SPEAKER: So far, we've covered many aspects
of using Cloud Operations to improve the observability
and reliability of your services running on Google Cloud.
But how should you approach setting up and using a suite
as your cloud footprint grows?
Today, we'll look at some enterprise
best practices that you can use to get the most value out
of Cloud Operations.
Welcome to Engineering for Reliability with Google Cloud.
Before we start, let's take a step back and answer
this simple question.
Why do we do all of these things?
What are we trying to achieve, overall,
when using a suite like Cloud Operations?
Ultimately, we're after three main objectives.
The first one is to make sure that our services are secure
and that we comply with policies and regulations that
are specifically relevant in our context.
That means we need to manage things
like data access and an audit trail.
The second one is the objective we've
talked about in just about every episode,
keeping our users happy.
That means we need to know if user experience degrades,
hopefully by using SLOs, and what to do about it.
The final goal is managing the capacity
required to run our services while ensuring
that we optimize for cost.
With that said, we'll tackle best practices
for setting up and using Cloud Operations by focusing
on these three key areas.
The first one, and the one we'll focus on today,
will be best practices for the enterprise.
We'll cover setting up a centralized logging
and monitoring environment, ensuring an audit trail,
and configuring data retention and access.
The next episode will address best practices for using
Cloud Monitoring specifically.
We'll get into what to monitor, how to do it,
how to manage alerts, and how to optimize your monitoring costs.
The final episode on this topic will cover best practices
for Cloud Logging.
We'll get into what and how to log,
how to use the logs your services generate,
and how to optimize your logging costs.
This is going to be a lot, but I think you're ready.
Let's get into it.
Let's start by talking about enterprise best practices.
The first recommendation is to centralize
monitoring, auditing, and observability data
in a single place.
For services running on Google Cloud,
we recommend using Cloud Operations to do just that.
Having this information in a single repository
with easy cross-team access greatly
improves practices like architecture design,
incident response, and root cause analysis.
For example, if I know the historical reliability track
record of my dependencies, I can better architect my own service
to meet my reliability objectives.
At the same time, I can do a better job of incident response
if I can see whether the services I depend on
are having an incident.
It's really difficult to do things like this
without having all this information in a single place.
The second recommendation is to ensure
that a clear and easily accessible
audit trail exists for your services.
This means using cloud audit logs
to help answer questions like who did what,
where, and when in your Google Cloud projects, and managing
IAM controls to limit who has access to view audit logs.
We've covered using audit logs in detail in another video.
We'll link to it in the show notes.
As you make audit log configuration changes,
use a test Google Cloud project to validate them
before propagating to developer and production projects.
When considering how you grant access to audit
logs across the organization, we recommend
using a least privilege approach to granting permissions.
We'll link to specific examples of that in the episode notes.
Note that data access audit logs are off by default,
except for BigQuery.
When you enable new Google Cloud Services,
evaluate whether or not to enable data
access audit logs for that new service.
The final recommendation for enterprises
is to thoughtfully manage log retention and analysis.
Consider the various retention needs
for compliance requirements, security and access analytics,
and event analytics.
We'll link to documentation explaining
specific considerations for each scenario in the episode notes.
The first way to do this is by using log views.
You can use log views to control who
has access to logs within your log buckets
based on your needs and requirements.
Custom log views provides you with a granular way
to control access to the logs in your log buckets.
You can also carefully control log retention
by using project-level or aggregated sinks
to export logs to BigQuery, Cloud Storage, and Pub/Sub
for analytics, archival, or consumption by other systems.
Each of these do have their own mechanisms
for controlling retention and access,
and you should carefully consider those
as you plan your retention strategy.
Thanks for joining me today.
We covered best practices for setting up and using
Cloud Operations in the enterprise,
including centralizing data, managing an audit trail,
and configuring data retention.
I hope these recommendations help
you keep your services secure and your users happy.
In our next episode, we'll tackle best practices
for using Cloud Monitoring.
Thanks so much for watching today.
Don't forget to like and subscribe to never miss out
on more Engineering for Reliability with Google Cloud.
See you soon.
[MUSIC PLAYING]