Skip to main content
Version: Next

Cloud Stroage

  • Is the essential storage service for working with data, especially unstructured data in the cloud
  • Data is durable and strongly consistent
  • Globally available
  • Buckets are containers for Objects
  • The metadata are used for purposes such as access control, compression, encryption, and lifecycle management
  • We can set:
    • Rentention period
    • Versionning
    • Life cycle management

Secure GCS​

Access​

  • IAM
    • It is set at the bucket level and applies uniform access rules to all objects within a bucket
    • Roles
      • Bucket Role Level
        • Reader
        • Writer
        • Owner
        • Set ACL policy
      • Project Role Level
        • Viewer
        • Editor
        • Owner
      • Custom Roles
  • ACL
    • Can be applied at the bucket level or on individual objects, so it provides more fine-grained access control
    • Enabled by default

Encyption​

  • Data encrypted at-rest and transit

  • No way de disabled encryption

  • GMEK (Google Managed Encryption Keys)

    • Is done by Google using encryption keys that we manage, Google-managed encryption keys, or GMEK
    • Hapens in two levels
      • First, the data is encrypted using a data encryption key
      • Then the data encryption key itself is encrypted using a key encryption key, or KEK

  • CMEK (Customer Managed Encryption Keys)

    • You control the creation and the existence of the KEK in Cloud KMS

  • CSEK (Customer Supplied Encryption Keys)

    • You provid the KEK key

Data locking​

  • For audit purposes, you can place a hold on an object, and all operations that could change or delete the object are suspended until the hold is released