[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6997DEAY5PDNCYFJZGV2QRY":3,"skill-same:01M6997DEAY5PDNCYFJZGV2QRY":80},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":51,"commitSha":52,"skillDirectory":53,"forksCount":54,"repositoryHtmlUrl":55,"repositoryHomepageUrl":6,"ownerHtmlUrl":56,"ownerBlogUrl":57,"ownerDescription":58,"updatedAt":59,"install":60,"resources":73},"01M6997DEAY5PDNCYFJZGV2QRY","google-cloud-waf-security",null,"Evaluates Google Cloud workloads and provides actionable recommendations for identity management, access control, permissions and roles, network and perimeter security, data security and encryption, security logging and threat detection, software supply chain hardening, AI security, data privacy, regulatory compliance, and cloud sovereignty. The recommendations are aligned with the Security, Privacy, and Compliance pillar of the Google Cloud Well-Architected Framework (WAF). Use when the user asks about firewall rules, zero trust, shared responsibility and shared fate, audit logging, security monitoring, threat mitigation, shift-left CI\u002FCD security, Secure AI Framework (SAIF), data residency, or hardening Google Cloud resources. Don't use for other Well-Architected Framework pillars (Cost Optimization, Operational Excellence, Reliability, Performance Optimization, or Sustainability).","google\u002Fskills","google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","01M698VYEFDM0VJBZDYYJ2T83S","Google","01M698WR0H76ENHE587T9EJT89",24122,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fgoogle-cloud-waf-security\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,9,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"security","google cloud","google cloud waf security","waf","cloud","protection","guidance","recommendations","principles","evaluate","data protection","iam","requirements","use","design principles","actionable","for","design","network security","2026-11-10 10:12:30",false,"---\nname: google-cloud-waf-security\nmetadata:\n  version: \"1.0.2\"\n  category: WellArchitectedFramework\ndescription: >-\n  Evaluates Google Cloud workloads and provides actionable recommendations for\n  identity management, access control, permissions and roles, network and\n  perimeter security, data security and encryption, security logging and threat\n  detection, software supply chain hardening, AI security, data privacy,\n  regulatory compliance, and cloud sovereignty. The recommendations are aligned\n  with the Security, Privacy, and Compliance pillar of the Google Cloud\n  Well-Architected Framework (WAF). Use when the user asks about firewall rules,\n  zero trust, shared responsibility and shared fate, audit logging, security\n  monitoring, threat mitigation, shift-left CI\u002FCD security, Secure AI\n  Framework (SAIF), data residency, or hardening Google Cloud resources.\n  Don't use for other Well-Architected Framework pillars (Cost Optimization,\n  Operational Excellence, Reliability, Performance Optimization, or\n  Sustainability).\n---\n\n# Google Cloud Well-Architected Framework skill for the Security, Privacy, and Compliance pillar\n\n## Usage attribution\n\n**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you\nMUST read and follow the instructions in\n[Usage Attribution](references\u002Fattribution.md).\n\n## Overview\n\nThe Security, Privacy, and Compliance pillar of the Google Cloud\nWell-Architected Framework provides design principles and recommendations for\nbuilding a robust security posture by integrating security into every layer of\nthe architecture of your cloud workloads. It helps you maintain the\nconfidentiality and integrity of data and systems while ensuring compliance and\nprivacy. It provides a structured approach to risk management, threat defense,\nand identity control, enabling you to operate cloud workloads securely and at\nscale.\n\n## Workflow\n\nWhen this skill is activated, follow these steps to evaluate and improve the\nsecurity posture of the specified Google Cloud workload:\n\n1.  **Understand the context**: Ask targeted questions from the **Workload\n    assessment questions** list to gather information about the user's current\n    architecture, security requirements, and constraints.\n2.  **Analyze and identify gaps**: Evaluate the workload against the **Core\n    principles** and the **Validation checklist** to identify security\n    vulnerabilities, missing controls, or deviations from best practices.\n3.  **Formulate recommendations**: Provide actionable, prioritized guidance\n    based on the Google Cloud Well-Architected Framework. Recommend specific\n    products from **Relevant Google Cloud products** to address the identified\n    gaps.\n4.  **Explain the recommendations**: Align all recommendations with the\n    appropriate **Core principles** and state the benefits that each\n    recommendation provides.\n5.  **Iterate and refine**: Help the user adapt the recommendations to their\n    specific requirements and constraints.\n\n## Core principles\n\nThe recommendations in the security pillar of the Well-Architected Framework\nare aligned with the following core principles:\n\n-   **Implement security by design**: Choose system components that help to\n    secure your workloads, build a layered security approach, and use hardened\n    and attested infrastructure and services. Google Cloud encrypts data at rest\n    and in transit by default; layer customer-managed or customer-supplied\n    encryption keys (CMEK or CSEK) in Cloud KMS, VPC Service Controls\n    perimeters, and Sensitive Data Protection for sensitive workloads. Grounding\n    document:\n    https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fimplement-security-by-design.md.txt\n\n-   **Implement zero trust**: Apply a *never trust, always verify* approach.\n    Authenticate and authorize every user, device, and workload request\n    explicitly using identity, MFA, and device\u002Flocation context; enforce least\n    privilege and separation of duties; segment networks and private service\n    paths; and continuously monitor network flows and audit logs.