Security Operations - GCP Professional Cloud Security Engineer¶

# Enable Data Access logs for a project
gcloud logging sinks create data-access-logs \
  bigquery.googleapis.com/projects/PROJECT_ID/datasets/audit_logs \
  --log-filter='logName:"cloudaudit.googleapis.com%2Fdata_access"'

# View Admin Activity logs
gcloud logging read "logName:cloudaudit.googleapis.com%2Factivity" \
  --limit 50 \
  --format json

# View Policy Denied logs
gcloud logging read "logName:cloudaudit.googleapis.com%2Fpolicy" \
  --project=PROJECT_ID \
  --freshness=7d

# Export specific audit logs to Cloud Storage
gcloud logging sinks create security-logs-bucket \
  storage.googleapis.com/security-audit-logs-bucket \
  --log-filter='protoPayload.@type="type.googleapis.com/google.cloud.audit.AuditLog" AND severity>=ERROR'

# Create log sink for BigQuery analysis
gcloud logging sinks create audit-logs-bq \
  bigquery.googleapis.com/projects/PROJECT_ID/datasets/security_logs \
  --log-filter='logName:("cloudaudit.googleapis.com" OR "securitycenter.googleapis.com")'

# Create log-based metric for failed SSH attempts
gcloud logging metrics create failed_ssh_attempts \
  --description="Count of failed SSH login attempts" \
  --log-filter='resource.type="gce_instance"
    AND logName="projects/PROJECT_ID/logs/syslog"
    AND textPayload=~"Failed password for"'

# Create metric for privilege escalation
gcloud logging metrics create privilege_escalation \
  --description="IAM policy changes granting admin roles" \
  --log-filter='protoPayload.methodName="SetIamPolicy"
    AND protoPayload.serviceData.policyDelta.bindingDeltas.role=~"roles/.*admin"
    AND protoPayload.serviceData.policyDelta.bindingDeltas.action="ADD"'

# Create metric for firewall rule changes
gcloud logging metrics create firewall_changes \
  --description="VPC firewall rule modifications" \
  --log-filter='resource.type="gce_firewall_rule"
    AND (protoPayload.methodName="v1.compute.firewalls.insert"
      OR protoPayload.methodName="v1.compute.firewalls.patch"
      OR protoPayload.methodName="v1.compute.firewalls.delete")'

# Create metric for sensitive data access
gcloud logging metrics create sensitive_data_access \
  --description="Access to buckets containing sensitive data" \
  --log-filter='resource.type="gcs_bucket"
    AND protoPayload.resourceName=~".*sensitive.*"
    AND protoPayload.methodName="storage.objects.get"'

# List all log-based metrics
gcloud logging metrics list

# Update an existing metric
gcloud logging metrics update failed_ssh_attempts \
  --description="Updated description for failed SSH attempts"

# Delete a metric
gcloud logging metrics delete old_metric_name

# Create alerting policy for failed authentication
cat > failed-auth-policy.yaml <<EOF
displayName: "Multiple Failed Authentication Attempts"
conditions:
  - displayName: "Failed auth threshold exceeded"
    conditionThreshold:
      filter: 'metric.type="logging.googleapis.com/user/failed_ssh_attempts" resource.type="gce_instance"'
      comparison: COMPARISON_GT
      thresholdValue: 10
      duration: 300s
      aggregations:
        - alignmentPeriod: 60s
          perSeriesAligner: ALIGN_RATE
notificationChannels:
  - projects/PROJECT_ID/notificationChannels/CHANNEL_ID
alertStrategy:
  autoClose: 604800s
documentation:
  content: "Multiple failed SSH authentication attempts detected. Potential brute force attack. Investigate source IPs and consider blocking."
  mimeType: text/markdown
enabled: true
EOF

gcloud alpha monitoring policies create --policy-from-file=failed-auth-policy.yaml

# Create policy for privilege escalation
cat > privilege-escalation-policy.yaml <<EOF
displayName: "Privilege Escalation Detected"
conditions:
  - displayName: "Admin role granted"
    conditionThreshold:
      filter: 'metric.type="logging.googleapis.com/user/privilege_escalation" resource.type="audited_resource"'
      comparison: COMPARISON_GT
      thresholdValue: 0
      duration: 60s
notificationChannels:
  - projects/PROJECT_ID/notificationChannels/EMAIL_CHANNEL
  - projects/PROJECT_ID/notificationChannels/PAGERDUTY_CHANNEL
alertStrategy:
  autoClose: 86400s
  notificationRateLimit:
    period: 300s
documentation:
  content: |
    # Privilege Escalation Alert

    An admin role has been granted. Immediate investigation required:
    1. Verify the principal who made the change
    2. Check if the change was authorized
    3. Review the scope of permissions granted
    4. Consider revoking if unauthorized
  mimeType: text/markdown
severity: CRITICAL
enabled: true
EOF

gcloud alpha monitoring policies create --policy-from-file=privilege-escalation-policy.yaml

# Create notification channel
gcloud alpha monitoring channels create \
  --display-name="Security Team Email" \
  --type=email \
  --channel-labels=email_address=security@example.com

gcloud alpha monitoring channels create \
  --display-name="Security PagerDuty" \
  --type=pagerduty \
  --channel-labels=service_key=YOUR_PAGERDUTY_KEY

# List all alerting policies
gcloud alpha monitoring policies list

# Update alerting policy
gcloud alpha monitoring policies update POLICY_ID \
  --update-notification-channels=projects/PROJECT_ID/notificationChannels/NEW_CHANNEL

# Delete alerting policy
gcloud alpha monitoring policies delete POLICY_ID

# Create sink to route all audit logs to BigQuery
gcloud logging sinks create all-audit-logs-bq \
  bigquery.googleapis.com/projects/PROJECT_ID/datasets/audit_logs \
  --log-filter='logName:cloudaudit.googleapis.com'

# Create sink for security-critical logs to Cloud Storage
gcloud logging sinks create security-critical-logs \
  storage.googleapis.com/security-logs-archive \
  --log-filter='severity>=ERROR OR logName:cloudaudit.googleapis.com'

# Create sink to route logs to Pub/Sub for real-time processing
gcloud logging sinks create realtime-security-events \
  pubsub.googleapis.com/projects/PROJECT_ID/topics/security-events \
  --log-filter='protoPayload.methodName=~".*delete.*" OR severity=CRITICAL'

# Create organization-level sink
gcloud logging sinks create org-wide-security-logs \
  bigquery.googleapis.com/projects/CENTRAL_PROJECT/datasets/org_security_logs \
  --organization=ORG_ID \
  --include-children \
  --log-filter='logName:cloudaudit.googleapis.com OR logName:securitycenter.googleapis.com'

# Create folder-level sink
gcloud logging sinks create folder-audit-logs \
  storage.googleapis.com/folder-audit-logs \
  --folder=FOLDER_ID \
  --include-children \
  --log-filter='logName:cloudaudit.googleapis.com'

