HITRUST CSF 11.5 - Google Cloud

const repository = new gcp.artifactregistry.Repository("my-repository", {
    repositoryId: "my-repo",
    format: "DOCKER",
    kmsKeyName: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",  // Specify customer-managed KMS key
    // ... other config
});

const repository = new gcp.artifactregistry.Repository("my-repository", {
    repositoryId: "my-repo",
    format: "DOCKER",
    dockerConfig: {
        immutableTags: true,  // Prevent tag overwrites to ensure image integrity
    },
    // ... other config
});

const dataset = new gcp.bigquery.Dataset("my-dataset", {
    datasetId: "example_dataset",
    defaultEncryptionConfiguration: {
        kmsKeyName: cryptoKey.id,  // Set customer-managed KMS key for encryption
    },
    // ... other config
});

const bigtableTable = new gcp.bigtable.Table("my-table", {
    instanceName: "my-bigtable-instance",
    changeStreamRetention: "72h0m0s",  // Enable change streams with 3-day retention
    // ... other config
});

const bucket = new gcp.storage.Bucket("my-bucket", {
    location: "US",
    logging: {
        logBucket: "my-logging-bucket",  // Specify the bucket for access logs
        logObjectPrefix: "bucket-logs/", // Optional prefix for log objects
    },
    // ... other config
});

const bucket = new gcp.storage.Bucket("my-bucket", {
    location: "US",
    encryption: {
        defaultKmsKeyName: "projects/my-project/locations/us/keyRings/my-keyring/cryptoKeys/my-key",  // Specify customer-managed KMS key
    },
    // ... other config
});

const bucketIamPolicy = new gcp.storage.BucketIAMPolicy("bucket-iam", {
    bucket: bucket.name,
    policyData: JSON.stringify({
        bindings: [
            {
                role: "roles/storage.objectViewer",
                members: [
                    "serviceAccount:service-{project-number}@dlp-api.iam.gserviceaccount.com",  // Grant DLP service account access
                ],
            },
            // ... other bindings
        ],
    }),
});

// Instead of overly broad roles like storage.admin or storage.objectAdmin
// Use specific roles based on actual needs:

// For read-only access
const viewerBinding = new gcp.storage.BucketIAMBinding("viewer-binding", {
    bucket: bucket.name,
    role: "roles/storage.objectViewer",  // Read-only access to objects
    members: ["user:viewer@example.com"],
});

// For write-only access
const creatorBinding = new gcp.storage.BucketIAMBinding("creator-binding", {
    bucket: bucket.name,
    role: "roles/storage.objectCreator",  // Write-only access (no read)
    members: ["serviceAccount:app@project.iam.gserviceaccount.com"],
});

// Avoid these overly broad roles:
// - roles/storage.admin
// - roles/storage.objectAdmin
// - roles/owner
// - roles/editor

const bucket = new gcp.storage.Bucket("my-bucket", {
    location: "US",
    lifecycleRules: [
        {
            action: {
                type: "Delete",  // Delete old objects
            },
            condition: {
                age: 365,  // After 365 days
            },
        },
        {
            action: {
                type: "SetStorageClass",
                storageClass: "NEARLINE",  // Archive to cheaper storage
            },
            condition: {
                age: 90,  // After 90 days
            },
        },
    ],
    // ... other config
});

// Option 1: Use multi-region location
const bucket = new gcp.storage.Bucket("my-bucket", {
    location: "US",  // Multi-region location (US, EU, or ASIA)
    // ... other config
});

// Option 2: Use dual-region location
const bucket = new gcp.storage.Bucket("my-bucket", {
    location: "NAM4",  // Dual-region location
    // ... other config
});

