To configure the behavior where each department member automatically has read-only access to all new project resources created by any department member, you should use Google Cloud's folder structure and IAM roles effectively. Here are the steps:
Create Folders for Departments: Create a folder under your Organization for each department. Folders help organize resources and provide a hierarchy for applying policies and permissions.
Assign IAM Roles to Google Groups: Assign the Project Viewer role to the Google Group associated with each department at the folder level. This ensures that all members of the group have the necessary permissions.
Inherited Permissions: When a department member creates a new project under their department's folder, the permissions assigned to the folder are inherited by the new project. Thus, all department members will automatically have read-only access to the project's resources.
Navigate to IAM & Admin in the GCP Console.
Select "Folders" from the left-hand menu.
For each department, create a new folder under the organization.
Select the newly created folder, and then go to the "Permissions" tab.
Click on "Add" to assign a new role.
Enter the email address of the Google Group for the department.
Assign the "Project Viewer" role to the group.
Access Restrictions: Since the permissions are applied at the folder level, only the members of the specific department's Google Group will have read-only access to the projects created in that folder. Other departments will not have access unless explicitly granted.
By following these steps, you ensure that department members have the required access to their respective projects without manual configuration for each new project.
Reference:
Google Cloud IAM Documentation
Google Cloud Resource Manager Documentation

To connect Compute Engine instances within a Google Cloud Platform project to workloads running in a dedicated server room that can only be accessed from within the private company network, you can use the following approaches:
Cloud VPN: Cloud VPN securely connects your on-premises network to your Google Cloud Virtual Private Cloud (VPC) network through an IPsec VPN connection. This enables secure communication between your GCP instances and your on-premises workloads over the internet.
Cloud Interconnect: Cloud Interconnect provides direct physical connections between your on-premises network and Google's network. It offers higher bandwidth and lower latency compared to Cloud VPN, making it suitable for workloads that require fast and reliable connectivity.
Both Cloud VPN and Cloud Interconnect allow you to securely connect your on-premises environments to Google Cloud, ensuring that the workloads remain within the private company network.
Reference:
Cloud VPN Overview
Cloud Interconnect Overview

Scenarios for exporting Cloud Logging data: Splunk This scenario shows how to export selected logs from Cloud Logging to Pub/Sub for ingestion into Splunk. Splunk is a security information and event management (SIEM) solution that supports several ways of ingesting data, such as receiving streaming data out of Google Cloud through Splunk HTTP Event Collector (HEC) or by fetching data from Google Cloud APIs through Splunk Add-on for Google Cloud. Using the Pub/Sub to Splunk Dataflow template, you can natively forward logs and events from a Pub/Sub topic into Splunk HEC. If Splunk HEC is not available in your Splunk deployment, you can use the Add-on to collect the logs and events from the Pub/Sub topic. https://cloud.google.com/solutions/exporting-stackdriver-logging-for-splunk

To meet the requirements of rotating the master key every 45 days, achieving FIPS 140-2 Level 3 validation, and ensuring the master key is stored redundantly in multiple US regions, you should use Customer-managed encryption keys with Cloud HSM. Here's how:
Set Up Cloud HSM:
Deploy Cloud HSM in your Google Cloud environment. Cloud HSM provides a hardware-based key management solution that meets FIPS 140-2 Level 3 compliance.
Create and Manage Keys:
Create your encryption keys in Cloud HSM. These keys can be managed and rotated per your policy requirements.
Key Rotation:
Set up a key rotation schedule to rotate the master key every 45 days. Cloud HSM allows you to automate this process.
Geographic Redundancy:
Ensure that your Cloud HSM configuration spans multiple regions within the US to achieve redundancy. This will ensure that your keys are available even if a particular region experiences an outage.
Compliance:
Cloud HSM's FIPS 140-2 Level 3 validation ensures that your encryption keys are managed in a secure and compliant manner.
Benefits:
Security and Compliance: Meets stringent compliance requirements.
Automated Management: Simplifies key management and rotation.
Redundancy: Ensures high availability of keys across multiple regions.
Reference:
Cloud HSM Documentation
Key Management with Cloud KMS and Cloud HSM