# Update sink filter
gcloud logging sinks update all-audit-logs-bq \
  --log-filter='logName:cloudaudit.googleapis.com AND severity>=WARNING'

# Grant sink service account permissions
# Get the sink's service account
SINK_SA=$(gcloud logging sinks describe all-audit-logs-bq --format='value(writerIdentity)')

# Grant BigQuery Data Editor role
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="$SINK_SA" \
  --role="roles/bigquery.dataEditor"

# List all sinks
gcloud logging sinks list

# Delete sink
gcloud logging sinks delete old-sink-name

# Create email notification channel
gcloud alpha monitoring channels create \
  --display-name="Security Team" \
  --type=email \
  --channel-labels=email_address=security-team@example.com \
  --enabled

# Create Slack notification channel
gcloud alpha monitoring channels create \
  --display-name="Security Slack" \
  --type=slack \
  --channel-labels=url=https://hooks.slack.com/services/YOUR/WEBHOOK/URL

# Create PagerDuty notification channel
gcloud alpha monitoring channels create \
  --display-name="Security On-Call" \
  --type=pagerduty \
  --channel-labels=service_key=YOUR_PAGERDUTY_SERVICE_KEY

# Create webhook notification channel
gcloud alpha monitoring channels create \
  --display-name="Security Webhook" \
  --type=webhook_tokenauth \
  --channel-labels=url=https://your-webhook-endpoint.com/alerts

# Create SMS notification channel
gcloud alpha monitoring channels create \
  --display-name="Security SMS" \
  --type=sms \
  --channel-labels=number=+15551234567

# List all notification channels
gcloud alpha monitoring channels list

# Describe a specific channel
gcloud alpha monitoring channels describe CHANNEL_ID

# Update notification channel
gcloud alpha monitoring channels update CHANNEL_ID \
  --update-channel-labels=email_address=new-security@example.com

# Delete notification channel
gcloud alpha monitoring channels delete CHANNEL_ID

# Enable Security Command Center API
gcloud services enable securitycenter.googleapis.com

# List all assets in organization
gcloud scc assets list ORGANIZATION_ID \
  --format="table(asset.securityCenterProperties.resourceName,asset.securityCenterProperties.resourceType,asset.createTime)"

# List assets of specific type
gcloud scc assets list ORGANIZATION_ID \
  --filter="securityCenterProperties.resourceType=\"google.compute.Instance\""

# List assets with specific security marks
gcloud scc assets list ORGANIZATION_ID \
  --filter="securityMarks.marks.environment=\"production\""

# Search for assets by project
gcloud scc assets list ORGANIZATION_ID \
  --filter="securityCenterProperties.resourceParent=\"//cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER\""

# Export assets to BigQuery
gcloud scc assets list ORGANIZATION_ID \
  --format=json > assets-export.json

# Count assets by type
gcloud scc assets list ORGANIZATION_ID \
  --format="value(asset.securityCenterProperties.resourceType)" | \
  sort | uniq -c | sort -rn

# Add security marks to an asset
gcloud scc assets update-marks ASSET_NAME \
  --organization=ORGANIZATION_ID \
  --security-marks="environment=production,data-classification=confidential,owner=security-team"

# Add marks to a finding
gcloud scc findings update-marks FINDING_NAME \
  --organization=ORGANIZATION_ID \
  --security-marks="false-positive=true,ticket=JIRA-123"

# List assets with specific marks
gcloud scc assets list ORGANIZATION_ID \
  --filter="securityMarks.marks.environment=\"production\" AND securityMarks.marks.data-classification=\"confidential\""

# Remove specific security marks
gcloud scc assets update-marks ASSET_NAME \
  --organization=ORGANIZATION_ID \
  --update-mask="marks.environment" \
  --security-marks=""

# Bulk update security marks using script
for asset in $(gcloud scc assets list ORG_ID --filter="resourceType:Instance" --format="value(name)"); do
  gcloud scc assets update-marks $asset \
    --organization=ORG_ID \
    --security-marks="auto-tagged=true,scan-date=$(date +%Y-%m-%d)"
done

# List all active findings
gcloud scc findings list ORGANIZATION_ID \
  --filter="state=\"ACTIVE\"" \
  --format="table(finding.category,finding.severity,finding.resourceName)"

# List high and critical severity findings
gcloud scc findings list ORGANIZATION_ID \
  --filter="state=\"ACTIVE\" AND (severity=\"HIGH\" OR severity=\"CRITICAL\")"

# List findings for specific category
gcloud scc findings list ORGANIZATION_ID \
  --filter="category=\"OPEN_FIREWALL\""

# List findings for specific project
gcloud scc findings list ORGANIZATION_ID \
  --filter="resourceName:\"projects/PROJECT_ID\""

# Update finding state
gcloud scc findings update FINDING_NAME \
  --organization=ORGANIZATION_ID \
  --state=INACTIVE

# Set finding as false positive
gcloud scc findings update-marks FINDING_NAME \
  --organization=ORGANIZATION_ID \
  --security-marks="false-positive=true,reviewed-by=analyst@example.com,review-date=$(date +%Y-%m-%d)"

# Create custom finding
gcloud scc findings create FINDING_ID \
  --organization=ORGANIZATION_ID \
  --source=SOURCE_NAME \
  --category="CUSTOM_SECURITY_ISSUE" \
  --state=ACTIVE \
  --resource-name="//compute.googleapis.com/projects/PROJECT/zones/us-central1-a/instances/instance-1" \
  --event-time="2024-01-01T12:00:00Z" \
  --severity=HIGH

# Export findings to file
gcloud scc findings list ORGANIZATION_ID \
  --filter="state=\"ACTIVE\"" \
  --format=json > active-findings.json

# Group findings by category
gcloud scc findings list ORGANIZATION_ID \
  --format="value(finding.category)" | \
  sort | uniq -c | sort -rn

# List all Security Health Analytics findings
gcloud scc findings list ORGANIZATION_ID \
  --source=ORGANIZATION_ID/sources/SECURITY_HEALTH_ANALYTICS_SOURCE_ID

# List open firewall findings
gcloud scc findings list ORGANIZATION_ID \
  --filter="category=\"OPEN_FIREWALL\" AND state=\"ACTIVE\"" \
  --format="table(finding.resourceName,finding.externalUri,finding.category)"

# List publicly accessible resources
gcloud scc findings list ORGANIZATION_ID \
  --filter="(category=\"PUBLIC_BUCKET_ACL\" OR category=\"PUBLIC_IP_ADDRESS\") AND state=\"ACTIVE\""

# List weak SSL policy findings
gcloud scc findings list ORGANIZATION_ID \
  --filter="category=\"WEAK_SSL_POLICY\" AND state=\"ACTIVE\""

# Enable custom modules (Premium tier)
gcloud scc custom-modules sha create \
  --organization=ORGANIZATION_ID \
  --display-name="Check for unencrypted disks" \
  --enablement-state=ENABLED \
  --custom-config-from-file=custom-config.yaml

