Roadmap › Google Cloud Platform (GCP) for .NET and Full Stack Developers › Module: Integration, Networking and Security
Lessons in this course (9)
7. Security and operations — Secret Manager, KMS, Logging, Monitoring
Intermediate★ Must knowLesson 7 of 9
- Secret Manager — versioned secrets, IAM-controlled; Cloud Run mounts them as env vars or files (
--set-secrets). - Cloud KMS — encryption keys (CMEK for Storage, Cloud SQL, BigQuery); HSM-backed keys.
- Identity Platform / Firebase Authentication — end-user sign-in; Identity-Aware Proxy (IAP) — protect internal apps with Google identity without a VPN.
- Security Command Center, Organization Policies (e.g. disallow public buckets, restrict regions), VPC Service Controls (data exfiltration perimeters).
- Cloud Logging (stdout/stderr JSON from Cloud Run/GKE is ingested automatically; Logs Explorer queries; log sinks to BigQuery/Storage), Cloud Monitoring (metrics, uptime checks, alerting, SLOs), Cloud Trace/Profiler, Error Reporting. ASP.NET Core: write structured JSON logs to stdout or use
Google.Cloud.Diagnostics.AspNetCore3; OpenTelemetry exporters for traces.