GCP Hardening Lab: Org Policies, IAM and VPC-SC

It teaches how to put preventive controls high in a Google Cloud organization and why: organization policy constraints, disabling service account keys, restricting IAM members to your domain, blocking public Cloud Storage access, wrapping data services in a VPC Service Controls perimeter, trimming roles with the IAM recommender, customer-managed encryption keys, network defaults and central audit logging.

Google documents a dry run mode that lets you monitor requests to protected services without preventing access. Enforcing an untested perimeter can block legitimate pipelines and partner access, so the lab scores dry run first higher than immediate enforcement.

Public access prevention blocks ACLs and IAM grants that make a bucket or its objects public to allUsers and allAuthenticatedUsers. Uniform bucket-level access disables ACLs so only IAM controls access. They solve different problems and are usually used together.

It gives you control of the key, including who can use it and when it is destroyed, but Google documents the trade-off: if the key is disabled or destroyed, or the service agent loses its role, the protected data cannot be accessed, and some services can lose data permanently. The lab scores planning for that above turning CMEK on everywhere.

No. It is a decision lab based on Google Cloud documentation. For a self-assessment across domains, use the GCP Security Checklist, and for the authoritative control list use the CIS Google Cloud Platform Foundation Benchmark itself.