# List Event Threat Detection findings
gcloud scc findings list ORGANIZATION_ID \
  --source=ORGANIZATION_ID/sources/EVENT_THREAT_DETECTION_SOURCE_ID

# List malware-related findings
gcloud scc findings list ORGANIZATION_ID \
  --filter="category=\"Malware:*\" AND state=\"ACTIVE\"" \
  --format="table(finding.category,finding.resourceName,finding.severity)"

# List data exfiltration findings
gcloud scc findings list ORGANIZATION_ID \
  --filter="category=\"Exfiltration:*\" AND state=\"ACTIVE\""

# List persistence mechanism findings
gcloud scc findings list ORGANIZATION_ID \
  --filter="category=\"Persistence:*\" AND state=\"ACTIVE\""

# List findings by severity
gcloud scc findings list ORGANIZATION_ID \
  --filter="severity=\"CRITICAL\" AND state=\"ACTIVE\"" \
  --format="table(finding.category,finding.resourceName,finding.eventTime)"

# Configure Event Threat Detection settings
gcloud scc settings services enable \
  --organization=ORGANIZATION_ID \
  --service=EVENT_THREAT_DETECTION

# Disable specific detectors
gcloud scc settings services update \
  --organization=ORGANIZATION_ID \
  --service=EVENT_THREAT_DETECTION \
  --detector=MALWARE_BAD_DOMAIN \
  --enabled=false

# List all sources
gcloud scc sources list ORGANIZATION_ID

# Describe a specific source
gcloud scc sources describe SOURCE_NAME \
  --organization=ORGANIZATION_ID

# Create custom source
gcloud scc sources create \
  --organization=ORGANIZATION_ID \
  --display-name="Custom Security Scanner" \
  --description="Internal security scanning tool"

# Update source
gcloud scc sources update SOURCE_NAME \
  --organization=ORGANIZATION_ID \
  --display-name="Updated Scanner Name"

# Get IAM policy for source
gcloud scc sources get-iam-policy SOURCE_NAME \
  --organization=ORGANIZATION_ID

# Grant source editor role
gcloud scc sources add-iam-policy-binding SOURCE_NAME \
  --organization=ORGANIZATION_ID \
  --member="serviceAccount:scanner@project.iam.gserviceaccount.com" \
  --role="roles/securitycenter.findingsEditor"

# Create notification config for critical findings
gcloud scc notifications create critical-findings-notif \
  --organization=ORGANIZATION_ID \
  --description="Notify on critical findings" \
  --pubsub-topic=projects/PROJECT_ID/topics/scc-critical-findings \
  --filter="severity=\"CRITICAL\" AND state=\"ACTIVE\""

# Create notification for specific category
gcloud scc notifications create firewall-notif \
  --organization=ORGANIZATION_ID \
  --description="Notify on open firewall findings" \
  --pubsub-topic=projects/PROJECT_ID/topics/scc-firewall \
  --filter="category=\"OPEN_FIREWALL\" AND state=\"ACTIVE\""

# List all notification configs
gcloud scc notifications list ORGANIZATION_ID

# Update notification config
gcloud scc notifications update critical-findings-notif \
  --organization=ORGANIZATION_ID \
  --filter="severity=\"CRITICAL\" OR severity=\"HIGH\""

# Delete notification config
gcloud scc notifications delete critical-findings-notif \
  --organization=ORGANIZATION_ID

# Test notification by creating test finding
gcloud scc findings create test-finding-$(date +%s) \
  --organization=ORGANIZATION_ID \
  --source=SOURCE_NAME \
  --category="TEST_FINDING" \
  --severity=CRITICAL \
  --state=ACTIVE

# Create a basic security policy
gcloud compute security-policies create web-app-policy \
  --description="Security policy for web application"

# Create policy with default rule action
gcloud compute security-policies create block-by-default \
  --description="Default deny policy" \
  --default-rule-action=deny-403

# List all security policies
gcloud compute security-policies list

# Describe a security policy
gcloud compute security-policies describe web-app-policy

# Update policy description
gcloud compute security-policies update web-app-policy \
  --description="Updated security policy"

# Delete security policy
gcloud compute security-policies delete web-app-policy

# Add SQLi (SQL Injection) protection rule
gcloud compute security-policies rules create 1000 \
  --security-policy=web-app-policy \
  --expression="evaluatePreconfiguredExpr('sqli-stable')" \
  --action=deny-403 \
  --description="Block SQL injection attempts"

# Add XSS (Cross-Site Scripting) protection
gcloud compute security-policies rules create 1001 \
  --security-policy=web-app-policy \
  --expression="evaluatePreconfiguredExpr('xss-stable')" \
  --action=deny-403 \
  --description="Block XSS attempts"

# Add LFI (Local File Inclusion) protection
gcloud compute security-policies rules create 1002 \
  --security-policy=web-app-policy \
  --expression="evaluatePreconfiguredExpr('lfi-stable')" \
  --action=deny-403 \
  --description="Block LFI attempts"

# Add RCE (Remote Code Execution) protection
gcloud compute security-policies rules create 1003 \
  --security-policy=web-app-policy \
  --expression="evaluatePreconfiguredExpr('rce-stable')" \
  --action=deny-403 \
  --description="Block RCE attempts"

# Add RFI (Remote File Inclusion) protection
gcloud compute security-policies rules create 1004 \
  --security-policy=web-app-policy \
  --expression="evaluatePreconfiguredExpr('rfi-stable')" \
  --action=deny-403 \
  --description="Block RFI attempts"

# Add method enforcement (block non-standard HTTP methods)
gcloud compute security-policies rules create 1005 \
  --security-policy=web-app-policy \
  --expression="evaluatePreconfiguredExpr('methodenforcement-stable')" \
  --action=deny-403 \
  --description="Block non-standard HTTP methods"

# Add scanner detection
gcloud compute security-policies rules create 1006 \
  --security-policy=web-app-policy \
  --expression="evaluatePreconfiguredExpr('scannerdetection-stable')" \
  --action=deny-403 \
  --description="Block security scanners"

# Add protocol attack protection
gcloud compute security-policies rules create 1007 \
  --security-policy=web-app-policy \
  --expression="evaluatePreconfiguredExpr('protocolattack-stable')" \
  --action=deny-403 \
  --description="Block protocol attacks"

# Add PHP injection protection
gcloud compute security-policies rules create 1008 \
  --security-policy=web-app-policy \
  --expression="evaluatePreconfiguredExpr('php-stable')" \
  --action=deny-403 \
  --description="Block PHP injection attempts"

# Add session fixation protection
gcloud compute security-policies rules create 1009 \
  --security-policy=web-app-policy \
  --expression="evaluatePreconfiguredExpr('sessionfixation-stable')" \
  --action=deny-403 \
  --description="Block session fixation attempts"

# Block specific IP address
gcloud compute security-policies rules create 2000 \
  --security-policy=web-app-policy \
  --expression="origin.ip == '203.0.113.10'" \
  --action=deny-403 \
  --description="Block malicious IP"

