— security first cloud · gcp
security, before
the first resource.
security is a day-0 property, not a day-N project. you set the defaults before the first real resource exists, or you inherit debt you never fully pay down. this is the groundwork, in the order you actually do it: the root of trust, least privilege, deny by default, then the record of who did what.
a build log, and an honest one. most of this is running; the part almost everyone skips until after an incident, a durable record you can actually query, is built here in the open, and the last part is a plain scorecard of what is solid and what is still a gap.
the series · 8 parts
- 01→The Root of Trust Comes Before the Automation2026-03-08
You cannot secure the thing that secures everything with the same tool that is able to delete it.
- 02→Identity Before Infrastructure2026-03-22
Least privilege starts at resource one, no workload carries a long-lived key, and even a powerful idle identity is a risk worth removing.
- 03→The Network Says No First2026-04-05
Nothing is reachable unless it is explicitly allowed, the one path in is narrowed to a single source, and the edge rejects the obvious attacks before they land.
- 04→Encrypt by Default, and Write Down Why the One Wide Grant Is Safe2026-04-19
Encryption is a default rather than a feature, and the single broad allow that could not be avoided carries its compensating-control argument written next to it.
- 05→The Record of Who Did What, Turned On Before You Need It2026-05-03
Most teams turn on the full audit trail the day after an incident asks for it. On a security-first build you turn it on when the project is still empty.
- 06→A Receipt You Cannot Read Is Not a Record2026-05-17
An audit trail you cannot ask questions of is a receipt you will never read. This is the part where I route the record to durable storage and answer the first questions that actually matter.
- 07→Wake Me When It Breaks, and Guardrails That Survive a Mistake2026-05-31
Two different promises: something tells a human when the thing is down, and the safety policy cannot be casually switched off by the next hasty change.
- 08→The Honest Scorecard: What Is Solid, What Is Still a Gap, What It Cost2026-06-14
The security you set up before shipping is only worth anything if you are honest about where it stops. Here is what is genuinely day-0-solid, what is still missing, and what security-first actually cost.
the same day-0 decisions, the other way, are in Security First Cloud: AWS. the rest of the writing lives in the garden.