// Option 3: Use custom placement with multiple data locations
const bucket = new gcp.storage.Bucket("my-bucket", {
    location: "US",
    customPlacementConfig: {
        dataLocations: ["US-EAST1", "US-WEST1"],  // Specify at least 2 regions
    },
    // ... other config
});

const bucket = new gcp.storage.Bucket("my-bucket", {
    location: "US",
    publicAccessPrevention: "enforced",  // Prevent all public access
    // ... other config
});

const bucket = new gcp.storage.Bucket("my-bucket", {
    location: "US",
    uniformBucketLevelAccess: true,  // Enable uniform bucket-level access
    // ... other config
});

import * as gcp from "@pulumi/gcp";

const bucket = new gcp.storage.Bucket("versioned-bucket", {
    location: "US",
    versioning: {
        enabled: true,
    },
});

import * as gcp from "@pulumi/gcp";

const bucket = new gcp.storage.Bucket("my-bucket", {
    location: "US",
    versioning: {
        enabled: true,
    },
});

// Create Cloud Armor security policy with protection rules
const securityPolicy = new gcp.compute.SecurityPolicy("web-security-policy", {
    rules: [
        {
            action: "rate_based_ban",
            priority: 1000,
            match: {
                versionedExpr: "SRC_IPS_V1",
                config: {
                    srcIpRanges: ["*"],
                },
            },
            rateLimitOptions: {
                conformAction: "allow",
                exceedAction: "deny(429)",
                rateLimitThreshold: {
                    count: 100,
                    intervalSec: 60,
                },
            },
            description: "Rate limiting rule",
        },
    ],
});

// Attach security policy to backend service
const backendService = new gcp.compute.BackendService("web-backend", {
    protocol: "HTTPS",
    securityPolicy: securityPolicy.id,  // Attach Cloud Armor for DDoS and WAF protection
    // ... other config
});

const trigger = new cloudbuild.Trigger("my-trigger", {
    build: {
        logsBucket: "gs://my-logs-bucket/build-logs",  // Configure centralized logs bucket
        options: {
            logging: "CLOUD_LOGGING_ONLY",  // Use Cloud Logging for audit trails
        },
        // ... other config
    },
    // ... other config
});

// Create a Cloud Armor security policy
const securityPolicy = new gcp.compute.SecurityPolicy("cdn-security-policy", {
    rules: [{
        action: "deny(403)",
        priority: 1000,
        match: {
            versionedExpr: "SRC_IPS_V1",
            config: {
                srcIpRanges: ["9.9.9.0/24"],
            },
        },
        description: "Deny access to example IP range",
    }],
});

// For BackendService: attach security policy
const backendService = new gcp.compute.BackendService("cdn-backend", {
    enableCdn: true,
    securityPolicy: securityPolicy.id,  // Attach Cloud Armor policy for DDoS protection
    // ... other config
});

// For BackendBucket: attach edge security policy
const backendBucket = new gcp.compute.BackendBucket("cdn-bucket-backend", {
    enableCdn: true,
    edgeSecurityPolicy: securityPolicy.id,  // Attach Cloud Armor policy for DDoS protection
    // ... other config
});

const backendService = new gcp.compute.BackendService("cdn-backend", {
    enableCdn: true,
    protocol: "HTTPS",  // Use HTTPS for secure communication to origin
    // ... other config
});

const queue = new gcp.cloudtasks.Queue("my-queue", {
    retryConfig: {
        maxAttempts: 10,  // Set reasonable max retry attempts
        maxRetryDuration: "3600s",  // Set max retry duration (1 hour)
        minBackoff: "0.1s",
        maxBackoff: "3600s",
    },
    // ... other config
});

const func = new gcp.cloudfunctions.Function("my-function", {
    description: "Processes customer orders from Pub/Sub and stores results in BigQuery",  // Add descriptive documentation
    labels: {
        purpose: "order-processing",  // Document function purpose
        team: "backend-team",  // Document ownership
        // ... other labels
    },
    // ... other config
});

const func = new gcp.cloudfunctions.Function("my-function", {
    timeout: 60,  // Set reasonable timeout in seconds (max 540)
    // ... other config
});