# Block IP range
gcloud compute security-policies rules create 2001 \
  --security-policy=web-app-policy \
  --expression="inIpRange(origin.ip, '203.0.113.0/24')" \
  --action=deny-403 \
  --description="Block suspicious IP range"

# Allow only specific countries (geo-blocking)
gcloud compute security-policies rules create 2002 \
  --security-policy=web-app-policy \
  --expression="origin.region_code != 'US' && origin.region_code != 'CA'" \
  --action=deny-403 \
  --description="Allow only US and Canada"

# Block specific user agents
gcloud compute security-policies rules create 2003 \
  --security-policy=web-app-policy \
  --expression="has(request.headers['user-agent']) && request.headers['user-agent'].contains('BadBot')" \
  --action=deny-403 \
  --description="Block known bad bots"

# Block requests without referer header
gcloud compute security-policies rules create 2004 \
  --security-policy=web-app-policy \
  --expression="!has(request.headers['referer'])" \
  --action=deny-403 \
  --description="Block requests without referer"

# Allow only specific paths
gcloud compute security-policies rules create 2005 \
  --security-policy=web-app-policy \
  --expression="!request.path.matches('/api/.*') && !request.path.matches('/public/.*')" \
  --action=deny-403 \
  --description="Block access to non-public paths"

# Rate limit by IP
gcloud compute security-policies rules create 2006 \
  --security-policy=web-app-policy \
  --expression="true" \
  --action=rate-based-ban \
  --rate-limit-threshold-count=100 \
  --rate-limit-threshold-interval-sec=60 \
  --ban-duration-sec=600 \
  --conform-action=allow \
  --exceed-action=deny-429 \
  --enforce-on-key=IP \
  --description="Rate limit: 100 requests per minute per IP"

# Combine multiple conditions
gcloud compute security-policies rules create 2007 \
  --security-policy=web-app-policy \
  --expression="origin.region_code == 'CN' && request.path.matches('/admin/.*')" \
  --action=deny-403 \
  --description="Block admin access from specific regions"

# Preview mode (log only, don't block)
gcloud compute security-policies rules create 2008 \
  --security-policy=web-app-policy \
  --expression="evaluatePreconfiguredExpr('sqli-stable')" \
  --action=deny-403 \
  --preview \
  --description="SQLi protection in preview mode"

# Rate limit by IP address
gcloud compute security-policies rules create 3000 \
  --security-policy=web-app-policy \
  --action=rate-based-ban \
  --rate-limit-threshold-count=1000 \
  --rate-limit-threshold-interval-sec=60 \
  --ban-duration-sec=600 \
  --conform-action=allow \
  --exceed-action=deny-429 \
  --enforce-on-key=IP \
  --description="Limit to 1000 req/min per IP"

# Rate limit by HTTP header
gcloud compute security-policies rules create 3001 \
  --security-policy=web-app-policy \
  --action=rate-based-ban \
  --rate-limit-threshold-count=100 \
  --rate-limit-threshold-interval-sec=60 \
  --ban-duration-sec=300 \
  --conform-action=allow \
  --exceed-action=deny-429 \
  --enforce-on-key=HTTP-HEADER \
  --enforce-on-key-name=X-API-Key \
  --description="Limit to 100 req/min per API key"

# Rate limit by user ID (from header)
gcloud compute security-policies rules create 3002 \
  --security-policy=web-app-policy \
  --action=rate-based-ban \
  --rate-limit-threshold-count=500 \
  --rate-limit-threshold-interval-sec=60 \
  --ban-duration-sec=600 \
  --conform-action=allow \
  --exceed-action=deny-429 \
  --enforce-on-key=HTTP-HEADER \
  --enforce-on-key-name=X-User-ID \
  --description="Limit to 500 req/min per user"

# Rate limit with custom ban threshold
gcloud compute security-policies rules create 3003 \
  --security-policy=web-app-policy \
  --action=rate-based-ban \
  --rate-limit-threshold-count=50 \
  --rate-limit-threshold-interval-sec=10 \
  --ban-duration-sec=1800 \
  --ban-threshold-count=5 \
  --ban-threshold-interval-sec=60 \
  --conform-action=allow \
  --exceed-action=deny-429 \
  --enforce-on-key=IP \
  --description="Ban after 5 violations in 60 seconds"

# Global rate limit (all traffic)
gcloud compute security-policies rules create 3004 \
  --security-policy=web-app-policy \
  --action=rate-based-ban \
  --rate-limit-threshold-count=10000 \
  --rate-limit-threshold-interval-sec=60 \
  --conform-action=allow \
  --exceed-action=deny-503 \
  --enforce-on-key=ALL \
  --description="Global rate limit: 10k req/min"

# Enable Adaptive Protection (auto-deploy rules based on ML)
gcloud compute security-policies update web-app-policy \
  --enable-layer7-ddos-defense \
  --layer7-ddos-defense-rule-visibility=STANDARD

# Set Adaptive Protection to premium
gcloud compute security-policies update web-app-policy \
  --enable-layer7-ddos-defense \
  --layer7-ddos-defense-rule-visibility=PREMIUM

# Disable Adaptive Protection
gcloud compute security-policies update web-app-policy \
  --no-enable-layer7-ddos-defense

# Configure alert threshold
gcloud compute security-policies update web-app-policy \
  --layer7-ddos-defense-threshold-count=100 \
  --layer7-ddos-defense-threshold-interval-sec=60

# Enable reCAPTCHA Enterprise integration
gcloud compute security-policies rules create 4000 \
  --security-policy=web-app-policy \
  --expression="!has(token.recaptcha_session) || token.recaptcha_session.score < 0.5" \
  --action=deny-403 \
  --description="Challenge low-score reCAPTCHA requests"

# Redirect to reCAPTCHA challenge
gcloud compute security-policies rules create 4001 \
  --security-policy=web-app-policy \
  --expression="evaluatePreconfiguredExpr('scannerdetection-stable')" \
  --action=redirect \
  --redirect-type=GOOGLE_RECAPTCHA \
  --description="Challenge suspected bots"

# Set reCAPTCHA site key
gcloud compute security-policies update web-app-policy \
  --recaptcha-site-key=SITE_KEY

# Attach security policy to backend service
gcloud compute backend-services update BACKEND_SERVICE \
  --security-policy=web-app-policy \
  --global

# Attach policy to backend bucket
gcloud compute backend-buckets update BACKEND_BUCKET \
  --security-policy=web-app-policy

# Remove security policy
gcloud compute backend-services update BACKEND_SERVICE \
  --security-policy="" \
  --global

# List backend services with security policies
gcloud compute backend-services list \
  --format="table(name,securityPolicy)"

# List all rules in policy
gcloud compute security-policies rules describe 1000 \
  --security-policy=web-app-policy

# Update rule priority
gcloud compute security-policies rules update 1000 \
  --security-policy=web-app-policy \
  --priority=900

