To ensure that only trusted container images are deployed on Cloud Run, you can implement Binary Authorization, which is a deploy-time security control that ensures only trusted images are used.
Set Up Binary Authorization:
Navigate to the Google Cloud Console.
Go to Security > Binary Authorization.
Configure the policy to include attestors that verify your trusted images.
Enable Binary Authorization on Cloud Run:
Go to the Cloud Run service.
Enable Binary Authorization on your existing Cloud Run services by selecting the appropriate Binary Authorization policy.
Set Organization Policy:
Go to the Organization Policies page in the Google Cloud Console.
Add a constraint for constraints/run.allowedBinaryAuthorizationPolicies.
Specify the list of allowed Binary Authorization policy names to enforce across your organization.
These steps ensure that any container image deployed on Cloud Run is validated against the specified Binary Authorization policies, preventing untrusted images from being deployed.
Reference:
Binary Authorization Documentation
Enabling Binary Authorization on Cloud Run

Activate Security Command Center (SCC) Premium: Security Command Center (SCC) Premium provides advanced security analytics and best practice recommendations for your Google Cloud environment. It includes functionalities such as asset discovery, vulnerability scanning, and security findings.
Create a Custom Rule to Mute Irrelevant Security Findings:
Navigate to the Security Command Center (SCC) in the Google Cloud Console.
Go to the "Settings" tab and find the "Mute findings" section.
Create a new mute rule by specifying the conditions that match the irrelevant controls you want to disregard. These conditions can be based on attributes such as resource type, finding type, and other metadata.
Apply this mute rule, which will ensure that the specified findings are not evaluated in your security posture assessments.
Ensure Continuous Compliance Monitoring:
The mute rules will automatically filter out the irrelevant findings, ensuring that only relevant controls from the CIS Google Cloud Computing Foundations Benchmark v1.3.0 are evaluated.
Regularly review and update the mute rules to adapt to any changes in your compliance requirements or security posture.
Reference:
Security Command Center Documentation
Creating and Managing Mute Rules

Objective: Ensure VMs can access Cloud Storage without reaching the public internet.
Solution: Enable Private Google Access on the VPC network, allowing VMs with only internal IP addresses to access Google APIs and services privately.
Steps:
Step 1: Open the Google Cloud Console.
Step 2: Go to the VPC Network section.
Step 3: Select the relevant VPC network and subnet.
Step 4: Enable Private Google Access for the subnet.
Private Google Access ensures that instances can access Google APIs and services (such as Cloud Storage) over a private network connection, without requiring a public IP address.
Reference:
Configuring Private Google Access
Best Practices for Secure Access

Disable service account key creation You can use the iam.disableServiceAccountKeyCreation boolean constraint to disable the creation of new external service account keys. This allows you to control the use of unmanaged long-term credentials for service accounts. When this constraint is set, user-managed credentials cannot be created for service accounts in projects affected by the constraint. https://cloud.google.com/resource-manager/docs/organization-policy/restricting-service-accounts#example_policy_boolean_constraint

To remove personally identifiable information (PII) from files older than 12 months and archive the anonymized files for retention purposes, you can use Google Cloud Data Loss Prevention (DLP).
Create a Cloud DLP Inspection Job:
Go to the Cloud DLP section in the Google Cloud Console.
Create an inspection job that scans files in your Cloud Storage bucket for PII.
Configure the job to only target files that are older than 12 months.
Configure De-identification:
In the inspection job settings, configure de-identification actions to remove or obfuscate PII in the files.
Specify the transformation techniques appropriate for your data, such as masking or tokenization.
Archive Anonymized Files:
Set up the job to move the de-identified files to another Cloud Storage bucket designated for archival.
Ensure this bucket has the appropriate retention policies and access controls in place.
Delete Original Files:
After de-identification and archiving, configure the job to delete the original files from the source bucket.
This approach ensures that PII is effectively removed from old files and that the anonymized data is securely archived, maintaining compliance with data retention and privacy policies.
Reference:
Cloud Data Loss Prevention Documentation
Setting Up DLP Jobs
Cloud Storage Documentation