// For Cloud Functions v2
const funcV2 = new gcp.cloudfunctionsv2.Function("my-function-v2", {
    serviceConfig: {
        timeoutSeconds: 60,  // Set reasonable timeout in seconds (max 540)
    },
    // ... other config
});

const iamMember = new gcp.cloudfunctions.FunctionIamMember("my-function-invoker", {
    cloudFunction: myFunction.name,
    role: "roles/cloudfunctions.invoker",
    member: "serviceAccount:my-service@project.iam.gserviceaccount.com",  // Use specific service account instead of allUsers
    // ... other config
});

const func = new gcp.cloudfunctions.Function("my-function", {
    environmentVariables: {
        API_KEY: "sensitive-value",
        DATABASE_URL: "postgres://...",
    },
    kmsKeyName: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",  // Add KMS key for encryption
    // ... other config
});

const func = new gcp.cloudfunctions.Function("my-function", {
    environmentVariables: {
        LOG_FORMAT: "json",  // Enable structured logging
        LOG_LEVEL: "INFO",  // Set appropriate log level
    },
    labels: {
        "log-sink": "cloud-logging",  // Configure log sink
    },
    // ... other config
});

const func = new gcp.cloudfunctions.Function("my-function", {
    runtime: "nodejs20",  // Use current supported runtime (e.g., nodejs20, python311, go121)
    // ... other config
});

const sqlInstance = new gcp.sql.DatabaseInstance("my-sql-instance", {
    databaseVersion: "POSTGRES_15",
    settings: {
        backupConfiguration: {
            enabled: true,  // Enable backups
            pointInTimeRecoveryEnabled: true,  // Enable PITR for PostgreSQL/MySQL
        },
        // ... other config
    },
});

import * as gcp from "@pulumi/gcp";

const instance = new gcp.sql.DatabaseInstance("my-db-instance", {
    databaseVersion: "POSTGRES_15",
    region: "us-central1",
    settings: {
        tier: "db-f1-micro",
        availabilityType: "REGIONAL",
    },
});

const sqlInstance = new gcp.sql.DatabaseInstance("my-sql-instance", {
    databaseVersion: "POSTGRES_15",
    settings: {
        maintenanceWindow: {
            updateTrack: "stable",  // Use stable update track for patching
            day: 7,  // Saturday (1=Sunday, 7=Saturday)
            hour: 3,  // 3 AM
        },
        // ... other config
    },
});

import * as gcp from "@pulumi/gcp";

const instance = new gcp.sql.DatabaseInstance("my-db-instance", {
    databaseVersion: "POSTGRES_15",
    region: "us-central1",
    settings: {
        tier: "db-f1-micro",
        ipConfiguration: {
            ipv4Enabled: false,
            privateNetwork: "projects/my-project/global/networks/my-vpc",
        },
    },
});

// For Cloud SQL instance: Enable IAM authentication
const sqlInstance = new gcp.sql.DatabaseInstance("my-sql-instance", {
    databaseVersion: "POSTGRES_15",
    settings: {
        databaseFlags: [
            {
                name: "cloudsql_iam_authentication",
                value: "on",  // Enable IAM authentication
            },
        ],
        passwordValidationPolicy: {
            enablePasswordPolicy: true,  // Enable password validation
        },
        // ... other config
    },
    // Do not set rootPassword - use auto-generated or Secret Manager
});

// For Cloud SQL users: Use IAM-based authentication
const sqlUser = new gcp.sql.User("my-sql-user", {
    instance: sqlInstance.name,
    name: "user@example.com",
    type: "CLOUD_IAM_USER",  // Use IAM user type instead of built-in
    // Do not set password field for IAM users
});

const sqlInstance = new gcp.sql.DatabaseInstance("my-sql-instance", {
    databaseVersion: "POSTGRES_15",
    settings: {
        ipConfiguration: {
            sslMode: "ENCRYPTED_ONLY",  // Require SSL/TLS for all connections
            // ... other config
        },
    },
});

const instance = new compute.Instance("my-instance", {
    attachedDisks: [{
        source: myDisk.selfLink,
        kmsKeySelfLink: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",  // Use CMEK for attached disk encryption
    }],
    // ... other config
});

const instance = new compute.Instance("my-instance", {
    bootDisk: {
        initializeParams: {
            image: "debian-cloud/debian-11",
        },
        kmsKeySelfLink: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",  // Use customer-managed encryption key
    },
    // ... other config
});