# Update rule expression
gcloud compute security-policies rules update 2000 \
  --security-policy=web-app-policy \
  --expression="origin.ip == '203.0.113.10' || origin.ip == '203.0.113.11'"

# Enable preview mode on rule
gcloud compute security-policies rules update 1000 \
  --security-policy=web-app-policy \
  --preview

# Disable preview mode
gcloud compute security-policies rules update 1000 \
  --security-policy=web-app-policy \
  --no-preview

# Delete rule
gcloud compute security-policies rules delete 1000 \
  --security-policy=web-app-policy

# Export policy configuration
gcloud compute security-policies export web-app-policy \
  --destination=policy-backup.yaml

# Import policy configuration
gcloud compute security-policies import web-app-policy \
  --source=policy-backup.yaml

# Monitor for security alerts in real-time
gcloud logging read "severity>=ERROR AND logName:cloudaudit" \
  --format=json \
  --freshness=5m

# Set up real-time log streaming
gcloud logging tail "severity>=WARNING" --format=json

# Query for suspicious activities
gcloud logging read '
  protoPayload.methodName=~".*delete.*" OR
  protoPayload.methodName="SetIamPolicy" OR
  protoPayload.methodName="CreateServiceAccountKey"
' --limit=100 --format=json

# Check Security Command Center for active findings
gcloud scc findings list ORGANIZATION_ID \
  --filter="state=\"ACTIVE\" AND severity=\"CRITICAL\""

# Monitor Cloud Armor logs for attacks
gcloud logging read 'resource.type="http_load_balancer" AND jsonPayload.enforcedSecurityPolicy.name!=""' \
  --limit=100 \
  --format=json

# Investigate user activity during incident window
gcloud logging read '
  protoPayload.authenticationInfo.principalEmail="suspicious-user@example.com"
  AND timestamp>="2024-01-01T10:00:00Z"
  AND timestamp<="2024-01-01T12:00:00Z"
' --format=json --limit=1000

# Trace specific resource changes
gcloud logging read '
  protoPayload.resourceName="//compute.googleapis.com/projects/PROJECT/zones/us-central1-a/instances/compromised-instance"
' --format=json

# Investigate IAM policy changes
gcloud logging read '
  protoPayload.methodName="SetIamPolicy"
  AND timestamp>="2024-01-01T00:00:00Z"
' --format=json

# Find all actions from specific IP
gcloud logging read '
  httpRequest.remoteIp="203.0.113.10"
  AND timestamp>="2024-01-01T00:00:00Z"
' --format=json

# Export comprehensive investigation logs
gcloud logging read '
  timestamp>="2024-01-01T00:00:00Z"
  AND timestamp<="2024-01-02T00:00:00Z"
  AND (severity>=WARNING OR logName:cloudaudit)
' --format=json > incident-investigation.json

# 1. Isolate compromised instance - Remove from backend service
gcloud compute backend-services remove-backend BACKEND_SERVICE \
  --instance-group=INSTANCE_GROUP \
  --instance-group-zone=ZONE \
  --global

# 2. Apply emergency firewall rule to block traffic
gcloud compute firewall-rules create emergency-block-$(date +%s) \
  --direction=INGRESS \
  --priority=100 \
  --network=default \
  --action=DENY \
  --rules=all \
  --source-ranges=0.0.0.0/0 \
  --target-tags=compromised

# Tag the compromised instance
gcloud compute instances add-tags INSTANCE_NAME \
  --zone=ZONE \
  --tags=compromised

# 3. Disable compromised service account
gcloud iam service-accounts disable SERVICE_ACCOUNT_EMAIL

# 4. Delete service account keys
for key in $(gcloud iam service-accounts keys list --iam-account=SERVICE_ACCOUNT_EMAIL --format="value(name)"); do
  gcloud iam service-accounts keys delete $key --iam-account=SERVICE_ACCOUNT_EMAIL --quiet
done

# 5. Revoke IAM permissions immediately
gcloud projects remove-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:SERVICE_ACCOUNT_EMAIL" \
  --role="roles/editor"

# 6. Stop compromised instance (preserve for forensics)
gcloud compute instances stop INSTANCE_NAME --zone=ZONE

# 7. Remove external IP address
gcloud compute instances delete-access-config INSTANCE_NAME \
  --zone=ZONE \
  --access-config-name="external-nat"

# 8. Update VPC firewall to restrict access
gcloud compute firewall-rules update FIREWALL_RULE \
  --source-ranges=10.0.0.0/8 \
  --disabled

# 9. Suspend user account
gcloud identity users update USER_EMAIL --suspended

# 10. Revoke all user sessions
gcloud identity users signout USER_EMAIL

# Create disk snapshot for forensic analysis
gcloud compute disks snapshot DISK_NAME \
  --snapshot-names=forensic-snapshot-$(date +%Y%m%d-%H%M%S) \
  --zone=ZONE \
  --storage-location=US

# Create snapshot with forensic labels
gcloud compute disks snapshot DISK_NAME \
  --snapshot-names=forensic-snapshot-incident-12345 \
  --zone=ZONE \
  --labels=incident=12345,collected-by=security-team,date=$(date +%Y%m%d)

# Clone disk for offline analysis
gcloud compute disks create forensic-disk-copy \
  --source-snapshot=forensic-snapshot-incident-12345 \
  --zone=us-central1-a

# Create isolated forensic analysis instance
gcloud compute instances create forensic-workstation \
  --zone=us-central1-a \
  --machine-type=n2-standard-8 \
  --network=forensics-network \
  --no-address \
  --disk=name=forensic-disk-copy,mode=ro,boot=no

# Export memory dump (requires instance access)
gcloud compute ssh INSTANCE_NAME --zone=ZONE \
  --command="sudo dd if=/dev/mem of=/tmp/memory-dump.bin bs=1M"

# Export logs for specific time window
gcloud logging read "timestamp>=\"2024-01-01T00:00:00Z\" AND timestamp<=\"2024-01-02T00:00:00Z\"" \
  --format=json \
  --project=PROJECT_ID > forensic-logs-$(date +%Y%m%d).json

# Export audit logs to Cloud Storage for long-term retention
gcloud logging sinks create forensic-evidence-sink \
  storage.googleapis.com/forensic-evidence-bucket \
  --log-filter='timestamp>="2024-01-01T00:00:00Z" AND logName:cloudaudit'

# Capture network traffic logs (VPC Flow Logs)
gcloud logging read 'resource.type="gce_subnetwork" AND logName:vpc_flows' \
  --format=json > network-flows-$(date +%Y%m%d).json

# Export Security Command Center findings
gcloud scc findings list ORGANIZATION_ID \
  --filter="eventTime>=\"2024-01-01T00:00:00Z\"" \
  --format=json > scc-findings-$(date +%Y%m%d).json

# Create forensic image export (requires Boot Disk)
gcloud compute images create forensic-image-$(date +%Y%m%d) \
  --source-disk=DISK_NAME \
  --source-disk-zone=ZONE \
  --family=forensic-images