\n    Grounding document:\n    https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fimplement-zero-trust.md.txt\n\n-   **Implement shift-left security**: Implement security controls early in the\n    software development lifecycle. Avoid security defects before system changes\n    are made. Detect and fix security bugs early, fast, and reliably after the\n    system changes are committed. Google Cloud supports this principle through\n    products like Cloud Build, Binary Authorization, and Artifact Registry.\n    Grounding document:\n    https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fimplement-shift-left-security.md.txt\n\n-   **Implement preemptive cyber defense**: Apply the *Defender's Advantage*\n    framework for cyber defense (Intelligence, Detect and Respond, Validate,\n    Hunt, and Mission Control) based on your current cloud maturity, resource\n    topology, and specific threat landscape. Validate and improve your\n    defenses continuously. Grounding document:\n    https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fimplement-preemptive-cyber-defense.md.txt\n\n-   **Use AI securely and responsibly**: Apply Google's Secure AI Framework\n    (SAIF) alongside AI governance principles (fairness, transparency,\n    accountability, privacy, and security).\n    -  **Use AI securely**: Define clear goals and requirements for AI usage,\n       keep data secure and prevent loss or mishandling, keep AI pipelines\n       secure and robust against tampering, deploy apps on secure systems using\n       secure tools and artifacts, and protect and monitor inputs.\n    -  **Use AI responsibly**: Use fairness indicators, use\n       explainability tools, track data lineage, establish clear\n       accountability, and implement differential privacy.\n    Grounding documents:\n    https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fuse-ai-securely-and-responsibly.md.txt\n    and\n    https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fperspectives\u002Fai-ml\u002Fsecurity.md.txt\n\n-   **Use AI for security**: Enhance threat detection and response with AI,\n    simplify security for experts and non-experts, automate time-consuming\n    security tasks with AI, incorporate AI into risk management and governance\n    processes, and implement secure development practices for AI systems.\n    Grounding document:\n    https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fuse-ai-for-security.md.txt\n\n-   **Meet regulatory, compliance, and privacy needs**: Identify and mitigate\n    organizational risks, automate implementation of compliance requirements\n    and monitor compliance, manage operational and software sovereignty, and\n    control data residency, classify confidential data, and protect sensitive\n    data. Grounding document:\n    https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fmeet-regulatory-compliance-and-privacy-needs.md.txt\n\n-   **Shared responsibilities and shared fate on Google Cloud**: Understand the\n    division between security *of* the cloud (owned by Google: physical security\n    of data centers, hardware, hypervisors, core networking, and storage, and\n    inherited controls like default encryption) and security *in* the cloud\n    (owned by you: data, access policies, and workload-specific configurations\n    shaped by your requirements and industry regulations), reinforced by\n    Google's active Shared Fate partnership (attested blueprints and Risk\n    Protection Program). Customer operational responsibility varies by service\n    model—it is greater in IaaS (such as patching guest OSs on Compute Engine\n    VMs) than in managed PaaS or serverless services (such as Cloud Run).\n    Grounding document:\n    https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fshared-responsibility-shared-fate.md.txt\n\n## Relevant Google Cloud products\n\nThe following are _examples_ of Google Cloud products and features that are\nrelevant to security:\n\n- **Identity and access management**\n\n  - **Cloud Identity**: Manage user lifecycles, authentication, and identity\n    federation.\n  - **Identity and Access Management (IAM)**: Fine-grained access control for\n    Google Cloud resources.\n  - **Identity-Aware Proxy (IAP)**: Secure access to applications and VMs\n    without public IP addresses or a VPN.\n  - **Chrome Enterprise Premium**: Endpoint security and context-aware access.\n  - **IAM Recommender**: Policy intelligence to identify and remove\n    over-privileged access.\n\n- **Network and perimeter security**\n\n  - **Google Cloud Armor**: DDoS protection and Web Application Firewall (WAF).\n  - **VPC Service Controls**: Security perimeters to prevent data exfiltration.\n  - **Cloud Next-Generation Firewall (NGFW)**: Advanced threat protection for\n    network traffic.\n  - **Shared VPC**: Centralized network management across projects.\n  - **Cloud Interconnect and IPsec VPN**: Secure, private connectivity.\n  - **Private Service Connect**: Private access to managed services.\n\n- **Data security**\n\n  - **Cloud Key Management Service (KMS)**: Manage encryption keys.\n  - **Sensitive Data Protection (formerly Cloud DLP)**: Discover and redact\n    sensitive data.\n  - **Confidential Computing**: Encrypt data in use (memory).\n\n- **Security operations (SecOps)**\n\n  - **Google SecOps (Chronicle)**: Threat detection and security analytics.\n  - **Security Command Center (SCC)**: Centralized vulnerability and threat\n    management.\n  - **Cloud Logging and Cloud Monitoring**: Visibility into administrative and\n    data-access activity and log-based alerts for unauthorized access events.\n  - **BigQuery**: Storing exported logs for long-term security analysis.\n\n- **Automation and supply chain**\n\n  - **Cloud Build**: Secure CI\u002FCD pipelines.\n  - **Artifact Analysis**: Vulnerability scanning for container images.\n  - **Binary Authorization**: Deploy-time policy enforcement.