Sample Security Posture Architecture
Edge and ingress
- Global HTTPS Load Balancer with Cloud Armor WAF and rate limiting
- NGINX reverse proxy in a managed instance group, private subnets, no public IPs
App Tier
- Node.js services on GKE or VM MIG with auto scale, private subnets
- Workload identity and least-privilege service accounts
- Private egress via Cloud NAT, outbound allowlist
Data Tier
- AlloyDB primary in Region 1 on private IP, read pool for scale
- Private Service Connect from app tier to AlloyDB
- Connection pooling with pgBouncer
Resilience and Recovery
- Cross-region standby AlloyDB in Region 2 with auto failover
- Point-in-time recovery, encrypted backups in a separate project
- Quarterly DR tests and documented RTO and RPO
Network Segmentation
- Separate VPCs or Shared VPC with subnet per tier
- Tight firewall rules, private DNS, no implicit inbound
- VPC Service Controls for data exfil protection
Secrets and Keys
- Secret Manager with rotation
- Customer-managed encryption keys in Cloud KMS or HSM
Observability
- Centralized Cloud Logging and Metrics with alerting
- Admin Activity and Data Access audit logs routed to SIEM
Governance
- Terraform and policy guardrails
- CIS Benchmarks and optional HIPAA or PCI mappings