short-Term Access Service account keys provide long lived access. One often has to provide short term access to GCP resources. That’s…