new gcp.compute.Instance("my-instance", {
  networkInterfaces: [{
    network: "my-vpc",
    subnetwork: "my-subnet",
    // accessConfigs: [], // Remove or set to empty array
  }],
  canIpForward: false,
});

const instance = new compute.Instance("my-instance", {
    metadata: {
        "enable-osconfig": "TRUE",  // Enable OS Config for vulnerability scanning
        "enable-guest-attributes": "TRUE",  // Enable guest attributes for older agent versions
    },
    // ... other config
});

const sqlInstance = new gcp.sql.DatabaseInstance("my-sql-instance", {
    databaseVersion: "POSTGRES_15",
    settings: {
        ipConfiguration: {
            ipv4Enabled: false,  // Disable public IP
            privateNetwork: "projects/my-project/global/networks/my-vpc",  // Use private network
            sslMode: "ENCRYPTED_ONLY",  // Require SSL/TLS
            // Do not include overly broad authorized networks
        },
    },
    deletionProtection: true,  // Enable deletion protection
    // ... other config
});

const job = new dataflow.Job("my-job", {
    kmsKeyName: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",  // Use CMEK for data encryption
    // ... other config
});

// For Dataflow Pipeline
const pipeline = new dataflow.Pipeline("my-pipeline", {
    workload: {
        dataflowFlexTemplateRequest: {
            launchParameter: {
                environment: {
                    kmsKeyName: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",  // Use CMEK for data encryption
                },
            },
        },
    },
    // ... other config
});

const instance = new gcp.compute.Instance("my-instance", {
    labels: {
        environment: "production",  // Required: valid environment label
        // ... other labels
    },
    // ... other config
});

// For Cloud SQL instances, use userLabels within settings
const sqlInstance = new gcp.sql.DatabaseInstance("my-database", {
    settings: {
        userLabels: {
            environment: "staging",  // Required: valid environment label
        },
        // ... other settings
    },
    // ... other config
});

// For GKE clusters, use resourceLabels
const cluster = new gcp.container.Cluster("my-cluster", {
    resourceLabels: {
        environment: "development",  // Required: valid environment label
    },
    // ... other config
});

const filestoreKey = new gcp.kms.CryptoKey("filestore-key", {
    name: "filestore-key",
    keyRing: filestoreKeyring.id,
});

const instance = new gcp.filestore.Instance("instance", {
    tier: "ENTERPRISE",
    kmsKeyName: filestoreKey.id,  // Specify customer-managed KMS key
    // ... other config
});

const firestoreDb = new gcp.firestore.Database("my-firestore-db", {
    name: "my-database",
    locationId: "us-central",
    type: "FIRESTORE_NATIVE",
    pointInTimeRecoveryEnablement: "POINT_IN_TIME_RECOVERY_ENABLED",  // Enable PITR
    // ... other config
});

const firewallRule = new gcp.compute.Firewall("allow-https", {
    network: network.id,
    direction: "INGRESS",
    allows: [{
        protocol: "tcp",
        ports: ["443"],  // Use HTTPS (port 443) instead of HTTP (port 80)
    }],
    sourceRanges: ["0.0.0.0/0"],
    // ... other config
});

const firewallRule = new gcp.compute.Firewall("allow-private-ingress", {
    network: network.id,
    direction: "INGRESS",
    allows: [{
        protocol: "tcp",
        ports: ["443"],
    }],
    sourceRanges: ["10.0.0.0/8", "192.168.0.0/16"],  // Use private ranges instead of 0.0.0.0/0
    // Or use source tags for internal traffic control:
    // sourceTags: ["web-tier"],
    // ... other config
});

const firewallRule = new gcp.compute.Firewall("allow-ssh-restricted", {
    network: network.id,
    direction: "INGRESS",
    allows: [{
        protocol: "tcp",
        ports: ["22"],
    }],
    sourceRanges: ["10.0.0.0/8", "192.168.1.0/24"],  // Restrict to specific IP ranges, not 0.0.0.0/0
    targetTags: ["ssh-access"],
    // ... other config
});