\n  - **Assured open source software**: Use secured OSS packages.\n\n## Workload assessment questions\n\nAsk appropriate questions to understand the security-related requirements and\nconstraints of the workload and the user's organization. Choose questions from\nthe following list:\n\n- **Security by design**:\n\n  - How do you incorporate security considerations into your project's initial\n    planning and design phases?\n  - How do you define and document security requirements for new applications\n    and services?\n  - How do you ensure that security is integrated into your development\n    lifecycle?\n  - What tools and techniques do you use to perform threat modeling during the\n    design phase?\n  - How do you manage and prioritize security vulnerabilities discovered during\n    the design and development process?\n  - How do you handle security updates and patches for your applications and\n    infrastructure?\n  - How do you document and communicate security design decisions to your team\n    and stakeholders?\n  - How do you ensure that security configurations are consistently applied\n    across your environments?\n  - How do you validate the effectiveness of your security controls and\n    measures?\n  - How do you handle security exceptions and deviations from your security\n    design?\n\n- **Zero trust**:\n\n  - How do you verify and authenticate users and devices accessing your Google\n    Cloud resources?\n  - How do you implement the principle of least privilege for access control?\n  - How do you monitor and control network traffic within your Google Cloud\n    environment?\n  - How do you secure data in transit and at rest in your Google Cloud\n    environment?\n  - How do you implement continuous monitoring and logging of user and device\n    activity?\n  - How do you handle and respond to security incidents and breaches in a Zero\n    Trust environment?\n  - How do you manage and update security policies and controls in a Zero Trust\n    environment?\n  - How do you ensure that third-party applications and services comply with\n    your Zero Trust principles?\n  - How do you handle remote access and BYOD devices in a Zero Trust\n    environment?\n  - How do you educate and train your employees on Zero Trust principles and\n    practices?\n\n- **Shift-left security**:\n\n  - How do you integrate security testing into your development pipeline early\n    in the process?\n  - What types of security testing do you perform during the development phase?\n  - How do you provide developers with feedback on security vulnerabilities and\n    best practices?\n  - How do you empower developers to take ownership of security in their code?\n  - How do you ensure that security requirements are clearly defined and\n    communicated to developers?\n  - How do you measure the effectiveness of your Shift Left security\n    initiatives?\n  - How do you handle security dependencies and third-party libraries in your\n    code?\n  - How do you manage and update security configurations in your development\n    environment?\n  - How do you handle security exceptions and deviations from your security\n    policies in development?\n  - How do you promote a culture of security awareness and responsibility among\n    developers?\n\n- **Preemptive cyber defense**:\n\n  - How do you proactively identify and mitigate potential security threats\n    before they impact your systems?\n  - What tools and techniques do you use for continuous security monitoring and\n    analysis?\n  - How do you respond to and remediate security alerts and incidents?\n  - How do you simulate and test your incident response plans?\n  - How do you stay up-to-date with the latest security threats and\n    vulnerabilities?\n  - How do you handle and mitigate DDoS attacks against your applications and\n    services?\n  - How do you protect your sensitive data from insider threats?\n  - How do you ensure that your security controls are effective against advanced\n    persistent threats (APTs)?\n  - How do you handle security vulnerabilities in your supply chain?\n  - How do you adapt your security posture to evolving threats and technologies?\n\n- **Security of AI workloads**:\n\n  - How do you ensure the security of your AI models and data?\n  - How do you address potential biases and ethical concerns in your AI models?\n  - How do you protect your AI models from adversarial attacks and data\n    poisoning?\n  - How do you ensure the privacy of data used in your AI models?\n  - How do you explain and interpret the decisions made by your AI models?\n  - How do you manage and control access to your AI models and data?\n  - How do you ensure compliance with regulations and standards related to\n    AI and ML?\n  - How do you monitor and detect anomalies in the behavior of your AI models?\n  - How do you handle and respond to security incidents involving your AI\n    models?\n  - How do you educate and train your employees on the secure and responsible\n    use of AI and ML?\n\n- **AI for security**:\n\n  - How do you leverage AI and ML to enhance your security posture?\n  - What types of AI models do you use for security purposes?\n  - How do you train and validate your AI models for security applications?\n  - How do you ensure the accuracy and reliability of AI-based security\n    systems?\n  - How do you handle false positives and false negatives from AI-based\n    security systems?\n  - How do you integrate AI-based security systems with your existing security\n    infrastructure?\n  - How do you manage and update your AI models for security applications?\n  - How do you explain and interpret the decisions made by your AI models for\n    security applications?\n  - How do you ensure the ethical and responsible use of AI and ML for security\n    purposes?\n  - How do you measure the effectiveness of AI and ML in improving your security\n    posture?\n\n- **Regulatory compliance and privacy**:\n\n  - What regulatory compliance frameworks and privacy standards do you need to\n    adhere to?