Techzone/Google Cloud Platform (GCP)

Google Cloud Platform (GCP)

3 min readArticle

Google's cloud platform. Third largest provider after AWS and Azure. Strongest in machine learning/AI (TPUs, Vertex AI, BigQuery ML), data analytics, and Kubernetes (GCP invented Kubernetes). Also strong in networking — Google's global backbone is exceptional.

Core Services

Service Equivalent Use
Compute Engine EC2 / Azure VM Virtual machines
Cloud Storage S3 / Azure Blob Object storage
Cloud SQL RDS / Azure SQL Managed databases
BigQuery Redshift Data warehouse / analytics
Cloud Functions Lambda / Azure Functions Serverless
GKE (Kubernetes Engine) EKS / AKS Managed Kubernetes
Cloud IAM AWS IAM Access management
Cloud Armor WAF Web Application Firewall
Cloud Logging CloudTrail / Monitor Logging and audit
VPC VPC / VNet Virtual networking

GCP CLI Setup (gcloud)

bash 
# Install Google Cloud SDK
curl https://sdk.cloud.google.com | bash
exec -l $SHELL
gcloud init

# Or on Linux
sudo apt install google-cloud-sdk

# Authenticate
gcloud auth login

# Set project
gcloud config set project PROJECT_ID

# Show current config
gcloud config list

# Current identity
gcloud auth list

Common Commands

bash 
# List projects
gcloud projects list

# List Compute Engine instances
gcloud compute instances list

# List Cloud Storage buckets
gsutil ls

# List IAM policies
gcloud projects get-iam-policy PROJECT_ID

# List service accounts
gcloud iam service-accounts list

# List GKE clusters
gcloud container clusters list

# List Cloud SQL instances
gcloud sql instances list

Storage (gsutil)

bash 
# List buckets
gsutil ls

# List bucket contents
gsutil ls gs://bucket-name/

# Check bucket permissions
gsutil iam get gs://bucket-name

# Download file
gsutil cp gs://bucket-name/file.txt ./local-file.txt

# Sync bucket
gsutil rsync -r gs://bucket-name/ ./local-dir/

# Check if public (no auth needed)
gsutil ls gs://public-bucket --no-auth
curl https://storage.googleapis.com/BUCKET-NAME/file.txt

Security Misconfigurations

Exposed Cloud Storage

bash 
# Public bucket check
curl https://storage.googleapis.com/BUCKETNAME/
# If returns XML file listing → bucket is public

# Try downloading
gsutil cp gs://target-bucket/sensitive.txt . --no-auth

Metadata Service (SSRF → Credentials)

If you have code execution on a GCP VM:

bash 
# Get service account token from metadata
curl -H "Metadata-Flavor: Google" \
  http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token

# Get all metadata
curl -H "Metadata-Flavor: Google" \
  http://metadata.google.internal/computeMetadata/v1/?recursive=true

# Use token to authenticate
gcloud auth activate-service-account --access-token=TOKEN

Overpermissioned Service Accounts

bash 
# Check what a service account can do
gcloud projects get-iam-policy PROJECT_ID \
  --flatten="bindings[].members" \
  --filter="bindings.members:serviceAccount:*" \
  --format="table(bindings.role,bindings.members)"

# Check if service account has owner/editor
# Owner or Editor on project = full access

GCP-Specific Security Tools

bash 
# ScoutSuite (multi-cloud audit)
pip install scoutsuite
scout gcp --user-account

# Google's Security Command Center
# Check in GCP Console → Security → Security Command Center

GCP vs AWS Terminology

GCP AWS Description
Project Account Billing/resource boundary
VPC VPC Virtual network
Compute Engine EC2 Virtual machines
Cloud Storage S3 Object storage
Cloud IAM IAM Access management
Service Account IAM Role Identity for services
Cloud Functions Lambda Serverless
GKE EKS Managed Kubernetes

See Also

  • aws-amazon-web-services-guide - AWS overview
  • microsoft-azure-guide - Azure overview
  • future-of-tech-emerging-trends-2023 - Cloud computing overview
techzonesite.comUnlock Your IT Potential