Question

A financial services company stores sensitive customer data in BigQuery and Cloud Storage within a Google Cloud project. The security team is concerned that a compromised service account or a malicious insider could copy data to a personal project outside the organization. They want to ensure that even users with valid IAM permissions cannot exfiltrate data to resources outside a defined boundary, while still allowing authorized on-premises analysts to query the data over a private connection. Which approach best meets these requirements?

Accepted Answer

Configure a VPC Service Controls perimeter around the project's BigQuery and Cloud Storage APIs, and use an ingress rule with a private connectivity access level for the on-premises analysts.

Answer

Apply hierarchical firewall policies at the organization level to block egress traffic to external IP ranges.

Answer

Grant the analysts only the BigQuery Data Viewer role and enable Cloud Audit Logs to detect any data copied outside the organization.

Answer

Enable Private Google Access on the subnet and restrict the service account with an IAM deny policy on the storage.objects.get permission.