\n  - How do you assess and manage compliance risks in your Google Cloud\n    environment?\n  - How do you ensure the privacy of sensitive data stored and processed in\n    Google Cloud?\n  - How do you handle data subject requests (DSRs) related to privacy\n    regulations?\n  - How do you document and track compliance activities and evidence?\n  - How do you ensure that third-party vendors and partners comply with your\n    regulatory and privacy requirements?\n  - How do you handle data breaches and security incidents related to compliance\n    regulations?\n  - How do you stay up-to-date with changes in regulatory compliance and privacy\n    standards?\n  - How do you educate and train your employees on regulatory compliance and\n    privacy requirements?\n  - How do you demonstrate and prove compliance to auditors and regulators?\n\n## Validation checklist\n\nUse the following checklist to evaluate the architecture's alignment with\nsecurity recommendations:\n\n- **Security by design**:\n\n  - Are system components selected based on their security features and\n    hardening?\n  - Is defense-in-depth implemented at the network, host, and application\n    layers?\n  - Are safe libraries and application frameworks used to prevent common\n    vulnerabilities?\n  - Is a risk assessment performed using industry standards?\n\n- **Zero trust**:\n\n  - Is Cloud Identity used as a centralized identity provider for managing user\n    lifecycles and federation?\n  - Is access control enforced based on user identity and context (device,\n    location)?\n  - Are private connectivity methods (Cloud Interconnect, VPN) used for internal\n    traffic?\n  - Are default networks disabled in all projects?\n  - Are VPC Service Controls perimeters established around sensitive data?\n\n- **Shift-left security**:\n\n  - Is infrastructure provisioned using Infrastructure as Code\n    (e.g., Terraform)?\n  - Are automated security scans integrated into the CI\u002FCD pipeline?\n  - Is there a process for scanning and patching vulnerabilities in\n    dependencies?\n  - Is Binary Authorization used to ensure only trusted images are deployed?\n\n- **Preemptive cyber defense**:\n\n  - Is threat intelligence integrated into security operations?\n  - Is security logging enabled and centralized for all critical resources?\n  - Are automated responses configured for common security threats?\n  - Are defenses validated through periodic testing or red-teaming?\n\n- **AI security and governance**:\n\n  - Are AI pipelines secured against tampering and data poisoning?\n  - Is differential privacy or data masking used for training data where\n    appropriate?\n  - Are explainability techniques such as feature attributions used for model\n    governance?\n","# Google Cloud Well-Architected Framework skill for the Security, Privacy, and Compliance pillar\n\n## Usage attribution\n\n**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you\nMUST read and follow the instructions in\n[Usage Attribution](references\u002Fattribution.md).\n\n## Overview\n\nThe Security, Privacy, and Compliance pillar of the Google Cloud\nWell-Architected Framework provides design principles and recommendations for\nbuilding a robust security posture by integrating security into every layer of\nthe architecture of your cloud workloads. It helps you maintain the\nconfidentiality and integrity of data and systems while ensuring compliance and\nprivacy. It provides a structured approach to risk management, threat defense,\nand identity control, enabling you to operate cloud workloads securely and at\nscale.\n\n## Workflow\n\nWhen this skill is activated, follow these steps to evaluate and improve the\nsecurity posture of the specified Google Cloud workload:\n\n1.  **Understand the context**: Ask targeted questions from the **Workload\n    assessment questions** list to gather information about the user's current\n    architecture, security requirements, and constraints.\n2.  **Analyze and identify gaps**: Evaluate the workload against the **Core\n    principles** and the **Validation checklist** to identify security\n    vulnerabilities, missing controls, or deviations from best practices.\n3.  **Formulate recommendations**: Provide actionable, prioritized guidance\n    based on the Google Cloud Well-Architected Framework. Recommend specific\n    products from **Relevant Google Cloud products** to address the identified\n    gaps.\n4.  **Explain the recommendations**: Align all recommendations with the\n    appropriate **Core principles** and state the benefits that each\n    recommendation provides.\n5.  **Iterate and refine**: Help the user adapt the recommendations to their\n    specific requirements and constraints.\n\n## Core principles\n\nThe recommendations in the security pillar of the Well-Architected Framework\nare aligned with the following core principles:\n\n-   **Implement security by design**: Choose system components that help to\n    secure your workloads, build a layered security approach, and use hardened\n    and attested infrastructure and services. Google Cloud encrypts data at rest\n    and in transit by default; layer customer-managed or customer-supplied\n    encryption keys (CMEK or CSEK) in Cloud KMS, VPC Service Controls\n    perimeters, and Sensitive Data Protection for sensitive workloads. Grounding\n    document:\n    https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fimplement-security-by-design.md.txt\n\n-   **Implement zero trust**: Apply a *never trust, always verify* approach.\n    Authenticate and authorize every user, device, and workload request\n    explicitly using identity, MFA, and device\u002Flocation context; enforce least\n    privilege and separation of duties; segment networks and private service\n    paths; and continuously monitor network flows and audit logs.