const firewallRule = new gcp.compute.Firewall("strict-firewall-rule", {
    network: network.id,
    direction: "INGRESS",  // Explicitly specify direction
    allows: [{
        protocol: "tcp",
        ports: ["443"],  // Specify explicit ports, not all ports
    }],
    sourceRanges: ["10.0.0.0/24"],  // Use restrictive source ranges for sensitive ports
    targetTags: ["web-servers"],  // Specify explicit targets
    // ... other config
});

const cluster = new gcp.container.Cluster("my-cluster", {
    privateClusterConfig: {
        enablePrivateEndpoint: true,  // Restrict control plane access to private networks
        enablePrivateNodes: true,      // Assign only private IPs to cluster nodes
        masterIpv4CidrBlock: "172.16.0.0/28",  // CIDR block for the master
    },
    // ... other config
});

const cluster = new gcp.container.Cluster("my-cluster", {
    databaseEncryption: {
        state: "ENCRYPTED",  // Enable secrets encryption
        keyName: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",  // Specify KMS key
    },
    // ... other config
});

const instance = new gcp.compute.Instance("my-instance", {
    machineType: "e2-medium",
    bootDisk: { /* ... */ },
    networkInterfaces: [{ /* ... */ }],
    metadataStartupScript: `#!/bin/bash
export DATABASE_PASSWORD="mySecretPassword123"
export API_KEY="AIzaSyAbc123def456ghi789jkl012mno345pqr678"
mysql -u admin -p"hardcodedPassword" -h db.example.com
`,
});

const cloudFunction = new gcp.cloudfunctions.Function("my-function", {
    runtime: "nodejs20",
    environmentVariables: {
        "DATABASE_PASSWORD": "mySecretPassword123",
        "API_KEY": "AIzaSyAbc123def456ghi789jkl012mno345pqr678",
    },
});

const sqlInstance = new gcp.sql.DatabaseInstance("my-db", {
    databaseVersion: "POSTGRES_15",
    rootPassword: "myHardcodedPassword123",
});

const binding = new gcp.projects.IAMBinding("service-binding", {
    project: "my-project",
    role: "roles/storage.objectViewer",  // Use specific roles instead of broad ones
    members: [
        "serviceAccount:my-app@my-project.iam.gserviceaccount.com",
    ],
    // Avoid overly broad roles like:
    // - roles/owner (full project access)
    // - roles/editor (write access to most resources)
    // Use specific roles: roles/storage.objectViewer, roles/pubsub.publisher, etc.
});

const template = new gcp.compute.InstanceTemplate("my-template", {
    disks: [{
        boot: true,
        sourceImage: "debian-cloud/debian-11",
        diskEncryptionKey: {
            kmsKeySelfLink: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",  // Use CMEK for disk encryption
        },
    }],
    // ... other config
});

const template = new compute.InstanceTemplate("my-template", {
    disks: [{
        boot: true,
        sourceImage: "debian-cloud/debian-11",
        diskEncryptionKey: {
            kmsKeySelfLink: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",  // Enable encryption with KMS key
        },
    }],
    // ... other config
});

const template = new compute.InstanceTemplate("my-template", {
    disks: [{
        boot: true,
        sourceImage: "debian-cloud/debian-11",
        diskEncryptionKey: {
            kmsKeySelfLink: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",  // Enable encryption for all disks
        },
    }],
    // ... other config
});

new gcp.compute.InstanceTemplate("my-template", {
  networkInterfaces: [{
    network: "my-vpc",
    subnetwork: "my-subnet",
    accessConfigs: [], // Empty array disables public IP
  }],
  // ... other config
});

const cryptoKey = new gcp.kms.CryptoKey("my-crypto-key", {
    name: "my-key",
    keyRing: keyRing.id,
    versionTemplate: {
        algorithm: "GOOGLE_SYMMETRIC_ENCRYPTION",  // Specify cryptographic algorithm
        protectionLevel: "HSM",  // Set protection level (SOFTWARE, HSM, EXTERNAL, EXTERNAL_VPC)
    },
    rotationPeriod: "7776000s",  // Optional: Configure 90-day rotation period
    purpose: "ENCRYPT_DECRYPT",  // Optional: Explicitly set key purpose
    // ... other config
});

