The short answer
Securing data platforms on Google Cloud requires isolating compute resources from the public internet, preventing unauthorized data egress, and encrypting sensitive tables with customer-controlled cryptographic keys.
Private Google Access
Compute Engine virtual machines and Dataproc clusters configured without public external IP addresses cannot reach public internet websites:
- Private Google Access: Configured at the VPC subnet level, allowing internal-only instances to communicate with Google APIs (including Cloud Storage, BigQuery, and Pub/Sub) using internal Google network routing.
- This eliminates the need for expensive NAT gateways for internal jobs while keeping worker nodes completely hidden from inbound internet threats.
Private Subnet (Dataproc / Compute VMs without Public IPs) | (Private Google Access enabled) v Google APIs Backbone (Cloud Storage, BigQuery, Pub/Sub) | (Protected inside VPC Service Controls Perimeter) x Exfiltration blocked to outside GCP projects
VPC Service Controls and CMEK
Even with strict roles, a compromised service account or malicious insider could copy data from your project into an external personal GCP bucket:
- VPC Service Controls (VPC-SC) creates a security perimeter around Google Cloud resources. It blocks API requests that attempt to move data across the perimeter boundary, stopping exfiltration.
- Customer-Managed Encryption Keys (CMEK) integrates Google Cloud KMS with BigQuery and GCS, ensuring your security team can revoke access or audit key usage logs independently.