Managed mTLS on GCP: workload identity becomes an architecture boundary
General availability of managed identity for backend mTLS reduces certificate toil, but requires explicit decisions about trust domains, migration and failure evidence.
Cloud Security: AWS and GCP
Cloud architecture, networking, containers and security responsibilities in AWS and Google Cloud.
Reading on this topic
API Gateway: 1 MB logs need a new evidence contract
Assess downstream truncation, data exposure and per-destination costs before expanding REST API execution logs.
Cloud SQL: database location does not finish the security review
Regional administrative API endpoints raise an architecture question: where do the operations that manage your data travel?
Containers: follow the review into runtime
An approved image still depends on deployment permissions.
Kubernetes: namespaces do not finish isolation analysis
Boundaries must account for shared resources.
Segmentation: review permitted outbound traffic
Connection destinations are part of the exposure boundary.
AWS and GCP: turn shared responsibility into tasks
Assign ownership for each control.
TLS: review the full path to the data consumer
The browser padlock describes only part of the architecture.
Thiago Lima Soneti da Silva (Thiago Silva) — Cyber Architect and technical lead at Lima e Silva Tecnologia.