Set the Resource Location Restriction organization policy constraint at the Folder level:
Setting the constraint at the folder level allows for very granular control over data residency requirements.
Each folder can represent a specific geographical location, and projects within those folders will inherit the location constraint, ensuring compliance with regulatory requirements.
This approach provides flexibility to manage data residency across different regions within the same organization.
Reference:
Organization Policy Service: Resource Location Restriction

To minimize the attack surface of the container for an internet-facing application running on Google Kubernetes Engine (GKE), the best practice is to build small containers using small base images. This approach helps in the following ways:
Reduce Vulnerabilities: Smaller base images contain fewer packages and dependencies, which minimizes the potential vulnerabilities that an attacker could exploit.
Improved Security: Using minimal base images such as distroless or Alpine Linux ensures that only the necessary components are included, reducing the attack surface significantly.
Easier Maintenance: Small containers are easier to maintain and update, ensuring that security patches can be applied quickly without dealing with unnecessary components.
Steps to Implement:
Choose a Minimal Base Image:
Use base images like gcr.io/distroless/base or alpine.
FROM gcr.io/distroless/base COPY myapp /myapp CMD ["/myapp"]
Optimize Container Image:
Remove unnecessary tools and libraries.
Use multi-stage builds to keep the final image small.
Regularly Update Base Images:
Keep the base images up-to-date with the latest security patches.
Reference:
Distroless Images
Best Practices for Building Containers

To handle PII data ingestion and ensure both redaction and re-identification for analytics purposes, you can use Cloud Data Loss Prevention (DLP) with appropriate techniques for masking and encryption.
Cloud Data Loss Prevention (DLP) with Cryptographic Hashing (C):
Use Cloud DLP to apply cryptographic hashing to PII data. Hashing transforms the data into a fixed-length string that is not directly readable, providing a layer of obfuscation. This helps in masking the PII while retaining the ability to verify data integrity.
Cloud Data Loss Prevention (DLP) with Deterministic Encryption using AES-SIV (E):
Apply deterministic encryption using AES-SIV through Cloud DLP. Deterministic encryption ensures that the same input will always produce the same encrypted output, allowing you to re-identify the PII when necessary. This method enables secure encryption while allowing data re-identification for analytics.
By combining these two approaches, you can effectively mask PII for privacy protection and later re-identify it when required for analysis.
Reference:
Cloud Data Loss Prevention Documentation
Data Redaction and Masking Techniques

"However, even though it is possible to uses tags for target filtering in this manner, we recommend that you use service accounts where possible. Target tags are not access-controlled and can be changed by someone with the instanceAdmin role while VMs are in service. Service accounts are access-controlled, meaning that a specific user must be explicitly authorized to use a service account. There can only be one service account per instance, whereas there can be multiple tags. Also, service accounts assigned to a VM can only be changed when the VM is stopped"

This is a Customer-supplied encryption keys (CSEK). We generate our own encryption key and manage it on-premises. A KEK never leaves Cloud KMS.There is no KEK or KMS on-premises. Encryption at rest by default, with various key management options https://cloud.google.com/security/encryption-at-rest