Module 01
Planned
Foundations of Google Cloud Security
10 lessons
GCP-001 – GCP-010
Zeus, Athena, Hephaestus
Foundation
Foundations
View lesson list
-
GCP-001
Who Protects Olympus? Google shared responsibility model
-
GCP-002
The Kingdom in the Clouds Google Cloud service fundamentals
-
GCP-003
Who Owns the Infrastructure? Provider-managed vs customer-managed security
-
GCP-004
The Three Layers of Olympus Infrastructure, platform, application security
-
GCP-005
The Security Architect's Mission Confidentiality, integrity, availability
-
GCP-006
When the Gods Share Responsibility IaaS, PaaS, SaaS responsibility
-
GCP-007
The Invisible Boundary Cloud trust boundaries
-
GCP-008
The Exposed Temple Cloud misconfigurations
-
GCP-009
Athena's First Security Review Asset identification and threat modeling
-
GCP-010
The Blueprint of Olympus Secure cloud foundation
Module 02
Planned
Resource Hierarchy and Governance
10 lessons
GCP-011 – GCP-020
Zeus, Hera, Athena
Foundation
Governance & Policy
View lesson list
-
GCP-011
The Kingdom and Its Territories Organization, folders, projects, resources
-
GCP-012
Zeus Divides Olympus Folder hierarchy design
-
GCP-013
The Project That Belonged to Nobody Project ownership
-
GCP-014
The Inherited Command IAM inheritance
-
GCP-015
The Forbidden Project Production / development separation
-
GCP-016
The Forgotten Territory Shadow IT and project inventory
-
GCP-017
The Laws of Every Kingdom Central governance
-
GCP-018
The Boundary Between Kingdoms Multi-project architecture
-
GCP-019
The Architect's Landing Zone Landing zones
-
GCP-020
The Map of Olympus Cloud Asset Inventory
Module 03
In production
Identity and Access Management
12 lessons
GCP-021 – GCP-032
Hecate, Hermes, Cerberus
Foundation
Identity & Access
View lesson list
-
GCP-021
Who Are You, Hermes? Authentication vs authorization
-
GCP-022
The Keys to Olympus IAM principals, roles, permissions
-
GCP-023
The God With Too Much Power Basic vs predefined roles
-
GCP-024
The Custom-Made Key Custom roles
-
GCP-025
The Stolen Identity Credential compromise
-
GCP-026
The Gate That Trusted Everyone Least privilege
-
GCP-027
The Permission That Traveled Downward Policy inheritance
-
GCP-028
The Temporary Visitor IAM Conditions
-
GCP-029
The Banished Messenger Access removal and credential revocation
-
GCP-030
The Invisible Permission Effective access and policy evaluation
-
GCP-031
The Two Locks of Olympus Multifactor authentication
-
GCP-032
The Gods Who Never Left Access reviews
Module 04
Planned
Advanced IAM and Privileged Access
12 lessons
GCP-033 – GCP-044
Hecate, Cerberus, Athena
Intermediate
Identity & Access
View lesson list
-
GCP-033
Even Zeus Needs Permission Privileged access management
-
GCP-034
The Borrowed Crown Temporary privilege elevation
-
GCP-035
The Role Nobody Should Have Owner / Editor risks
-
GCP-036
The Impersonator at the Gate Service account impersonation
-
GCP-037
The Untrusted Outsider External identity federation
-
GCP-038
The Two Gods Who Must Agree Separation of duties
-
GCP-039
The Secret Passage IAM privilege escalation
-
GCP-040
The Forbidden Combination IAM Deny
-
GCP-041
The Conditions of Entry Context-aware access
-
GCP-042
The Unbreakable Boundary Principal access boundaries
-
GCP-043
The Identity That Crossed Kingdoms Workforce Identity Federation
-
GCP-044
The Audit of Divine Powers IAM Recommender and Policy Analyzer
Module 05
Planned
Service Accounts and Workload Identity
10 lessons
GCP-045 – GCP-054
Hermes, Hecate, Hephaestus
Intermediate
Identity & Access
View lesson list
-
GCP-045
The Messenger Without a Face Service account fundamentals
-
GCP-046
