Lesson 04 — Compute Engine Security

Welcome

Google Compute Engine (GCE) is Google’s Infrastructure-as-a-Service (IaaS) offering that enables organisations to deploy and manage virtual machines within Google Cloud Platform.

Although cloud-native services continue to grow, virtual machines remain one of the most widely deployed workloads in enterprise environments.

They commonly host:

Business Applications
Web Servers
APIs
Databases
Security Tools
CI/CD Platforms
Kubernetes Nodes
Legacy Applications

For a Cloud Penetration Tester, Compute Engine instances often represent one of the most valuable targets because they combine operating system security with cloud-native identity, networking, and storage configurations.

This lesson introduces Compute Engine from an enterprise security assessment perspective.

Learning Objectives

After completing this lesson, you will be able to:

Understand Google Compute Engine architecture.
Explain Compute Engine deployment models.
Assess Compute Engine security configurations.
Review instance authentication methods.
Understand metadata service security.
Assess persistent disk security.
Review enterprise compute security controls.
Identify common Compute Engine attack surfaces.

Business Scenario

You are conducting an authorised penetration test for CloudNova Technologies.

The customer hosts several production workloads on Google Compute Engine, including:

Linux Web Servers
Windows Application Servers
Internal APIs
Database Servers
Security Appliances
Kubernetes Worker Nodes

Management has requested an assessment of their virtual machine infrastructure to verify that deployments follow Google Cloud security best practices.

Your objective is to review the Compute Engine environment, identify security weaknesses, and provide practical remediation recommendations.

What is Google Compute Engine?

Google Compute Engine is Google’s virtual machine platform.

It enables organisations to deploy scalable virtual machines across Google’s global infrastructure while integrating with cloud-native services such as:

Google Cloud IAM
VPC Networks
Cloud Storage
Secret Manager
Cloud Logging
Google Kubernetes Engine
Cloud Monitoring

Each Compute Engine instance can be configured with different operating systems, networking, storage, and identity settings depending on business requirements.

Compute Engine Architecture

A typical Compute Engine deployment consists of:

Google Cloud Project

↓

VPC Network

↓

Subnet

↓

Compute Engine Instance

↓

Operating System

↓

Persistent Disk

↓

Service Account

↓

Applications

↓

Monitoring & Logging

Understanding how these components interact is essential during a cloud security assessment.

Instance Components

Each virtual machine consists of several security-relevant components.

Compute Resources

Machine Type
CPU
Memory
GPU (optional)

Operating System

Supported operating systems include:

Ubuntu
Debian
Rocky Linux
Red Hat Enterprise Linux
SUSE Linux
Windows Server

Operating system hardening should be reviewed during every assessment.

Persistent Disks

Each VM may contain:

Boot Disk
Data Disks
SSD Storage
Standard Persistent Disks

Review:

Encryption
Snapshot policies
Backup configuration
Access controls

Networking

Each instance may have:

Internal IP Address
External IP Address
Firewall Rules
Network Tags
Service Networking

Publicly accessible instances should receive additional scrutiny during assessments.

Service Accounts

Every Compute Engine instance can be associated with a Google Cloud Service Account.

Service Accounts allow applications running on the VM to interact with Google Cloud APIs.

During an assessment, review:

Assigned Service Account
IAM Roles
Permissions
API Access
Scope of access

Over-privileged Service Accounts are a common security finding.

Metadata Service

Google Compute Engine provides a metadata service that supplies configuration information to virtual machines.

Examples include:

Instance metadata
Startup scripts
Custom metadata
Service Account tokens
SSH configuration

Because metadata contains sensitive operational information, organisations should review its configuration carefully and restrict unnecessary exposure.

Instance Security Configuration

During enterprise reviews, assess:

Secure Boot configuration
Shielded VM settings
OS Login
Serial Port access
Startup scripts
Guest attributes
Automatic updates
Patch management
Administrative access

Document any deviations from organisational standards.

Common Compute Engine Attack Surfaces

Enterprise security reviews commonly focus on:

Public IP addresses
Weak firewall rules
Over-privileged Service Accounts
Outdated operating systems
Weak SSH management
Missing Shielded VM protections
Unnecessary metadata exposure
Poor patch management
Weak administrative controls

These findings can significantly increase the attack surface if not properly managed.

Enterprise Security Best Practices

Well-managed Compute Engine deployments typically:

Minimise public exposure.
Use least-privileged Service Accounts.
Enable Shielded VM features.
Encrypt all persistent disks.
Restrict administrative access.
Implement regular patch management.
Enable Cloud Monitoring and Logging.
Perform regular vulnerability assessments.
Review firewall rules periodically.

Enterprise Skills You Will Develop

By completing this lesson you will learn how to:

Review Compute Engine deployments.
Assess virtual machine security.
Evaluate identity integration.
Review network exposure.
Assess storage security.
Validate enterprise security controls.
Prepare for enterprise compute security assessments.

Key Takeaways

After completing this lesson you should understand:

Google Compute Engine architecture.
Virtual machine security.
Persistent Disk security.
Service Account security.
Metadata service.
Shielded VM features.
Common enterprise attack surfaces.
Compute Engine security best practices.

Knowledge Check

You should now be able to answer:

What is Google Compute Engine?
Why are Service Accounts important for Compute Engine security?
What information is available through the metadata service?
Why should public IP addresses be carefully reviewed?
What are Shielded VMs?
What are the most common Compute Engine security risks?

Next Lesson

➡️ Lesson 05 — Cloud Storage Assessment

In the next lesson, you will learn how to assess Google Cloud Storage, bucket security, object permissions, encryption, public access controls, lifecycle management, and enterprise data protection from a Cloud Penetration Tester’s perspective.