# Export image to Cloud Storage
gcloud compute images export \
  --destination-uri=gs://forensic-evidence-bucket/forensic-image-$(date +%Y%m%d).tar.gz \
  --image=forensic-image-$(date +%Y%m%d)

# 1. Deploy clean replacement instance from trusted image
gcloud compute instances create replacement-instance \
  --image=trusted-golden-image \
  --image-project=PROJECT_ID \
  --zone=us-central1-a

# 2. Restore from clean backup
gcloud compute disks create restored-disk \
  --source-snapshot=pre-incident-backup-snapshot \
  --zone=us-central1-a

# 3. Update firewall rules to normal state
gcloud compute firewall-rules update production-firewall \
  --enabled

gcloud compute firewall-rules delete emergency-block-*

# 4. Create new service account with least privilege
gcloud iam service-accounts create new-service-account \
  --display-name="Replacement Service Account"

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:new-service-account@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/viewer"

# 5. Rotate all potentially compromised credentials
gcloud iam service-accounts keys create new-key.json \
  --iam-account=SERVICE_ACCOUNT_EMAIL

# 6. Update application configuration
gcloud compute instances add-metadata INSTANCE_NAME \
  --zone=ZONE \
  --metadata-from-file=config=new-config.yaml

# 7. Verify security controls
gcloud scc findings list ORGANIZATION_ID \
  --filter="state=\"ACTIVE\" AND severity=\"HIGH\""

# 8. Re-enable monitoring and alerting
gcloud alpha monitoring policies update POLICY_ID --enabled

# 9. Document changes in Cloud Asset Inventory
gcloud asset search-all-resources \
  --query="createTime>2024-01-01T00:00:00Z" \
  --order-by="createTime DESC"

# Generate incident timeline from logs
gcloud logging read '
  timestamp>="2024-01-01T10:00:00Z"
  AND timestamp<="2024-01-01T12:00:00Z"
  AND (severity>=ERROR OR logName:cloudaudit)
' --format="table(timestamp,resource.type,protoPayload.methodName,protoPayload.authenticationInfo.principalEmail)" \
  --limit=1000 > incident-timeline.txt

# Analyze asset changes during incident
gcloud asset search-all-resources \
  --query="updateTime>=2024-01-01T10:00:00Z AND updateTime<=2024-01-01T12:00:00Z" \
  --format=json > incident-asset-changes.json

# Review IAM changes
gcloud logging read '
  protoPayload.methodName="SetIamPolicy"
  AND timestamp>="2024-01-01T00:00:00Z"
' --format="table(timestamp,protoPayload.authenticationInfo.principalEmail,protoPayload.resourceName)"

# Document lessons learned
# Create incident report with:
# - Root cause analysis
# - Timeline of events
# - Actions taken
# - Gaps identified
# - Recommendations for improvement

# Enable Container Analysis API
gcloud services enable containeranalysis.googleapis.com containerscanning.googleapis.com

# Push image to trigger automatic scanning
docker tag myapp:latest gcr.io/PROJECT_ID/myapp:v1.0
docker push gcr.io/PROJECT_ID/myapp:v1.0

# Manual scan trigger
gcloud container images scan gcr.io/PROJECT_ID/myapp:v1.0

# List vulnerabilities for specific image
gcloud container images describe gcr.io/PROJECT_ID/myapp:v1.0 \
  --show-package-vulnerability \
  --format=json

# List vulnerabilities with specific severity
gcloud container images describe gcr.io/PROJECT_ID/myapp:v1.0 \
  --show-package-vulnerability \
  --format=json | jq '.vulnerability.packageIssue[] | select(.severity | IN("CRITICAL", "HIGH"))'

# Get vulnerability occurrences
gcloud container images list-tags gcr.io/PROJECT_ID/myapp \
  --format='get(digest)' \
  --filter='tags:v1.0' | \
  xargs -I {} gcloud container images describe gcr.io/PROJECT_ID/myapp@{} \
  --show-package-vulnerability

# List all images with vulnerabilities
gcloud container images list --repository=gcr.io/PROJECT_ID \
  --format="table(name,tags)"

# Export vulnerability scan results
gcloud container images describe gcr.io/PROJECT_ID/myapp:v1.0 \
  --show-package-vulnerability \
  --format=json > vulnerability-report.json

# Check for specific CVEs
gcloud container images describe gcr.io/PROJECT_ID/myapp:v1.0 \
  --show-package-vulnerability \
  --format=json | jq '.vulnerability.packageIssue[] | select(.cve | contains("CVE-2024-"))'

# Set up continuous scanning
gcloud artifacts repositories create my-repo \
  --repository-format=docker \
  --location=us-central1 \
  --description="Docker repository with scanning"

# Enable vulnerability scanning on Artifact Registry
gcloud artifacts repositories update my-repo \
  --location=us-central1 \
  --enable-vulnerability-scanning

# Enable Binary Authorization API
gcloud services enable binaryauthorization.googleapis.com

# Create attestation note in Container Analysis
cat > note.json <<EOF
{
  "name": "projects/PROJECT_ID/notes/prod-attestor-note",
  "attestation": {
    "hint": {
      "human_readable_name": "Production attestation"
    }
  }
}
EOF

curl -X POST \
  "https://containeranalysis.googleapis.com/v1/projects/PROJECT_ID/notes?noteId=prod-attestor-note" \
  -H "Authorization: Bearer $(gcloud auth print-access-token)" \
  -H "Content-Type: application/json" \
  -d @note.json

# Create attestor
gcloud container binauthz attestors create prod-attestor \
  --attestation-authority-note=prod-attestor-note \
  --attestation-authority-note-project=PROJECT_ID

# Add public key to attestor
gcloud container binauthz attestors public-keys add \
  --attestor=prod-attestor \
  --pgp-public-key-file=pubkey.asc

# Create Binary Authorization policy
cat > policy.yaml <<EOF
globalPolicyEvaluationMode: ENABLE
defaultAdmissionRule:
  requireAttestationsBy:
    - projects/PROJECT_ID/attestors/prod-attestor
  enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG
  evaluationMode: REQUIRE_ATTESTATION
clusterAdmissionRules:
  us-central1-a.prod-cluster:
    requireAttestationsBy:
      - projects/PROJECT_ID/attestors/prod-attestor
      - projects/PROJECT_ID/attestors/security-attestor
    enforcementMode: ENFORCED_BLOCK_AND_AUDIT_LOG
    evaluationMode: REQUIRE_ATTESTATION
admissionWhitelistPatterns:
  - namePattern: gcr.io/PROJECT_ID/trusted-base-images/*
EOF

# Import policy
gcloud container binauthz policy import policy.yaml

# View current policy
gcloud container binauthz policy export

# Create attestation for image
gcloud container binauthz attestations sign-and-create \
  --artifact-url=gcr.io/PROJECT_ID/myapp@sha256:abc123... \
  --attestor=prod-attestor \
  --attestor-project=PROJECT_ID \
  --pgp-key-fingerprint=ABCD1234... \
  --pgp-secret-key-file=privkey.asc