The Key That Never Expired Long-lived key risk
-
GCP-047
The Stolen Messenger Seal Service account key compromise
-
GCP-048
The Messenger Who Borrowed Authority Short-lived credentials
-
GCP-049
The Workload From Another Kingdom Workload Identity Federation
-
GCP-050
The Container That Needed Permission Workload Identity Federation for GKE
-
GCP-051
The Default Messenger Problem Default service accounts
-
GCP-052
The Keyless Kingdom Keyless service account design
-
GCP-053
The Messenger's True Identity User vs service identity
-
GCP-054
The Chain of Delegation Delegated service account access
Module 06
Planned
Organization Policies and Guardrails
10 lessons
GCP-055 – GCP-064
Hera, Themis, Zeus
Intermediate
Governance & Policy
View lesson list
-
GCP-055
The Laws Even Zeus Must Follow Organization Policy Service
-
GCP-056
No Keys Shall Be Forged Disable service account key creation
-
GCP-057
No Temple Open to Everyone Public access restrictions
-
GCP-058
The Forbidden Regions Resource location constraints
-
GCP-059
The Unbreakable Rule Constraint enforcement
-
GCP-060
The Exception to the Law Controlled policy exceptions
-
GCP-061
The Law That Changed Everything Policy inheritance
-
GCP-062
The Architect's Guardrails Baseline guardrails
-
GCP-063
The Kingdom That Drifted Configuration drift
-
GCP-064
The New Project That Broke the Rules Automated policy enforcement
Module 07
Planned
VPC Networking Fundamentals
12 lessons
GCP-065 – GCP-076
Poseidon, Hermes, Heimdall
Intermediate
Network Security
View lesson list
-
GCP-065
The Roads Between Kingdoms VPC fundamentals
-
GCP-066
The Islands of Olympus Subnets and CIDR
-
GCP-067
The Invisible Sea Lanes Routes and next hops
-
GCP-068
The Messenger's Destination DNS and addressing
-
GCP-069
The Private Road Internal vs external IP
-
GCP-070
The Shared Kingdom Shared VPC
-
GCP-071
The Bridge Between Kingdoms VPC Peering
-
GCP-072
The Tunnel Beneath the Sea Cloud VPN
-
GCP-073
The Dedicated Divine Highway Cloud Interconnect
-
GCP-074
The Messenger Who Never Needed the Internet Private Google Access
-
GCP-075
The Hidden Exit Cloud NAT
-
GCP-076
The Network That Spanned Regions Global VPC and regional subnets
Module 08
Planned
Network Security and Perimeter Controls
14 lessons
GCP-077 – GCP-090
Heimdall, Cerberus, Athena
Intermediate
Network Security
View lesson list
-
GCP-077
The Guardian at the Gate VPC firewall rules
-
GCP-078
Who May Enter Olympus? Ingress rules
-
GCP-079
Who May Leave Olympus? Egress rules
-
GCP-080
The Rule That Won the Battle Firewall evaluation and priority
-
GCP-081
The Enemy Wearing a Friendly Seal Identity-based firewall targeting
-
GCP-082
The Fortress Within a Fortress Hierarchical firewall policies
-
GCP-083
The Shield Against the Hydra Cloud Armor DDoS mitigation
-
GCP-084
The Web Application Under Siege Cloud Armor WAF
-
GCP-085
The Secret Path to Google's Services Private Service Connect
-
GCP-086
The Boundary Around Sacred Data VPC Service Controls
-
GCP-087
The Gate That Was Left Open Public exposure
-
GCP-088
The Network's Footprints VPC Flow Logs
-
GCP-089
The Watchtower That Saw Everything Packet Mirroring
-
GCP-090
The Protected Front Door Load balancers, TLS and security policies
Module 09
Planned
Encryption and Key Management
12 lessons
GCP-091 – GCP-102
Hades, Hecate, Hephaestus
Intermediate
Data & Encryption
View lesson list
-
GCP-091
The Secret Only Zeus Can Read Encryption fundamentals
-
GCP-092
The Locked Scroll Encryption at rest
-
GCP-093
The Protected Messenger Encryption in transit
-
GCP-094
The Master Key of Olympus Cloud KMS
-
GCP-095
The Key Forged by the Customer CMEK
-
GCP-096
The Key That Never Leaves the Vault Cloud HSM