\n    Grounding document:\n    https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fimplement-zero-trust.md.txt\n\n-   **Implement shift-left security**: Implement security controls early in the\n    software development lifecycle. Avoid security defects before system changes\n    are made. Detect and fix security bugs early, fast, and reliably after the\n    system changes are committed. Google Cloud supports this principle through\n    products like Cloud Build, Binary Authorization, and Artifact Registry.\n    Grounding document:\n    https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fimplement-shift-left-security.md.txt\n\n-   **Implement preemptive cyber defense**: Apply the *Defender's Advantage*\n    framework for cyber defense (Intelligence, Detect and Respond, Validate,\n    Hunt, and Mission Control) based on your current cloud maturity, resource\n    topology, and specific threat landscape. Validate and improve your\n    defenses continuously. Grounding document:\n    https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fimplement-preemptive-cyber-defense.md.txt\n\n-   **Use AI securely and responsibly**: Apply Google's Secure AI Framework\n    (SAIF) alongside AI governance principles (fairness, transparency,\n    accountability, privacy, and security).\n    -  **Use AI securely**: Define clear goals and requirements for AI usage,\n       keep data secure and prevent loss or mishandling, keep AI pipelines\n       secure and robust against tampering, deploy apps on secure systems using\n       secure tools and artifacts, and protect and monitor inputs.\n    -  **Use AI responsibly**: Use fairness indicators, use\n       explainability tools, track data lineage, establish clear\n       accountability, and implement differential privacy.\n    Grounding documents:\n    https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fuse-ai-securely-and-responsibly.md.txt\n    and\n    https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fperspectives\u002Fai-ml\u002Fsecurity.md.txt\n\n-   **Use AI for security**: Enhance threat detection and response with AI,\n    simplify security for experts and non-experts, automate time-consuming\n    security tasks with AI, incorporate AI into risk management and governance\n    processes, and implement secure development practices for AI systems.\n    Grounding document:\n    https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fuse-ai-for-security.md.txt\n\n-   **Meet regulatory, compliance, and privacy needs**: Identify and mitigate\n    organizational risks, automate implementation of compliance requirements\n    and monitor compliance, manage operational and software sovereignty, and\n    control data residency, classify confidential data, and protect sensitive\n    data. Grounding document:\n    https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fmeet-regulatory-compliance-and-privacy-needs.md.txt\n\n-   **Shared responsibilities and shared fate on Google Cloud**: Understand the\n    division between security *of* the cloud (owned by Google: physical security\n    of data centers, hardware, hypervisors, core networking, and storage, and\n    inherited controls like default encryption) and security *in* the cloud\n    (owned by you: data, access policies, and workload-specific configurations\n    shaped by your requirements and industry regulations), reinforced by\n    Google's active Shared Fate partnership (attested blueprints and Risk\n    Protection Program). Customer operational responsibility varies by service\n    model—it is greater in IaaS (such as patching guest OSs on Compute Engine\n    VMs) than in managed PaaS or serverless services (such as Cloud Run).\n    Grounding document:\n    https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fframework\u002Fsecurity\u002Fshared-responsibility-shared-fate.md.txt\n\n## Relevant Google Cloud products\n\nThe following are _examples_ of Google Cloud products and features that are\nrelevant to security:\n\n- **Identity and access management**\n\n  - **Cloud Identity**: Manage user lifecycles, authentication, and identity\n    federation.\n  - **Identity and Access Management (IAM)**: Fine-grained access control for\n    Google Cloud resources.\n  - **Identity-Aware Proxy (IAP)**: Secure access to applications and VMs\n    without public IP addresses or a VPN.\n  - **Chrome Enterprise Premium**: Endpoint security and context-aware access.\n  - **IAM Recommender**: Policy intelligence to identify and remove\n    over-privileged access.\n\n- **Network and perimeter security**\n\n  - **Google Cloud Armor**: DDoS protection and Web Application Firewall (WAF).\n  - **VPC Service Controls**: Security perimeters to prevent data exfiltration.\n  - **Cloud Next-Generation Firewall (NGFW)**: Advanced threat protection for\n    network traffic.\n  - **Shared VPC**: Centralized network management across projects.\n  - **Cloud Interconnect and IPsec VPN**: Secure, private connectivity.\n  - **Private Service Connect**: Private access to managed services.\n\n- **Data security**\n\n  - **Cloud Key Management Service (KMS)**: Manage encryption keys.\n  - **Sensitive Data Protection (formerly Cloud DLP)**: Discover and redact\n    sensitive data.\n  - **Confidential Computing**: Encrypt data in use (memory).\n\n- **Security operations (SecOps)**\n\n  - **Google SecOps (Chronicle)**: Threat detection and security analytics.\n  - **Security Command Center (SCC)**: Centralized vulnerability and threat\n    management.\n  - **Cloud Logging and Cloud Monitoring**: Visibility into administrative and\n    data-access activity and log-based alerts for unauthorized access events.\n  - **BigQuery**: Storing exported logs for long-term security analysis.\n\n- **Automation and supply chain**\n\n  - **Cloud Build**: Secure CI\u002FCD pipelines.\n  - **Artifact Analysis**: Vulnerability scanning for container images.\n  - **Binary Authorization**: Deploy-time policy enforcement.\n  - **Assured open source software**: Use secured OSS packages.