# List attestations for image
gcloud container binauthz attestations list \
  --artifact-url=gcr.io/PROJECT_ID/myapp@sha256:abc123... \
  --attestor=prod-attestor \
  --attestor-project=PROJECT_ID

# Dry run to test policy
gcloud container binauthz attestations create \
  --artifact-url=gcr.io/PROJECT_ID/myapp:v1.0 \
  --attestor=prod-attestor \
  --attestor-project=PROJECT_ID \
  --dry-run

# Update policy enforcement mode
cat > updated-policy.yaml <<EOF
globalPolicyEvaluationMode: ENABLE
defaultAdmissionRule:
  requireAttestationsBy:
    - projects/PROJECT_ID/attestors/prod-attestor
  enforcementMode: DRYRUN_AUDIT_LOG_ONLY
  evaluationMode: REQUIRE_ATTESTATION
EOF

gcloud container binauthz policy import updated-policy.yaml

# Enable OS Config API
gcloud services enable osconfig.googleapis.com

# Create patch deployment for immediate patching
gcloud compute os-config patch-deployments create emergency-patch \
  --file=patch-deployment.yaml

cat > patch-deployment.yaml <<EOF
patchConfig:
  rebootConfig: ALWAYS
  apt:
    type: DIST
    excludes:
      - kernel*
  yum:
    security: true
    minimal: true
instanceFilter:
  all: false
  zones:
    - us-central1-a
  labels:
    - env: prod
duration: 3600s
EOF

# Create recurring patch schedule
gcloud compute os-config patch-deployments create weekly-patches \
  --file=weekly-patch-deployment.yaml

cat > weekly-patch-deployment.yaml <<EOF
patchConfig:
  rebootConfig: DEFAULT
  apt:
    type: DIST
  yum:
    security: true
    minimal: true
instanceFilter:
  groupLabels:
    - labels:
        env: prod
        os: linux
recurringSchedule:
  timeZone:
    id: America/New_York
  timeOfDay:
    hours: 2
    minutes: 0
  frequency: WEEKLY
  weekly:
    dayOfWeek: SUNDAY
duration: 7200s
EOF

# List all patch deployments
gcloud compute os-config patch-deployments list

# Execute patch job immediately
gcloud compute os-config patch-jobs execute \
  --instance-filter-labels=env=prod \
  --async

# List patch jobs
gcloud compute os-config patch-jobs list

# Describe patch job status
gcloud compute os-config patch-jobs describe PATCH_JOB_ID

# List instance patch states
gcloud compute os-config patch-jobs list-instance-details PATCH_JOB_ID

# Cancel running patch job
gcloud compute os-config patch-jobs cancel PATCH_JOB_ID

# Get patch compliance report
gcloud compute instances os-inventory describe INSTANCE_NAME \
  --zone=us-central1-a \
  --view=FULL

# Enable Web Security Scanner API
gcloud services enable websecurityscanner.googleapis.com

# Create scan configuration
cat > scan-config.yaml <<EOF
displayName: "Production Web App Scan"
startingUrls:
  - "https://example.com"
targetPlatforms:
  - APP_ENGINE
  - COMPUTE
userAgent: CHROME_LINUX
maxQps: 5
authentication:
  googleAccount:
    username: "scanner@example.com"
    password: "secure-password"
schedule:
  scheduleTime: "2024-01-01T02:00:00Z"
  intervalDurationDays: 7
EOF

# Create scan configuration
gcloud web-security-scanner scan-configs create \
  --scan-config-from-file=scan-config.yaml \
  --project=PROJECT_ID

# Start scan run
gcloud web-security-scanner scan-runs start SCAN_CONFIG_NAME

# List scan runs
gcloud web-security-scanner scan-runs list SCAN_CONFIG_NAME

# Describe scan run
gcloud web-security-scanner scan-runs describe SCAN_RUN_NAME

# List findings
gcloud web-security-scanner findings list SCAN_RUN_NAME \
  --format="table(name,category,severity,trackingId)"

# List high severity findings
gcloud web-security-scanner findings list SCAN_RUN_NAME \
  --filter="severity=HIGH OR severity=CRITICAL"

# Export findings
gcloud web-security-scanner findings list SCAN_RUN_NAME \
  --format=json > scan-findings.json

# Stop scan run
gcloud web-security-scanner scan-runs stop SCAN_RUN_NAME

# Delete scan configuration
gcloud web-security-scanner scan-configs delete SCAN_CONFIG_NAME

# Enable Cloud Asset Inventory
gcloud services enable cloudasset.googleapis.com

# Scan for public IPs
gcloud compute instances list \
  --format="table(name,zone,networkInterfaces[0].accessConfigs[0].natIP)" \
  --filter="networkInterfaces.accessConfigs.natIP:*"

# Find instances without Shielded VM features
gcloud compute instances list \
  --format="table(name,zone)" \
  --filter="NOT shieldedInstanceConfig.enableSecureBoot=true"

# Scan for unencrypted disks
gcloud compute disks list \
  --format="table(name,zone,diskEncryptionKey.sha256)" \
  --filter="NOT diskEncryptionKey.sha256:*"

# Find buckets with public access
gsutil ls -L -b gs://** 2>/dev/null | grep -A 5 "allUsers\|allAuthenticatedUsers"

# Scan for service accounts with keys
gcloud iam service-accounts list --format="value(email)" | while read sa; do
  echo "Service Account: $sa"
  gcloud iam service-accounts keys list --iam-account=$sa
done

# Find overly permissive firewall rules
gcloud compute firewall-rules list \
  --filter="sourceRanges:(0.0.0.0/0) AND allowed[].ports:(22 OR 3389)" \
  --format="table(name,sourceRanges,allowed)"

# Scan for legacy object ACLs on buckets
gsutil uniformbucketlevelaccess get gs://BUCKET_NAME

# Find SQL instances without SSL
gcloud sql instances list \
  --filter="settings.ipConfiguration.requireSsl=false" \
  --format="table(name,settings.ipConfiguration.requireSsl)"

# Enable Cloud IDS API
gcloud services enable ids.googleapis.com

# Create IDS endpoint
gcloud ids endpoints create production-ids \
  --network=projects/PROJECT_ID/global/networks/prod-vpc \
  --zone=us-central1-a \
  --severity=INFORMATIONAL \
  --enable-traffic-logs

# List IDS endpoints
gcloud ids endpoints list --zone=us-central1-a

# Describe IDS endpoint
gcloud ids endpoints describe production-ids --zone=us-central1-a

# Update IDS endpoint severity threshold
gcloud ids endpoints update production-ids \
  --zone=us-central1-a \
  --severity=MEDIUM

# View IDS threat detections
gcloud logging read 'resource.type="ids.googleapis.com/Endpoint"' \
  --limit=100 \
  --format=json

