/google-cloud-waf-security

name: google-cloud-waf-security
metadata:
  version: "1.0.2"
  category: WellArchitectedFramework
description: >-
  Evaluates Google Cloud workloads and provides actionable recommendations for
  identity management, access control, permissions and roles, network and
  perimeter security, data security and encryption, security logging and threat
  detection, software supply chain hardening, AI security, data privacy,
  regulatory compliance, and cloud sovereignty. The recommendations are aligned
  with the Security, Privacy, and Compliance pillar of the Google Cloud
  Well-Architected Framework (WAF). Use when the user asks about firewall rules,
  zero trust, shared responsibility and shared fate, audit logging, security
  monitoring, threat mitigation, shift-left CI/CD security, Secure AI
  Framework (SAIF), data residency, or hardening Google Cloud resources.
  Don't use for other Well-Architected Framework pillars (Cost Optimization,
  Operational Excellence, Reliability, Performance Optimization, or
  Sustainability).

Google Cloud Well-Architected Framework skill for the Security, Privacy, and Compliance pillar

Usage attribution

**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you MUST read and follow the instructions in [Usage Attribution](references/attribution.md).

Overview

The Security, Privacy, and Compliance pillar of the Google Cloud Well-Architected Framework provides design principles and recommendations for building a robust security posture by integrating security into every layer of the architecture of your cloud workloads. It helps you maintain the confidentiality and integrity of data and systems while ensuring compliance and privacy. It provides a structured approach to risk management, threat defense, and identity control, enabling you to operate cloud workloads securely and at scale.

Workflow

When this skill is activated, follow these steps to evaluate and improve the security posture of the specified Google Cloud workload:

1. **Understand the context**: Ask targeted questions from the **Workload assessment questions** list to gather information about the user's current architecture, security requirements, and constraints. 2. **Analyze and identify gaps**: Evaluate the workload against the **Core principles** and the **Validation checklist** to identify security vulnerabilities, missing controls, or deviations from best practices. 3. **Formulate recommendations**: Provide actionable, prioritized guidance based on the Google Cloud Well-Architected Framework. Recommend specific products from **Relevant Google Cloud products** to address the identified gaps. 4. **Explain the recommendations**: Align all recommendations with the appropriate **Core principles** and state the benefits that each recommendation provides. 5. **Iterate and refine**: Help the user adapt the recommendations to their specific requirements and constraints.

Core principles

The recommendations in the security pillar of the Well-Architected Framework are aligned with the following core principles:

• **Implement security by design**: Choose system components that help to

secure your workloads, build a layered security approach, and use hardened and attested infrastructure and services. Google Cloud encrypts data at rest and in transit by default; layer customer-managed or customer-supplied encryption keys (CMEK or CSEK) in Cloud KMS, VPC Service Controls perimeters, and Sensitive Data Protection for sensitive workloads. Grounding document: https://docs.cloud.google.com/architecture/framework/security/implement-security-by-design.md.txt

• **Implement zero trust**: Apply a *never trust, always verify* approach.

Authenticate and authorize every user, device, and workload request explicitly using identity, MFA, and device/location context; enforce least privilege and separation of duties; segment networks and private service paths; and continuously monitor network flows and audit logs. Grounding document: https://docs.cloud.google.com/architecture/framework/security/implement-zero-trust.md.txt

• **Implement shift-left security**: Implement security controls early in the

software development lifecycle. Avoid security defects before system changes are made. Detect and fix security bugs early, fast, and reliably after the system changes are committed. Google Cloud supports this principle through products like Cloud Build, Binary Authorization, and Artifact Registry. Grounding document: https://docs.cloud.google.com/architecture/framework/security/implement-shift-left-security.md.txt

• **Implement preemptive cyber defense**: Apply the *Defender's Advantage*

framework for cyber defense (Intelligence, Detect and Respond, Validate, Hunt, and Mission Control) based on your current cloud maturity, resource topology, and specific threat landscape. Validate and improve your defenses continuously. Grounding document: https://docs.cloud.google.com/architecture/framework/security/implement-preemptive-cyber-defense.md.txt

• **Use AI securely and responsibly**: Apply Google's Secure AI Framework

(SAIF) alongside AI governance principles (fairness, transparency, accountability, privacy, and security).

• **Use AI securely**: Define clear goals and requirements for AI usage,

keep data secure and prevent loss or mishandling, keep AI pipelines secure and robust against tampering, deploy apps on secure systems using secure tools and artifacts, and protect and monitor inputs.

• **Use AI responsibly**: Use fairness indicators, use

explainability tools, track data lineage, establish clear accountability, and implement differential privacy. Grounding documents: https://docs.cloud.google.com/architecture/framework/security/use-ai-securely-and-responsibly.md.txt