IAM policies (Allow, Deny, and conditions)

View the content before continuing.

This exercise is part of the course

Manage Security in Google Cloud

View Course

Hands-on interactive exercise

Turn theory into action with one of our interactive exercises

Start Exercise

This exercise is part of the course

Manage Security in Google Cloud

IntermediateSkill Level

5.0+

1 reviews

Start Course for Free

In this introduction, you'll explore the course goals and preview each section.

Exercise 1: Security in Google Cloud: Series overview

This section of the course introduces Google Cloud's foundational security principles, including the Zero Trust model, the shift from traditional shared responsibility to a modern Shared Fate partnership, the types of infrastructure-level threats mitigated at scale, and the three Pillars of Trust: Access Transparency, Access Approval, and Compliance.

Exercise 1: Module overview Exercise 2: Google's approach: Zero trust Exercise 3: Shared Fate Exercise 4: Threats mitigated by Google's infrastructure Exercise 5: The pillars of trust Exercise 6: Module review Exercise 7: Quiz — Question 1 Exercise 8: Quiz — Question 2 Exercise 9: Quiz — Question 3 Exercise 10: Quiz — Question 4

This section of the course covers configuring Google Cloud identity services to manage workforce access, including Cloud Identity editions, user synchronization via GCDS and Single Sign-On (SSO), and syncless authentication through Workforce Identity Federation. You will also explore Managed Service for Microsoft Active Directory, user and group management, and critical authentication best practices like Multi-Factor Authentication (MFA).

Exercise 1: Module overview Exercise 2: Cloud Identity unpacked Exercise 3: Connecting on-prem: User provisioning + SSO Exercise 4: Connecting on-prem: Workforce Identity Federation Exercise 5: Managed Service for Microsoft AD Exercise 6: Authentication best practices (MFA & keys)Exercise 7: Defining users and groups Exercise 8: Module review Exercise 9: Quiz — Question 1 Exercise 10: Quiz — Question 2 Exercise 11: Quiz — Question 3

Master Google Cloud's fundamental security perimeter through Identity and Access Management (IAM) and resource hierarchy governance. In this module, you will configure basic, predefined, and custom roles, and apply context-aware IAM Conditions. You will evaluate the differences between IAM Allow/Deny policies and governance-focused Organization Policies. Finally, you will leverage Policy Intelligence tools—Troubleshooter, Analyzer, Recommender, and Simulator—to diagnose access, test changes, and strictly enforce the principle of least privilege.

Exercise 1: Module overview Exercise 2: Resource Manager Exercise 3: IAM roles and conditions Exercise 4: Service accounts Exercise 5: Workload Identity Federation Exercise 6: IAM policies (Allow, Deny, and conditions)

Current Exercise

Exercise 7: Organization policies Exercise 8: Troubleshooting and analyzing IAM policies Exercise 9: Proactively improving IAM Exercise 10: The IAM best practices checklist Exercise 11: Google Cloud IAM: Implementing Least Privilege Exercise 12: Module review Exercise 13: Quiz — Question 1 Exercise 14: Quiz — Question 2 Exercise 15: Quiz — Question 3 Exercise 16: Quiz — Question 4 Exercise 17: Quiz — Question 5

This module focuses on securing your cloud network perimeter and protecting data in transit. You will explore how to design secure, isolated Virtual Private Cloud (VPC) architectures and control traffic flow using Cloud Next-Generation Firewall (NGFW) policies. The module also covers building a Zero-Trust perimeter to prevent data exfiltration and setting up private access pathways for secure application connectivity. Finally, you will learn how to actively monitor your environment and use advanced threat protection tools to detect and respond to network-level risks.

Exercise 1: Module overview Exercise 2: VPC network security foundations Exercise 3: Cloud Next Generation Firewall (NGFW)Exercise 4: VPC connectivity options Exercise 5: Private Google Access Exercise 6: Implementing a zero-trust perimeter Exercise 7: Network monitoring (VPC Flow Logs)Exercise 8: Advanced threat protection (IDPS, IDS, & DNS security)Exercise 9: Configuring Cloud NGFW Firewalls Exercise 10: Working with VPC Flow Logs Exercise 11: Implement Advanced Threat Protection Exercise 12: Module review Exercise 13: Quiz — Question 1 Exercise 14: Quiz — Question 2 Exercise 15: Quiz — Question 3 Exercise 16: Quiz — Question 4

Course resources

Exercise 1: Course summary