2.1 Configuring network topologies

Considerations include :

• Extending to on-premises environments (hybrid networking)
• Extending to a multi-cloud environment that may include Google Cloud to Google Cloud communication
• Security protection (e.g. intrusion protection, access control, firewalls)

2.2 Configuring individual storage systems

Considerations include :

• Data storage allocation
• Data processing/compute provisioning
• Security and access management
• Network configuration for data transfer and latency
• Data retention and data life cycle management
• Data growth planning

2.3 Configuring compute systems

Considerations include :

• Compute resource provisioning
• Compute volatility configuration (preemptible vs. standard)
• Network configuration for compute resources (Google Compute Engine, Google Kubernetes Engine, server less networking)
• Infrastructure orchestration, resource configuration, and patch management
• Container orchestration

3.1 Designing for security

Considerations include :

• Identity and access management (IAM)
• Resource hierarchy (organizations, folders, projects)
• Data security (key management, encryption, secret management)
• Separation of duties (SoD)
• Security controls (e.g., auditing, VPC Service Controls, context aware access, organization policy)
• Managing customer-managed encryption keys with Cloud Key Management Service
• Remote access

3.2 Designing for compliance

Considerations include :

• Legislation (e.g., health record privacy, children’s privacy, data privacy, and ownership)
• Commercial (e.g., sensitive data such as credit card information handling, personally identifiable information [PII])
• Industry certifications (e.g., SOC 2)
• Audits (including logs)