Resource Hierarchy and IAM
GCP's resource hierarchy-Organisation → Folders → Projects → Resources-determines how IAM policies are inherited. Testing evaluates IAM bindings at each level, identifies overpermissive bindings that cascade downward, checks for the dreaded default compute service account with Editor role (present in most GCP environments), and verifies that organisation policies enforce security baselines across all projects.
Service Account Security
Service accounts in GCP are both identities and resources-they can be impersonated, have keys exported, and delegate access to other accounts. Testing evaluates service account key management (exported keys vs workload identity), impersonation permissions, and whether service accounts follow least-privilege. The default Compute Engine and App Engine service accounts frequently have Project Editor permissions-providing broad access that any compromised workload inherits.
Cloud Storage and BigQuery
GCS bucket testing evaluates uniform vs fine-grained access control, public access prevention, and bucket-level IAM versus ACLs. BigQuery testing covers dataset permissions, authorised views, and column-level security. For organisations using GCP primarily for data analytics, BigQuery security testing is often the highest priority.
GKE Security
Google Kubernetes Engine testing overlaps with general Kubernetes security (covered in our dedicated guide) but includes GKE-specific concerns: Workload Identity configuration, node pool security settings, Binary Authorisation for container image verification, and integration with GCP IAM for cluster access control.
Testing GCP with Penetrify
Penetrify's GCP security testing evaluates the resource hierarchy, IAM bindings, service account configurations, Cloud Storage, BigQuery, and GKE with practitioners who understand Google's specific security model and its unique default configuration patterns.
The Bottom Line
GCP's defaults are often more permissive than AWS or Azure's-default service accounts with Editor, legacy API access enabled, and broad project-level permissions. Testing must evaluate these GCP-specific patterns. Penetrify delivers this expertise.