-
GCP-097
The Key That Came From Another Kingdom Cloud EKM
-
GCP-098
The Day the Key Was Destroyed Key destruction
-
GCP-099
The Rotating Seal Key rotation
-
GCP-100
The Secret Hidden in Plain Sight Secret Manager
-
GCP-101
The Wrong God Holding the Key Key access control
-
GCP-102
The Seal of Authenticity Digital signatures
Module 10
Planned
Cloud Storage and Data Protection
12 lessons
GCP-103 – GCP-114
Hades, Athena, Hermes
Intermediate
Data & Encryption
View lesson list
-
GCP-103
The Vault Anyone Could Open Public Cloud Storage buckets
-
GCP-104
The Scroll With No Owner Bucket IAM
-
GCP-105
The Kingdom's Storage Rules Uniform bucket-level access
-
GCP-106
The Forbidden Public Scroll Public Access Prevention
-
GCP-107
The Scroll That Could Never Be Changed Retention policies and Bucket Lock
-
GCP-108
The Lost Ancient Record Object versioning
-
GCP-109
The Archive That Survived Destruction Soft delete
-
GCP-110
The Secret Hidden Inside a Scroll Sensitive Data Protection
-
GCP-111
The Message That Expired Signed URLs
-
GCP-112
The Stolen Archive Data exfiltration
-
GCP-113
The Data That Crossed Borders Data residency
-
GCP-114
The Last Remaining Copy Backup and recovery
Module 11
Planned
Compute Engine Security
12 lessons
GCP-115 – GCP-126
Hephaestus, Artemis, Athena
Intermediate
Compute & Containers
View lesson list
-
GCP-115
The Warrior Built From an Image VM images
-
GCP-116
The Unarmored Warrior VM hardening
-
GCP-117
The Trusted Boot Sequence Shielded VMs
-
GCP-118
The Protected Memory Chamber Confidential VMs
-
GCP-119
The Keyless Entrance OS Login
-
GCP-120
The Dangerous Open Port SSH / RDP exposure
-
GCP-121
The Hidden Access Tunnel IAP TCP forwarding
-
GCP-122
The Unpatched Fortress OS patch management
-
GCP-123
The Warrior's Secret Identity VM service accounts and access scopes
-
GCP-124
The Compromised Image Golden image provenance
-
GCP-125
The Fortress That Rebuilt Itself Managed instance groups
-
GCP-126
The Machine Under Investigation VM incident response
Module 12
Planned
GKE and Container Security
14 lessons
GCP-127 – GCP-140
Hephaestus, Cerberus, Athena
Intermediate
Compute & Containers
View lesson list
-
GCP-127
The Army of Containers Kubernetes architecture
-
GCP-128
The General and His Workers Control plane and worker nodes
-
GCP-129
The Container That Escaped Container isolation
-
GCP-130
The Pod With Too Much Power Kubernetes RBAC
-
GCP-131
The Identity of a Workload GKE workload identity
-
GCP-132
The Private Army Private GKE clusters
-
GCP-133
The Forbidden Deployment Binary Authorization
-
GCP-134
The Poisoned Container Image Artifact Registry vulnerability scanning
-
GCP-135
The Container's Invisible Walls Kubernetes NetworkPolicy
-
GCP-136
The Dangerous Privileged Pod Pod security
-
GCP-137
The Secrets Hidden in a Container Kubernetes secrets
-
GCP-138
The Cluster That Needed an Upgrade GKE patching and release channels
-
GCP-139
The Autopilot Commander GKE Autopilot vs Standard
-
GCP-140
The Compromised Workload Container threat detection
Module 13
Planned
Serverless and Application Security
12 lessons
GCP-141 – GCP-152
Hephaestus, Hermes, Ares
Intermediate
Application Security & DevSecOps
View lesson list
-
GCP-141
The Application Without a Server Cloud Run security
-
GCP-142
The Public Service Nobody Intended Cloud Run ingress and authentication
-
GCP-143
The Messenger at the API Gate API Gateway authentication
-
GCP-144
The Dangerous Request Input validation
-
GCP-145
The Impostor's Token OAuth token validation
-
GCP-146
The Application That Trusted Its Caller Broken authorization
-
GCP-147
The Secret Written Into the Code Hardcoded secrets
-
