Cloud Key Management Service (Cloud KMS) is the Google Cloud service for creating and managing cryptographic keys, including customer-managed encryption keys and rotation. PCSE covers it as central to ensuring data protection.
Identity and Access Management (IAM) is the Google Cloud service that controls who can do what on which resources through roles bound to identities.
Cloud Identity is Google's identity-as-a-service platform for managing users, groups, and devices, with single sign-on and directory sync.
A service account is a special Google Cloud identity used by applications and workloads rather than people to authenticate and access resources.
Workload Identity Federation is a Google Cloud capability that lets external workloads access resources using short-lived credentials without service-account keys.
VPC Service Controls is a Google Cloud feature that creates a security perimeter around managed services to mitigate data exfiltration.
Cloud Armor is Google Cloud's web-application-firewall and DDoS-protection service applied at the edge and load balancer.
Private Service Connect is a Google Cloud capability for privately reaching services across VPC networks without exposing traffic to the internet.
Cloud Key Management Service (Cloud KMS) is the Google Cloud service for creating and managing cryptographic keys, including customer-managed encryption keys and rotation.
A customer-managed encryption key (CMEK) is an encryption key that the customer creates and controls in Cloud KMS to protect Google Cloud data.
Sensitive Data Protection (formerly Cloud DLP) is a Google Cloud service for discovering, classifying, and de-identifying sensitive data.
Secret Manager is a Google Cloud service for securely storing, versioning, and accessing secrets such as API keys and credentials.
Security Command Center is Google Cloud's centralized security and risk-management platform for surfacing misconfigurations, vulnerabilities, and threats.
Cloud Logging is Google Cloud's managed service for storing, searching, and analyzing log data, including audit logs.
Assured Workloads is a Google Cloud service that enforces compliance controls and data-residency requirements for regulated workloads.