Blog

Standing up two new GCP projects for a payments service migrating from an existing PCI-DSS environment on another cloud, with isolated Terraform state, scoped service accounts, a network and encryption-key layer built from a documented audit question list, and an IAM-only access design for a multi-schema Postgres database.

Giving developers access to a private Cloud SQL instance without static IP allowlists or shared passwords. Covers the Cloud SQL Auth Proxy TLS 1.3 tunnel, IAM Database Authentication with Google Workspace identities, engine-specific database flags, and Terraform for the instance, users, and project-level bindings.

Building a self-managed NGFW for PCI-DSS compliance as an alternative to Azure Premium Firewall at $1300 per month. Compares FW and NGFW capabilities across layer 7 application awareness, IDS/IPS, identity-based policy, malware scanning, and TLS inspection.