Lesson 1: The Google Cloud Security Map on One Page

Why start with a map?

If you open the Google Cloud console and type "security", you get dozens of products back. Some are services you turn on. Some are features inside other services. Some go by a name that changed two years ago, but the old name lives on in the Terraform module your predecessor wrote. Before you can choose anything (that is the rest of this course), you need one page that answers three questions about every service:

1. What job does it do? We sort services into seven job groups.
2. What was it called before? Old names hide in docs, blog posts, API hostnames and vendor slides.
3. Is it still for sale? Some services, or tiers of them, are deprecated and have a shutdown date.

Think of it as the floor plan of a building you have just been handed the keys to. You don't need to know how every room is wired yet, but you do need to know which door leads where.

The seven job groups

Trade-off note: Some services cover more than one job. VPC Service Controls stops data from leaving a perimeter, so it sits under data protection, but it also uses access levels from Access Context Manager, which is a zero trust idea. Workload Identity Federation lets machines outside Google Cloud sign in, but it is configured in IAM, so it sits under access control. When a service fits two groups, file it under the job you would buy it for and note the other.

Former names: the decoder ring

This is where real projects trip people up. A 2022 runbook says "enable BeyondCorp". A Terraform module creates google_data_loss_prevention_* resources. Neither one is wrong. They just use the old names.

Gotcha: A product rename almost never renames the API. If you search your org's enabled APIs for "Sensitive Data Protection", you get nothing back. Search for dlp.

Walkthrough: find old names in your own estate

# 1. Which security-related APIs are enabled in this project?
#    Filter on API hostnames, not marketing names.
gcloud services list --enabled \
  --filter="config.name~(dlp|beyondcorp|cloudkms|secretmanager|privateca|iap|securitycenter|accesscontextmanager)" \
  --format="value(config.name)"

# Example output:
# cloudkms.googleapis.com
# dlp.googleapis.com            <- this is Sensitive Data Protection
# iap.googleapis.com
# secretmanager.googleapis.com

# 2. Grep your infrastructure repo for legacy names so docs and
#    reviewers use the current ones.
grep -rniE "beyondcorp|cloud dlp|data_loss_prevention|chronicle" ./terraform ./docs

# Example output:
# terraform/dlp.tf:3:resource "google_data_loss_prevention_inspect_template" "pii" {
# docs/runbook.md:41:Ask the BeyondCorp admin to add the user...

Don't rename the Terraform resource types, because the provider still uses them. Do update the prose in runbooks so a new joiner can find the current docs.

Is it retiring? Read the deprecations page

Every major Google Cloud service publishes a Deprecations page, and usually also release notes. Check them before you design around a service, and again before you renew a contract.

# How to find it
1. Open the service's docs, e.g. docs.cloud.google.com/security-command-center/docs
2. Look for "Deprecations" in the left nav (or search "<service> deprecations")
3. Read the table: feature | deprecation date | shutdown date
4. Cross-check the release notes for the same date

Here is what the Security Command Center (SCC) page shows as of October 2026:

What this means in practice: the SCC service itself is fine, with the Standard and Premium tiers carrying on. The Enterprise tier is deprecated, and organisations still on it move to Premium by default on or after 21 May 2027. If a vendor slide pitches "SCC Enterprise" for a new build, push back. You would be designing around a tier that has an end date.

Best practice: Deprecation is a property of a tier or feature, not always of a whole service. Record it at that level: "SCC: active; Enterprise tier: deprecated, shutdown 2027-05-21." Ask your account team whether a deprecated tier can still be newly activated, because the deprecations page records dates and doesn't always spell out sales policy.

Key takeaways

• Sort every service by the job it does, using seven groups: workforce and customer identity; access control and governance; keys, secrets and certificates; threat detection and posture; logging and audit; data protection; zero trust access.
• Learn the decoder ring: BeyondCorp Enterprise → Chrome Enterprise Premium, Cloud DLP → Sensitive Data Protection, Chronicle → Google Security Operations.
• A rename rarely changes the API name. Search for dlp.googleapis.com and beyondcorp.googleapis.com.
• The deprecations page gives deprecation and shutdown dates for features and tiers. SCC Enterprise was deprecated on 21 May 2026 and shuts down on 21 May 2027.
• Record lifecycle status per tier or feature, with dates, in every selection note.