// Use specific roles instead of overprivileged roles
const cryptoKeyBinding = new gcp.kms.CryptoKeyIAMBinding("key-access", {
    cryptoKeyId: cryptoKey.id,
    role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",  // Use specific role
    members: [
        "serviceAccount:my-service@project.iam.gserviceaccount.com",  // Use specific service accounts
        "group:security-team@example.com",  // Or specific groups
    ],
    // Avoid: roles/owner, roles/editor, roles/cloudkms.admin
    // Avoid: allUsers, allAuthenticatedUsers, domain-wide access
    // ... other config
});

const cryptoKey = new kms.CryptoKey("my-crypto-key", {
    name: "my-key",
    keyRing: keyRing.id,
    destroyScheduledDuration: "2592000s",  // Set 30-day scheduled destruction period
    skipInitialVersionCreation: false,  // Create initial key version
    versionTemplate: {
        algorithm: "GOOGLE_SYMMETRIC_ENCRYPTION",
        protectionLevel: "SOFTWARE",
    },
    // ... other config
});

const cryptoKey = new kms.CryptoKey("my-crypto-key", {
    name: "my-key",
    keyRing: keyRing.id,
    rotationPeriod: "7776000s",  // Enable rotation every 90 days
    versionTemplate: {
        algorithm: "GOOGLE_SYMMETRIC_ENCRYPTION",
        protectionLevel: "SOFTWARE",
    },
    // ... other config
});

// Create a health check
const healthCheck = new gcp.compute.HealthCheck("backend-health-check", {
    httpHealthCheck: {
        port: 80,
        requestPath: "/health",
    },
    checkIntervalSec: 10,
    timeoutSec: 5,
});

// Attach health check to backend service
const backendService = new gcp.compute.BackendService("my-backend", {
    healthChecks: [healthCheck.id],  // Configure health checks for monitoring
    backends: [/* ... */],
    // ... other config
});

import * as gcp from "@pulumi/gcp";

// For global backend service
const backendService = new gcp.compute.BackendService("my-backend", {
    logConfig: {
        enable: true,
        sampleRate: 1.0  // 1.0 = 100% logging, 0.5 = 50% sampling
    },
    // ... other configuration
});

// For regional backend service
const regionBackendService = new gcp.compute.RegionBackendService("my-region-backend", {
    logConfig: {
        enable: true,
        sampleRate: 1.0
    },
    // ... other configuration
});

// Create instance groups in multiple zones
const instanceGroup1 = new gcp.compute.InstanceGroup("backend-zone-a", {
    zone: "us-central1-a",
    instances: [/* ... */],
});

const instanceGroup2 = new gcp.compute.InstanceGroup("backend-zone-b", {
    zone: "us-central1-b",
    instances: [/* ... */],
});

// Configure backend service with multi-zone backends
const backendService = new gcp.compute.BackendService("multi-zone-backend", {
    backends: [
        { group: instanceGroup1.id },  // Backend in zone A
        { group: instanceGroup2.id },  // Backend in zone B for high availability
    ],
    // ... other config
});

import * as gcp from "@pulumi/gcp";

// Create SSL certificate (or use existing)
const sslCert = new gcp.compute.ManagedSslCertificate("my-cert", {
    managed: {
        domains: ["example.com"]
    }
});

// Create HTTPS target proxy
const httpsProxy = new gcp.compute.TargetHttpsProxy("https-proxy", {
    urlMap: urlMap.id,
    sslCertificates: [sslCert.id]
});

// Create forwarding rule on port 443
const httpsForwardingRule = new gcp.compute.GlobalForwardingRule("https-rule", {
    target: httpsProxy.id,
    portRange: "443",
    ipProtocol: "TCP",
    loadBalancingScheme: "EXTERNAL"
});