# Query for specific threat types
gcloud logging read '
  resource.type="ids.googleapis.com/Endpoint"
  AND jsonPayload.alert.severity="HIGH"
  AND jsonPayload.alert.category="malware"
' --limit=50 --format=json

# Export IDS logs to BigQuery for analysis
gcloud logging sinks create ids-threat-logs \
  bigquery.googleapis.com/projects/PROJECT_ID/datasets/threat_intelligence \
  --log-filter='resource.type="ids.googleapis.com/Endpoint"'

# Configure log export to Chronicle
gcloud logging sinks create chronicle-security-logs \
  pubsub.googleapis.com/projects/PROJECT_ID/topics/chronicle-ingestion \
  --log-filter='
    logName:cloudaudit.googleapis.com OR
    resource.type="gce_firewall_rule" OR
    resource.type="ids.googleapis.com/Endpoint" OR
    logName:securitycenter.googleapis.com
  '

# Grant Chronicle service account permissions
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:chronicle-ingestion@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/pubsub.subscriber"

# Create Pub/Sub subscription for Chronicle
gcloud pubsub subscriptions create chronicle-subscription \
  --topic=chronicle-ingestion \
  --push-endpoint=https://chronicle-forwarder.googleapis.com/v1/projects/PROJECT_ID/logs:write

# Export Security Command Center findings to Chronicle
gcloud scc notifications create chronicle-scc-export \
  --organization=ORGANIZATION_ID \
  --description="Export SCC findings to Chronicle" \
  --pubsub-topic=projects/PROJECT_ID/topics/chronicle-ingestion \
  --filter="state=\"ACTIVE\""

# List policy violations
gcloud asset search-all-resources \
  --scope=organizations/ORG_ID \
  --query="state:ACTIVE AND -labels.compliant:true"

# Automated compliance checks
for project in $(gcloud projects list --format="value(projectId)"); do
  echo "Checking $project..."
  gcloud sql instances list --project=$project --filter="settings.ipConfiguration.requireSsl=false"
done

# Check for Organization Policy violations
gcloud resource-manager org-policies describe constraints/iam.allowedPolicyMemberDomains \
  --effective \
  --project=PROJECT_ID

# Export compliance posture
gcloud asset analyze-iam-policy \
  --scope=organizations/ORG_ID \
  --full-resource-name=//cloudresourcemanager.googleapis.com/organizations/ORG_ID \
  --format=json > org-iam-analysis.json

# Check encryption requirements
# Requirement 3.4: Encryption at rest
gcloud compute disks list \
  --filter="NOT diskEncryptionKey:*" \
  --format="table(name,zone,sizeGb)" > unencrypted-disks.txt

# Requirement 1.3: Network segmentation
gcloud compute firewall-rules list \
  --filter="sourceRanges:(0.0.0.0/0)" \
  --format="table(name,sourceRanges,allowed)" > permissive-firewall-rules.txt

# Requirement 10.2: Audit logging
gcloud logging sinks list --format="table(name,destination)" > logging-sinks.txt

# Requirement 8.7: Access control
gcloud projects get-iam-policy PROJECT_ID \
  --flatten="bindings[].members" \
  --format="table(bindings.role,bindings.members)" > iam-permissions.txt

# Check BAA compliance
# Access logs for PHI data
gcloud logging read 'resource.type="gcs_bucket" AND resource.labels.bucket_name=~".*phi.*"' \
  --limit=100 --format=json > phi-access-logs.json

# Verify encryption in transit
gcloud sql instances list \
  --filter="settings.ipConfiguration.requireSsl=false" \
  --format="table(name,settings.ipConfiguration.requireSsl)"

# Check for VPC Service Controls
gcloud access-context-manager perimeters list \
  --policy=ACCESS_POLICY_NAME

# Verify audit log retention
gsutil lifecycle get gs://hipaa-audit-logs

# CC6.1: Logical access controls
gcloud projects get-iam-policy PROJECT_ID \
  --format=json | jq '.bindings[] | select(.role | contains("admin") or contains("owner"))'

# CC6.6: Encryption
gcloud compute disks list --filter="NOT diskEncryptionKey:*"
gcloud sql instances list --filter="settings.ipConfiguration.requireSsl=false"

# CC7.2: System monitoring
gcloud alpha monitoring policies list --format="table(displayName,enabled)"

# CC7.3: Threat detection
gcloud scc findings list ORGANIZATION_ID \
  --filter="state=\"ACTIVE\"" \
  --format="table(finding.category,finding.severity)"

# Generate SOC 2 compliance report
cat > soc2-compliance-check.sh <<'EOF'
#!/bin/bash
echo "SOC 2 Compliance Report - $(date)" > soc2-report.txt
echo "======================================" >> soc2-report.txt

echo -e "\n## CC6.1 - Logical Access Controls" >> soc2-report.txt
gcloud projects get-iam-policy PROJECT_ID --flatten="bindings[].members" \
  --filter="bindings.role:(roles/owner OR roles/editor)" \
  --format="table(bindings.role,bindings.members)" >> soc2-report.txt

echo -e "\n## CC6.6 - Encryption" >> soc2-report.txt
echo "Unencrypted disks:" >> soc2-report.txt
gcloud compute disks list --filter="NOT diskEncryptionKey:*" --format="value(name)" >> soc2-report.txt

echo -e "\n## CC7.2 - System Monitoring" >> soc2-report.txt
gcloud alpha monitoring policies list --format="table(displayName,enabled)" >> soc2-report.txt

echo -e "\n## CC7.3 - Active Security Findings" >> soc2-report.txt
gcloud scc findings list ORGANIZATION_ID --filter="state=\"ACTIVE\"" \
  --format="table(finding.category,finding.severity)" >> soc2-report.txt

cat soc2-report.txt
EOF
chmod +x soc2-compliance-check.sh
./soc2-compliance-check.sh

# Most common security operations commands

# View recent security events
gcloud logging read "logName:cloudaudit.googleapis.com" --limit=50

# List active SCC findings
gcloud scc findings list ORG_ID --filter="state=\"ACTIVE\""

# Create log-based metric
gcloud logging metrics create METRIC_NAME --log-filter="FILTER"

# Create alerting policy from file
gcloud alpha monitoring policies create --policy-from-file=policy.yaml

# Create Cloud Armor rule
gcloud compute security-policies rules create PRIORITY \
  --security-policy=POLICY --expression="EXPR" --action=ACTION

# Snapshot disk for forensics
gcloud compute disks snapshot DISK --zone=ZONE

# List container vulnerabilities
gcloud container images describe IMAGE --show-package-vulnerability

# Export Binary Authorization policy
gcloud container binauthz policy export

# Create log sink
gcloud logging sinks create SINK_NAME DESTINATION --log-filter="FILTER"

# Create SCC notification
gcloud scc notifications create NOTIF_NAME --organization=ORG \
  --pubsub-topic=TOPIC --filter="FILTER"