\n\n## Workload assessment questions\n\nAsk appropriate questions to understand the security-related requirements and\nconstraints of the workload and the user's organization. Choose questions from\nthe following list:\n\n- **Security by design**:\n\n  - How do you incorporate security considerations into your project's initial\n    planning and design phases?\n  - How do you define and document security requirements for new applications\n    and services?\n  - How do you ensure that security is integrated into your development\n    lifecycle?\n  - What tools and techniques do you use to perform threat modeling during the\n    design phase?\n  - How do you manage and prioritize security vulnerabilities discovered during\n    the design and development process?\n  - How do you handle security updates and patches for your applications and\n    infrastructure?\n  - How do you document and communicate security design decisions to your team\n    and stakeholders?\n  - How do you ensure that security configurations are consistently applied\n    across your environments?\n  - How do you validate the effectiveness of your security controls and\n    measures?\n  - How do you handle security exceptions and deviations from your security\n    design?\n\n- **Zero trust**:\n\n  - How do you verify and authenticate users and devices accessing your Google\n    Cloud resources?\n  - How do you implement the principle of least privilege for access control?\n  - How do you monitor and control network traffic within your Google Cloud\n    environment?\n  - How do you secure data in transit and at rest in your Google Cloud\n    environment?\n  - How do you implement continuous monitoring and logging of user and device\n    activity?\n  - How do you handle and respond to security incidents and breaches in a Zero\n    Trust environment?\n  - How do you manage and update security policies and controls in a Zero Trust\n    environment?\n  - How do you ensure that third-party applications and services comply with\n    your Zero Trust principles?\n  - How do you handle remote access and BYOD devices in a Zero Trust\n    environment?\n  - How do you educate and train your employees on Zero Trust principles and\n    practices?\n\n- **Shift-left security**:\n\n  - How do you integrate security testing into your development pipeline early\n    in the process?\n  - What types of security testing do you perform during the development phase?\n  - How do you provide developers with feedback on security vulnerabilities and\n    best practices?\n  - How do you empower developers to take ownership of security in their code?\n  - How do you ensure that security requirements are clearly defined and\n    communicated to developers?\n  - How do you measure the effectiveness of your Shift Left security\n    initiatives?\n  - How do you handle security dependencies and third-party libraries in your\n    code?\n  - How do you manage and update security configurations in your development\n    environment?\n  - How do you handle security exceptions and deviations from your security\n    policies in development?\n  - How do you promote a culture of security awareness and responsibility among\n    developers?\n\n- **Preemptive cyber defense**:\n\n  - How do you proactively identify and mitigate potential security threats\n    before they impact your systems?\n  - What tools and techniques do you use for continuous security monitoring and\n    analysis?\n  - How do you respond to and remediate security alerts and incidents?\n  - How do you simulate and test your incident response plans?\n  - How do you stay up-to-date with the latest security threats and\n    vulnerabilities?\n  - How do you handle and mitigate DDoS attacks against your applications and\n    services?\n  - How do you protect your sensitive data from insider threats?\n  - How do you ensure that your security controls are effective against advanced\n    persistent threats (APTs)?\n  - How do you handle security vulnerabilities in your supply chain?\n  - How do you adapt your security posture to evolving threats and technologies?\n\n- **Security of AI workloads**:\n\n  - How do you ensure the security of your AI models and data?\n  - How do you address potential biases and ethical concerns in your AI models?\n  - How do you protect your AI models from adversarial attacks and data\n    poisoning?\n  - How do you ensure the privacy of data used in your AI models?\n  - How do you explain and interpret the decisions made by your AI models?\n  - How do you manage and control access to your AI models and data?\n  - How do you ensure compliance with regulations and standards related to\n    AI and ML?\n  - How do you monitor and detect anomalies in the behavior of your AI models?\n  - How do you handle and respond to security incidents involving your AI\n    models?\n  - How do you educate and train your employees on the secure and responsible\n    use of AI and ML?\n\n- **AI for security**:\n\n  - How do you leverage AI and ML to enhance your security posture?\n  - What types of AI models do you use for security purposes?\n  - How do you train and validate your AI models for security applications?\n  - How do you ensure the accuracy and reliability of AI-based security\n    systems?\n  - How do you handle false positives and false negatives from AI-based\n    security systems?\n  - How do you integrate AI-based security systems with your existing security\n    infrastructure?\n  - How do you manage and update your AI models for security applications?\n  - How do you explain and interpret the decisions made by your AI models for\n    security applications?\n  - How do you ensure the ethical and responsible use of AI and ML for security\n    purposes?\n  - How do you measure the effectiveness of AI and ML in improving your security\n    posture?\n\n- **Regulatory compliance and privacy**:\n\n  - What regulatory compliance frameworks and privacy standards do you need to\n    adhere to?\n  - How do you assess and manage compliance risks in your Google Cloud\n    environment?\n  - How do you ensure the privacy of sensitive data stored and processed in\n    Google Cloud?