Google Cloud security commands are the CLI and API instructions you use to configure, audit, and enforce security controls across Google Cloud Platform (GCP) resources. They let you manage Identity and Access Management (IAM) policies, enable encryption, set up security policies, and verify compliance—all from the command line or scripts, making security automation scalable and repeatable.
- Why Command‑Line Security Matters in GCP
- Core Tooling: gcloud and gsutil
- Installing and Initializing
- Managing IAM with Commands
- Testing Permissions
- Encryption Commands
- Network Security Commands
- Example: Restricting Egress
- Compliance and Auditing Commands
- Automation Best Practices
- Common Pitfalls and How to Avoid Them
- Where to Find Official Documentation
More from this site
Keep reading the latest coverage
Why Command‑Line Security Matters in GCP
Using commands instead of the console provides:
- Version‑controlled configurations (IaC)
- Fast, repeatable deployments across projects and organizations
- Auditable logs via Cloud Audit Logs
- Integration with CI/CD pipelines
Core Tooling: gcloud and gsutil
The two primary command‑line tools for security in GCP are gcloud (the Google Cloud SDK) and gsutil for Cloud Storage. Both support authentication via service accounts and can be scripted in Bash, Python, or Terraform.
Installing and Initializing
Download the Cloud SDK, run gcloud init, and authenticate with gcloud auth login or gcloud auth activate-service-account. Verify the installation with gcloud version.
Managing IAM with Commands
IAM controls who can do what on which resources. The most common commands are:
- gcloud projects get-iam-policy PROJECT_ID – Retrieve current bindings.
- gcloud projects set-iam-policy PROJECT_ID POLICY_FILE.yaml – Apply a revised policy.
- gcloud iam roles create ROLE_ID --project=PROJECT_ID --file=ROLE.yaml – Define a custom role.
Policies are expressed in YAML or JSON, listing members and role pairs. Example snippet:
| Member | Role |
|---|---|
| user:alice@example.com | roles/viewer |
| serviceAccount:my‑svc@my‑project.iam.gserviceaccount.com | roles/editor |
Testing Permissions
Use gcloud iam test-permissions RESOURCE --permissions=PERM1,PERM2 to confirm a principal's effective rights before granting them.
Encryption Commands
GCP encrypts data at rest by default, but you can control keys with Cloud KMS.
- gcloud kms keyrings create KEYRING --location=global
- gcloud kms keys create KEY_NAME --keyring=KEYRING --purpose=encryption
- gcloud kms encrypt --key=KEY_NAME --plaintext-file=FILE --ciphertext-file=FILE.enc
- gcloud kms decrypt --key=KEY_NAME --ciphertext-file=FILE.enc --plaintext-file=FILE
These commands let you generate, rotate, and use customer‑managed encryption keys (CMEK) for Compute Engine disks, Cloud Storage buckets, and BigQuery tables.
Network Security Commands
Firewalls, VPC Service Controls, and Private Service Connect are managed via gcloud compute and gcloud beta network-security commands.
- gcloud compute firewall-rules create RULE_NAME --allow tcp:443 --target-tags web‑server
- gcloud beta network-security per-policy create POLICY_NAME --description="DLP policy"
- gcloud compute networks subnets update SUBNET --private-ip-google-access
Example: Restricting Egress
To block all outbound traffic except to Google APIs:
gcloud compute firewall-rules create deny-egress --direction=EGRESS --action=DENY --priority=1000 --destination-ranges=0.0.0.0/0
Then add an allow rule for the required ranges.
Compliance and Auditing Commands
Cloud Audit Logs capture every security‑related API call. Retrieve logs with:
gcloud logging read "resource.type=\"gce_instance\" AND logName=\"projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Factivity\"" --limit=10
Export logs to BigQuery for long‑term analysis using:
gcloud logging sinks create audit-sink bigquery.googleapis.com/projects/PROJECT_ID/datasets/audit --log-filter="resource.type=\"gce_instance\""
Automation Best Practices
To keep security configurations consistent:
Common Pitfalls and How to Avoid Them
| Pitfall | Impact | Mitigation | |---|---|---| | Over‑granting roles (e.g., using Owner) | Broad attack surface | Apply principle of least privilege; use predefined roles | | Storing service‑account keys locally | Credential leakage | Use workload identity federation; avoid key files | | Ignoring key rotation | Stale keys increase risk | Set automatic rotation in KMS (30‑day default) | | Not testing IAM changes | Unexpected access loss | Run gcloud iam test-permissions in a staging project |
Where to Find Official Documentation
The definitive reference is the Google Cloud SDK documentation site. Key sections include:
- IAM documentation: cloud.google.com/iam/docs
- Cloud KMS guide: cloud.google.com/kms/docs
- Networking security: cloud.google.com/vpc/docs/firewalls
- Audit logging: cloud.google.com/logging/docs/audit