GCP-148
The Application's Hidden Dependencies Software composition analysis
-
GCP-149
The Function With Excessive Power Serverless least privilege
-
GCP-150
The Application Behind the Shield Identity-Aware Proxy
-
GCP-151
The Poisoned Build Artifact Artifact provenance
-
GCP-152
The API Under Attack API abuse prevention
Module 14
Planned
Database and Analytics Security
12 lessons
GCP-153 – GCP-164
Hades, Mnemosyne, Athena
Intermediate
Data & Encryption
View lesson list
-
GCP-153
The Database Beneath Olympus Cloud SQL security
-
GCP-154
The Database Exposed to the Sea Private Cloud SQL connectivity
-
GCP-155
The Password That Shouldn't Exist IAM database authentication
-
GCP-156
The Database That Forgot Its History Backups and point-in-time recovery
-
GCP-157
The Sacred Tables BigQuery dataset permissions
-
GCP-158
The Forbidden Column BigQuery column-level security
-
GCP-159
The Rows Only Certain Gods Can See BigQuery row-level security
-
GCP-160
The Query That Revealed a Secret Analytics data exposure
-
GCP-161
The Disguised Identity Data masking and tokenization
-
GCP-162
The Database That Crossed Kingdoms Replication and residency
-
GCP-163
The Memory That Could Not Be Lost Spanner resilience
-
GCP-164
The Archive Accessed at Midnight Database audit logging
Module 15
Planned
Logging, Monitoring, and Detection
14 lessons
GCP-165 – GCP-178
Mnemosyne, Artemis, Apollo
Intermediate
Detection & Response
View lesson list
-
GCP-165
The Eyes of Olympus Cloud Logging
-
GCP-166
The Record of Every Command Cloud Audit Logs
-
GCP-167
Who Changed the Kingdom? Admin Activity logs
-
GCP-168
Who Opened the Sacred Vault? Data Access logs
-
GCP-169
The Logs That Never Arrived Logging coverage
-
GCP-170
The Missing Evidence Log retention
-
GCP-171
The Messenger Who Raised the Alarm Log-based alerts
-
GCP-172
The Signals of an Approaching Attack Cloud Monitoring
-
GCP-173
The River of Security Events Log Router and sinks
-
GCP-174
The Central Archive Centralized logging
-
GCP-175
The Alert Nobody Investigated Alert fatigue
-
GCP-176
The Trail Through Olympus Event correlation
-
GCP-177
The Chronicle of a Breach Incident timelines
-
GCP-178
The Watchtower That Never Sleeps Continuous monitoring
Module 16
Planned
Security Command Center and Posture Management
12 lessons
GCP-179 – GCP-190
Athena, Artemis, Zeus
Intermediate
Detection & Response
View lesson list
-
GCP-179
The Map of Every Weakness Security Command Center
-
GCP-180
The Exposed Temple Nobody Saw Misconfiguration findings
-
GCP-181
The Hidden Threat Within Olympus Threat detection findings
-
GCP-182
The Dangerous Path to the Throne Attack path analysis
-
GCP-183
The God With Excessive Permissions IAM risk findings
-
GCP-184
The Unprotected Resource Asset inventory
-
GCP-185
The Risk That Matters Most Finding prioritization
-
GCP-186
The Vulnerability That Became an Attack Exposure vs exploitation
-
GCP-187
The Finding That Wouldn't Disappear Remediation verification
-
GCP-188
The Exception Athena Approved Risk exceptions
-
GCP-189
The Security Score of Olympus Posture metrics
-
GCP-190
The Architect's Daily Inspection Cloud security review
Module 17
Planned
Threat Detection and Incident Response
14 lessons
GCP-191 – GCP-204
Artemis, Athena, Asclepius, Ares
Intermediate
Detection & Response
View lesson list
-
GCP-191
The First Sign of an Intruder Initial compromise detection
-
GCP-192
The Stolen Divine Identity Compromised user response
-
GCP-193
The Messenger Sending Strange Requests Suspicious API activity
-
GCP-194
The Enemy Moving Between Temples Lateral movement
-
GCP-195
The Compromised Service Account Service account compromise
-
GCP-196