// Optional: HTTP to HTTPS redirect
const httpProxy = new gcp.compute.TargetHttpProxy("http-proxy", {
    urlMap: redirectUrlMap.id  // URL map configured for redirect
});

const httpForwardingRule = new gcp.compute.GlobalForwardingRule("http-rule", {
    target: httpProxy.id,
    portRange: "80",
    ipProtocol: "TCP",
    loadBalancingScheme: "EXTERNAL"
});

const disk = new compute.Disk("my-disk", {
    diskEncryptionKey: {
        kmsKeySelfLink: "projects/my-project/locations/us-central1/keyRings/my-keyring/cryptoKeys/my-key",  // Use customer-managed KMS key
    },
    // ... other config
});

// Create Service Attachment with manual connection approval
const serviceAttachment = new gcp.compute.ServiceAttachment("psc-service", {
    connectionPreference: "ACCEPT_MANUAL",  // Require manual approval for connections
    consumerAcceptLists: [{
        projectIdOrNum: "consumer-project-123",
        connectionLimit: 10,  // Limit connections to minimize attack surface
    }],
    targetService: backendService.id,
    // ... other config
});

// Create Forwarding Rule for PSC with internal load balancing
const forwardingRule = new gcp.compute.ForwardingRule("psc-endpoint", {
    network: network.id,  // Specify network for proper isolation
    loadBalancingScheme: "INTERNAL",  // Use internal scheme for private connectivity
    target: serviceAttachment.id,
    // ... other config
});

const deadLetterTopic = new gcp.pubsub.Topic("dead-letter-topic", {});

const subscription = new gcp.pubsub.Subscription("my-subscription", {
    topic: topic.name,
    deadLetterPolicy: {
        deadLetterTopic: deadLetterTopic.id,  // Specify dead letter topic
        maxDeliveryAttempts: 5,  // Set max delivery attempts before moving to DLQ
    },
    // ... other config
});

import * as gcp from "@pulumi/gcp";

// Create KMS KeyRing and CryptoKey for encryption
const keyRing = new gcp.kms.KeyRing("pubsub-keyring", {
    name: "pubsub-keyring",
    location: "us-central1"
});

const cryptoKey = new gcp.kms.CryptoKey("pubsub-key", {
    name: "pubsub-encryption-key",
    keyRing: keyRing.id,
    rotationPeriod: "7776000s"  // 90 days
});

// Grant Pub/Sub service account access to the key
const binding = new gcp.kms.CryptoKeyIAMBinding("pubsub-key-binding", {
    cryptoKeyId: cryptoKey.id,
    role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
    members: ["serviceAccount:service-PROJECT_NUMBER@gcp-sa-pubsub.iam.gserviceaccount.com"]
});

// COMPLIANT: Topic with customer-managed encryption key
const topicCompliant = new gcp.pubsub.Topic("encrypted-topic", {
    name: "secure-topic",
    kmsKeyName: cryptoKey.id,  // Compliant: CMEK configured
    messageRetentionDuration: "86400s"
});

// NON-COMPLIANT: Topic without CMEK (uses Google-managed keys)
const topicNonCompliant = new gcp.pubsub.Topic("default-topic", {
    name: "insecure-topic"
    // Missing kmsKeyName - uses default Google-managed encryption
});

const subscription = new gcp.pubsub.Subscription("my-subscription", {
    topic: topic.name,
    messageRetentionDuration: "604800s",  // Set retention to 7 days (in seconds)
    // ... other config
});

const subscriptionIamBinding = new gcp.pubsub.SubscriptionIAMBinding("subscription-subscriber-binding", {
    subscription: subscription.id,
    role: "roles/pubsub.subscriber",  // Use specific role instead of admin/owner/editor
    members: [
        "serviceAccount:app-service@project.iam.gserviceaccount.com",  // Use specific service accounts instead of allUsers
    ],
});

const topicIamBinding = new gcp.pubsub.TopicIAMBinding("topic-publisher-binding", {
    topic: topic.id,
    role: "roles/pubsub.publisher",  // Use specific role instead of admin/owner/editor
    members: [
        "serviceAccount:app-service@project.iam.gserviceaccount.com",  // Use specific service accounts instead of allUsers
    ],
});

const instance = new gcp.compute.Instance("my-instance", {
    labels: {
        environment: "production",  // Required: environment label
        team: "platform",           // Required: team label
        owner: "john-doe",          // Required: owner label
        // ... other labels
    },
    // ... other config
});