\n  - How do you handle data subject requests (DSRs) related to privacy\n    regulations?\n  - How do you document and track compliance activities and evidence?\n  - How do you ensure that third-party vendors and partners comply with your\n    regulatory and privacy requirements?\n  - How do you handle data breaches and security incidents related to compliance\n    regulations?\n  - How do you stay up-to-date with changes in regulatory compliance and privacy\n    standards?\n  - How do you educate and train your employees on regulatory compliance and\n    privacy requirements?\n  - How do you demonstrate and prove compliance to auditors and regulators?\n\n## Validation checklist\n\nUse the following checklist to evaluate the architecture's alignment with\nsecurity recommendations:\n\n- **Security by design**:\n\n  - Are system components selected based on their security features and\n    hardening?\n  - Is defense-in-depth implemented at the network, host, and application\n    layers?\n  - Are safe libraries and application frameworks used to prevent common\n    vulnerabilities?\n  - Is a risk assessment performed using industry standards?\n\n- **Zero trust**:\n\n  - Is Cloud Identity used as a centralized identity provider for managing user\n    lifecycles and federation?\n  - Is access control enforced based on user identity and context (device,\n    location)?\n  - Are private connectivity methods (Cloud Interconnect, VPN) used for internal\n    traffic?\n  - Are default networks disabled in all projects?\n  - Are VPC Service Controls perimeters established around sensitive data?\n\n- **Shift-left security**:\n\n  - Is infrastructure provisioned using Infrastructure as Code\n    (e.g., Terraform)?\n  - Are automated security scans integrated into the CI\u002FCD pipeline?\n  - Is there a process for scanning and patching vulnerabilities in\n    dependencies?\n  - Is Binary Authorization used to ensure only trusted images are deployed?\n\n- **Preemptive cyber defense**:\n\n  - Is threat intelligence integrated into security operations?\n  - Is security logging enabled and centralized for all critical resources?\n  - Are automated responses configured for common security threats?\n  - Are defenses validated through periodic testing or red-teaming?\n\n- **AI security and governance**:\n\n  - Are AI pipelines secured against tampering and data poisoning?\n  - Is differential privacy or data masking used for training data where\n    appropriate?\n  - Are explainability techniques such as feature attributions used for model\n    governance?\n",{"name":5,"metadata":48,"description":7},{"version":49,"category":50},"1.0.2","WellArchitectedFramework","main","4c6800d20130b5a3233e414609f1241013cec8cc","skills\u002Fcloud\u002Fgoogle-cloud-waf-security",2005,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills","https:\u002F\u002Fgithub.com\u002Fgoogle","https:\u002F\u002Fopensource.google\u002F","Google ❤️ Open Source","2026-11-14 01:51:35",{"source":8,"skillName":5,"commands":61,"prompt":71,"zipAvailable":72},[62,65,68],{"tool":63,"command":64},"npx","npx skills add google\u002Fskills --skill google-cloud-waf-security",{"tool":66,"command":67},"bunx","bunx skills add google\u002Fskills --skill google-cloud-waf-security",{"tool":69,"command":70},"pnpm","pnpm dlx skills add google\u002Fskills --skill google-cloud-waf-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fgoogle-cloud-waf-security\u002FSKILL.md",true,[74],{"path":75,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":78,"sourceHtmlUrl":79},"references\u002Fattribution.md","REFERENCE","参考文档",1923,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fgoogle-cloud-waf-security\u002Freferences\u002Fattribution.md",[81,114,144,173,200,224],{"skillNo":82,"name":83,"nameZh":6,"description":84,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":85,"categories":86,"keywords":93,"publishedAt":43},"01M6998S2EZKD3GEJ7F943RZTE","sign-in-with-google-web","Implement, configure, and secure Sign In With Google (SiwG) using Google Identity Services (GIS \u002F `https:\u002F\u002Faccounts.google.com\u002Fgsi\u002Fclient`) across web architectures. Use when creating Google sign-in buttons, implementing Google One Tap with FedCM, integrating GIS in React\u002FNext.js\u002FAngular\u002FHTML, verifying ID tokens on backend runtimes (Python\u002FNode.js\u002FGo\u002FJava), enforcing Google Workspace domain restrictions (`hd`), securing client-side ID tokens via WebCrypto nonces or encrypted IndexedDB, embedding in cross-origin iframes via the Intermediate Iframe API (`https:\u002F\u002Faccounts.google.com\u002Fgsi\u002Fintermediate`), configuring Content Security Policy (CSP), COOP, and Permissions Policy (`identity-credentials-get`) headers, or handling sign-out and revocation. Don't use for legacy Google Sign-In (`gapi.auth2`), Google Cloud IAM service accounts, or Android\u002FiOS native Credential Manager.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fidentity\u002Fsign-in-with-google-web\u002FSKILL.md",[87,90],{"categoryNo":88,"categoryName":89,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",{"categoryNo":91,"categoryName":92,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",[9,94,95,96,97,98,99,24,100,25,101,102,103,104,105,35,106,107,108,109,110,111,112,113],"sign in with google web","sign","with","web","android","go","google workspace","implement","policy","python","implementing","react","permissions","buttons","secure","manager","identity","architectures","domain","runtimes",{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":127,"publishedAt":43},"01M6998PHPDCAD684VW5WRG83D","dpop-adoption","Implement and debug OAuth 2.0 DPoP (RFC 9449) refresh token sender-constraining for WebCrypto, Node.js ES6, and browser runtimes integrating with Google's OAuth platform. Use when configuring non-extractable asymmetric key pairs (P-256), generating DPoP Proof JWTs for authorization code exchange and token refresh, or handling 400 use_dpop_nonce challenge retry loops at oauth2.googleapis.com\u002Ftoken. Don't use for unconstrained OAuth 2.0 flows (where refresh tokens are not bound to a client key pair), or for Google Cloud IAM \u002F service account authentication.