The Treasure Leaving Olympus Exfiltration detection
-
GCP-197
The War Room Assembles Incident triage
-
GCP-198
The Order to Contain Containment
-
GCP-199
The Evidence Before the Battle Forensic preservation
-
GCP-200
The Enemy That Returned Eradication
-
GCP-201
The Recovery of Olympus Recovery validation
-
GCP-202
The Story of the Attack Root cause analysis
-
GCP-203
The Lessons Written in Stone Post-incident review
-
GCP-204
The Next Attack Is Coming Detection improvement
Module 18
Planned
DevSecOps and Infrastructure as Code
14 lessons
GCP-205 – GCP-218
Hephaestus, Athena, Ares
Intermediate
Application Security & DevSecOps
View lesson list
-
GCP-205
The Blueprint That Builds a Kingdom Terraform fundamentals
-
GCP-206
The Dangerous Blueprint IaC misconfigurations
-
GCP-207
The Secret Hidden in Terraform State Terraform state security
-
GCP-208
The Change Nobody Reviewed Code reviews
-
GCP-209
The Builder With Too Much Power CI/CD least privilege
-
GCP-210
The Poisoned Build Pipeline CI/CD compromise
-
GCP-211
The Untrusted Dependency Dependency supply chain attacks
-
GCP-212
The Artifact With a Trusted Seal Build attestations
-
GCP-213
The Vulnerability Found Before Deployment Security scanning
-
GCP-214
The Deployment Athena Rejected Policy as code
-
GCP-215
The Kingdom That Changed Overnight Infrastructure drift
-
GCP-216
The Emergency Rollback Deployment rollback
-
GCP-217
The Forge Without Permanent Keys Federated CI/CD identities
-
GCP-218
The Security Test Before the Battle Continuous security validation
Module 19
Planned
AI and Vertex AI Security
16 lessons
GCP-219 – GCP-234
Apollo, Athena, Loki, Hermes
Intermediate
AI Security
View lesson list
-
GCP-219
The Oracle Awakens Vertex AI fundamentals
-
GCP-220
The Oracle That Believed a Lie Prompt injection
-
GCP-221
The False Prophecy Hallucinations
-
GCP-222
The Forbidden Knowledge AI data leakage
-
GCP-223
The Oracle's Secret Instructions System prompt exposure
-
GCP-224
The Poisoned Scroll RAG document poisoning
-
GCP-225
The Messenger Who Became a Tool AI tool calling
-
GCP-226
The Agent That Took Too Much Authority Agent permission boundaries
-
GCP-227
The Untrusted MCP Server MCP server trust
-
GCP-228
The Oracle That Obeyed the Enemy Indirect prompt injection
-
GCP-229
The Corrupted Training Scrolls Training data poisoning
-
GCP-230
The Model That Revealed Its Secrets Model extraction
-
GCP-231
The Private Oracle Vertex AI private connectivity
-
GCP-232
The Guardian of AI Data AI data governance
-
GCP-233
The Oracle's Dangerous Action Human approval for actions
-
GCP-234
The Trial of the Oracle AI red teaming
Module 20
Planned
Enterprise Architecture, Resilience, and Zero Trust
12 lessons
GCP-235 – GCP-246
Athena, Zeus, Hestia, Hera
Intermediate
Architecture & Zero Trust
View lesson list
-
GCP-235
The Kingdom That Trusted No One Zero Trust
-
GCP-236
The Identity Before the Network Identity-centric access
-
GCP-237
The Fortress With Many Walls Defense in depth
-
GCP-238
The Kingdom With No Single Point of Failure High availability
-
GCP-239
The Temple That Survived a Regional Disaster Multi-region resilience
-
GCP-240
The Backup That Failed Backup testing
-
GCP-241
The Time Olympus Could Afford to Lose RPO and RTO
-
GCP-242
The Threat Across Every Kingdom Enterprise threat modeling
-
GCP-243
The Price of Security Risk-based security investment
-
GCP-244
The Council's Security Review Architecture review
-
GCP-245
The Cloud Foundation That Scaled Cloud guardrails at scale
-
GCP-246
The Final Defense of Olympus Integrated defense
No modules match that search. Try a product name (“Cloud Armor”) or a concept (“least privilege”).