// For Cloud SQL instances, use userLabels within settings
const sqlInstance = new gcp.sql.DatabaseInstance("my-database", {
    settings: {
        userLabels: {
            environment: "production",  // Required: environment label
            team: "data",               // Required: team label
            owner: "jane-smith",        // Required: owner label
        },
        // ... other settings
    },
    // ... other config
});

// For GKE clusters, use resourceLabels
const cluster = new gcp.container.Cluster("my-cluster", {
    resourceLabels: {
        environment: "production",  // Required: environment label
        team: "infrastructure",     // Required: team label
        owner: "ops-team",          // Required: owner label
    },
    // ... other config
});

import * as gcp from "@pulumi/gcp";

// Create a KMS KeyRing and CryptoKey
const keyRing = new gcp.kms.KeyRing("my-keyring", {
    name: "secret-keyring",
    location: "us-central1",
});

const cryptoKey = new gcp.kms.CryptoKey("my-key", {
    name: "secret-encryption-key",
    keyRing: keyRing.id,
    rotationPeriod: "7776000s",  // 90 days
});

// Option 1: Auto-replication with customer-managed encryption
const secretAuto = new gcp.secretmanager.Secret("my-secret-auto", {
    secretId: "my-cmek-secret",
    replication: {
        auto: {
            customerManagedEncryption: {
                kmsKeyName: cryptoKey.id,  // Use customer-managed KMS key
            },
        },
    },
});

// Option 2: User-managed replication with customer-managed encryption
const secretUserManaged = new gcp.secretmanager.Secret("my-secret-user", {
    secretId: "my-cmek-secret-regional",
    replication: {
        userManaged: {
            replicas: [
                {
                    location: "us-central1",
                    customerManagedEncryption: {
                        kmsKeyName: cryptoKey.id,  // Use customer-managed KMS key
                    },
                },
                {
                    location: "us-east1",
                    customerManagedEncryption: {
                        kmsKeyName: cryptoKey.id,  // Specify for each replica
                    },
                },
            ],
        },
    },
});

const serviceAccount = new gcp.serviceaccount.Account("app-service-account", {
    accountId: "webapp-backend",  // Use application-specific service account
    displayName: "Web App Backend Service Account",
});

const serviceAccountKey = new gcp.serviceaccount.Key("app-key", {
    serviceAccountId: serviceAccount.name,
    keyAlgorithm: "KEY_ALG_RSA_2048",  // Use RSA_2048 or RSA_4096 for strong encryption
    // Avoid creating keys for default service accounts like:
    // - {project-number}-compute@developer.gserviceaccount.com
    // - {project-id}@appspot.gserviceaccount.com
});

const serviceAccount = new gcp.serviceaccount.Account("backend-service-account", {
    accountId: "webapp-backend",  // Use specific, descriptive names (6-30 chars)
    displayName: "Web Application Backend Service Account",
    // Avoid generic/prohibited names like: default, admin, root, system, compute
    // Use names that describe the service purpose: webapp-backend, data-processor, etc.
});

// Create separate stacks for each environment
// Stack: dev-stack
const devInstance = new gcp.compute.Instance("dev-instance", {
    labels: {
        environment: "development",  // All resources in this stack use "development"
        // ... other labels
    },
    // ... other config
});

// Stack: prod-stack
const prodInstance = new gcp.compute.Instance("prod-instance", {
    labels: {
        environment: "production",  // All resources in this stack use "production"
        // ... other labels
    },
    // ... other config
});

import * as gcp from "@pulumi/gcp";

const subnet = new gcp.compute.Subnetwork("my-subnet", {
    ipCidrRange: "10.0.0.0/24",
    network: network.id,
    region: "us-central1",
    logConfig: {
        aggregationInterval: "INTERVAL_5_SEC",  // or INTERVAL_30_SEC, INTERVAL_1_MIN, etc.
        flowSampling: 1.0,  // 1.0 = 100% sampling, 0.5 = 50%
        metadata: "INCLUDE_ALL_METADATA"
    },
    privateIpGoogleAccess: true
});