Security is typically implemented at multiple levels, using a variety of techniques to ensure comprehensive protection, as shown in Figure 10-1. When securing a Google Cloud Dataproc environment, the first consideration is perimeter security, which controls who can even attempt to access the resources. This can be achieved through firewall rules, network access control lists (ACLs), or more advanced solutions like VPC Service Controls (VPC SCs), which create a security perimeter around sensitive data and services.
Figure 10-1. Tools and techniques to implement security at multiple levels
Once a user gains access to the perimeter, the focus shifts to service-level security. At this stage, two critical tasks come into play: authentication and authorization. Authentication ensures that the user has the correct credentials to prove their identity, which can be implemented using Kerberos within Dataproc clusters or through Google Cloud’s built-in authentication mechanisms (IAM) when accessing other services.
After authenticating, authorization verifies that the authenticated user is permitted access to specific resources. This can be managed using Google Cloud’s IAM for many services, while Apache Ranger can provide fine-grained access control within the Dataproc cluster itself. To enforce policies across multiple projects or folders, organization constraints ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month, and much more.
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.
Julian F.
Head of Cybersecurity
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.
Addison B.
Field Engineer
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.
Amir M.
Data Platform Tech Lead
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.