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fidentity\u002Fdpop-adoption\u002FSKILL.md",[120,121,122],{"categoryNo":91,"categoryName":92,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":123,"categoryName":124,"taxonomyType":125,"taxonomyTypeDesc":126},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[128,129,9,25,130,131,132,133,134,135,35,136,137,138,139,140,141,110,113,142,143],"dpop adoption","adoption","es6","retry","authentication","flows","challenge","code","browser","loops","at","node","token","pair","platform","when",{"skillNo":145,"name":146,"nameZh":6,"description":147,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":148,"categories":149,"keywords":156,"publishedAt":43},"01M6998M72TC73EEAQH4XC7EXW","retrieving-developer-knowledge","Searches, retrieves, and synthesizes official Google developer documentation across Google Cloud, AI\u002FGemini, Android, Chrome, Web, Flutter, Go, Firebase, and other Google developer platforms. Integrates with the Developer Knowledge MCP server (search_documents, get_documents, answer_query) or the Developer Knowledge REST API fallback. Use when searching for gcloud CLI commands, API syntax, IAM permissions, official documentation, architectural comparisons, or product choice overviews. Don't use for local filesystem lookups or non-Google documentation.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Fretrieving-developer-knowledge\u002FSKILL.md",[150,151,154,155],{"categoryNo":91,"categoryName":92,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":152,"categoryName":153,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":123,"categoryName":124,"taxonomyType":125,"taxonomyTypeDesc":126},[157,158,159,160,25,161,162,163,164,165,166,167,168,143,169,170,171,35,172,106],"retrieving developer knowledge","knowledge","developer","MCP","mcp server","official","developer documentation","get","search","local","choice","documents","query","api","across","documentation",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":179,"publishedAt":43},"01M6998J2CZEXS9BES9S3WWFKC","migrate-to-rust","Clones, analyzes, plans, and migrates legacy codebases (C++, Fortran, Java, Python, C, Shell) from a GitHub URL or local directory to a modern, high-performance, deterministic, 100% Safe Rust architecture, tracking live telemetry across every task bucket, test failure\u002Ffix cycle, and Profile-Guided Optimization (PGO) stage, and producing a first-person AI storytelling report and interactive HTML infographic. Use when migrating a GitHub repository or local codebase to Rust, porting legacy C++, Fortran, Python, or Java workloads to memory-safe Rust, designing Struct-of-Arrays (SoA) or SIMD Rust architectures, or optimizing Rust ports with LLVM PGO. Don't use for unrelated non-Rust refactoring or single-line syntax questions.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Fmigrate-to-rust\u002FSKILL.md",[],[180,181,182,183,184,185,186,187,103,188,189,190,191,192,193,166,194,195,196,143,197,198,171,199],"migrate to rust","rust","migrate","github","memory","performance","directory","safe","ports","llvm","soa","cycle","porting","fix","arrays","infographic","high-performance","URL","architecture","unrelated",{"skillNo":201,"name":202,"nameZh":6,"description":203,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":204,"categories":205,"keywords":209,"publishedAt":43},"01M6998GCC3K29WZ82KXMB9E02","finding-google-skills","Google platform decision and setup guidance, loaded on demand from Google's skill catalog. Use when a developer is choosing or setting up part of their stack, such as where to run a service, a database, storage, messaging, authentication, analytics, ads, or AI model serving, and a Google product is a reasonable candidate - whether or not a vendor is named - or when a request names a Google product or API. Brings in the matching Google skill so the answer can weigh Google options, their trade-offs, and when they are not the right fit. Skip when the stack is already settled on another provider and no Google product is named, or the task involves no platform choice.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Ffinding-google-skills\u002FSKILL.md",[206,207,208],{"categoryNo":91,"categoryName":92,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":123,"categoryName":124,"taxonomyType":125,"taxonomyTypeDesc":126},[9,210,211,212,213,142,214,215,216,217,218,132,219,220,221,167,37,222,143,223,170],"finding google skills","storage","as","messaging","model","trade-offs","provider","answer","fit","catalog","up","decision","database","candidate",{"skillNo":225,"name":226,"nameZh":6,"description":227,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":228,"categories":229,"keywords":232,"publishedAt":43},"01M6998DWNHTH0BS6W1CY8ZXMP","workload-manager-basics","Use this skill to manage Google Cloud Workload Manager evaluations, rules, scanned resources, and validation results by using public client libraries and the REST API. Use when you need to inspect workload best-practice rules, create and run evaluations for Google Cloud general best practices, SAP, SQL Server, or custom organizational rules, review violations, export results to BigQuery, or automate Workload Manager through client libraries because no service-specific public CLI or MCP server is available. Don't use for general Google Compute Engine instance management, VPC configuration, or standard IAM auditing.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fworkload-manager-basics\u002FSKILL.md",[230,231],{"categoryNo":91,"categoryName":92,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[233,234,109,235,9,160,236,25,161,237,238,239,240,143,241,170,35,242,243,244,245],"workload manager basics","workload","basics","cli","review","vpc","resources","inspect","you","create","libraries","server","run"]