The whole point of this series was to argue that security is a property you set as a default on day 0, not a project you schedule for day N. An argument like that is only worth anything if you are willing to grade yourself honestly at the end, including the parts you did not do. So here is the scorecard for the account these eight parts were built against. What holds up, what does not, and what the whole thing actually cost.
What is genuinely day-0-solid
These were in place before there was anything real to protect, which is the only reason they were cheap.
The root of trust. The state that describes the entire infrastructure is stored encrypted, versioned so a bad write can be rolled back, and locked so two applies cannot race and corrupt it. The thing that can rebuild or destroy everything is itself protected before anything else exists.
Identity before infrastructure. Every workload runs as its own minimal identity with exactly the few grants it needs and nothing account-wide. Deployments authenticate through short-lived federated identity tied to the source repository, so there is no long-lived deploy key sitting anywhere to leak. The honest tension I named earlier stands: the runtime identities are tightly scoped, and the thing that applies infrastructure is necessarily powerful, so that applier is the credential I guard hardest.
Deny by default. Storage blocks public access at every level it can be blocked. The origin is reachable only through the content delivery layer, not directly. A TLS floor is pinned so nothing negotiates down to weak transport. Nothing is reachable unless something explicitly made it so.
Encrypt at rest, redact in the logs. Encryption is the default state, not a feature I turned on. And the deliberate redaction decision holds: the logs are capped so they never record the API key header or the contents of an uploaded file, and retention is bounded rather than left to accumulate forever. More logging is more attack surface, and I logged the useful things without logging the secrets.
The record of who-did-what. Built live in this series, because it was the real gap. The account-wide, multi-region audit trail is on, validating its own integrity with signed digests, and landing in a bucket locked down harder than anything else I run.
A queryable record. Also built live. The trail is not just stored, it is answerable. Real questions, who touched permissions last week, every access to the secret, what one role did, come back in seconds against the full history.
A wake-me alerting tier. A self-hosted metrics and logs stack watches the fleet and pages me when something is actually down, with the honest scope label attached and the restraint to stay quiet otherwise.
What is not covered
This is the part that makes the scorecard honest instead of a victory lap.
Threat detection. There is no managed service watching the account for the signals of compromise: credential exfiltration patterns, resource abuse like crypto-mining, API calls that are unusual for this account. The audit trail records all the raw material, but nothing sits on top of it flagging "this pattern looks like an attack." I can answer questions after I suspect something. Nothing tells me to start suspecting.
Config drift detection. There is no continuous compliance watching resources for changes that violate policy. Terraform catches drift, but only for the resources it manages, and only at the moment I run a plan. Between plans, a change made directly against the account is invisible until the next apply, if it surfaces at all.
Multi-account guardrails. This is the biggest structural gap, and I covered it in the previous part. A single account means no organization, which means no service control policies, which means no enforced rule that survives an administrator's mistake. The guardrails I have are discipline, not walls. Discipline holds until someone is in a hurry.
None of these are covered because none of them are free, and on a footprint this size the honest engineering call was to defer them rather than pretend a small project needs enterprise-grade coverage. Deferring is a legitimate decision. Not knowing you deferred is not.
What security-first actually cost
Money. Less than people expect, which is exactly why the day-0 case is easy to make. The audit trail's management events are effectively free. Data events and the query scans, with tight partitions and lifecycle rules moving old logs to cold storage, come to a few dollars a month. The self-hosted monitoring box is the largest standing line item at roughly thirty to thirty-five dollars a month. Everything else, the encryption, the private-by-default posture, the least-privilege identities, the locked state, costs nothing recurring at all. It is configuration, not a subscription. The three gaps above are the parts that would add real recurring cost, threat detection and config compliance both price per event or per resource, and that pricing is the honest reason a small footprint defers them.
Time. The day-0 groundwork was a few focused days of work, spread across the build rather than spent up front in a block. The audit-trail build was the largest single chunk because it was genuinely new. Everything else was decisions made once, correctly, at the moment the resource was created.
And that is the real cost, the one that does not show up in dollars or hours: discipline. Every one of these controls was cheap only because it was done before there was anything depending on it. An encrypted-by-default policy is a line of configuration on an empty bucket and a migration project on a full one. Least privilege is easy on the first identity and a painful audit on the fiftieth. The audit trail is worth everything if it has been running for six months and worth nothing if you enable it during the incident. The expensive part of security-first is not the work. It is doing the work when there is nothing yet to protect and no incident forcing your hand, when every incentive says ship the feature instead.
The through-line
That is the whole thesis, restated at the end where it can be tested against the receipts. Security is a property you set as a default, not a project you schedule. What you decide before resource one is very close to what you will actually have, because the defaults you skip on day 0 become the debt you never quite find time to pay down. I did not do everything. The scorecard has real gaps, named plainly. But the things I did do were cheap precisely because I did them first, and the things I deferred are deferred with open eyes rather than by accident. That distinction, doing the groundwork early and knowing exactly where the edges are, is what security-first actually means. Not perfect. Honest, and set as a default.
Previous: Know When It Breaks, and Guardrails That Survive a Mistake
The same decision, the other cloud: The Honest Scorecard on GCP