Private certificate authority foundations across AWS and Google Cloud
Google Cloud Implementation Lead, paired with the AWS lead
AWS
Google Cloud
CA Service
Cloud KMS
IAM
Audit Logs
Org Policy
Private CA
KMS
On this page
Overview
A global security organization needed a private PKI foundation across AWS and Google Cloud. The goal was a repeatable infrastructure-as-code implementation with separate duties, protected signing keys, auditability and policy controls.
Challenge
The design had to express one security model through different cloud-native certificate, key-management, identity and policy services. Terraform modules also needed to be validated in controlled environments before customer deployment.
My role
I led the Google Cloud implementation and worked with the AWS engineer on the equivalent AWS foundation. I prepared the Google Cloud lab, validated the Terraform approach, implemented the CA Service and Cloud KMS components, and aligned IAM, logging and organization-policy controls with the shared PKI design.
Architecture & approach
Simplified view of the engagement scope. Confidential details omitted.
Built a dedicated Google Cloud PKI project and subordinate certificate authority.
Protected CA keys with Cloud KMS and defined IAM separation of duties.
Configured audit logging, alerting and organization-policy guardrails.
Validated the project Terraform modules in a lab before applying them in the customer environment.
Coordinated the Google Cloud implementation with the AWS Private CA counterpart.
Key decisions
Kept the control intent consistent across both clouds while using each platform’s native services.
Separated administrative, issuance and audit responsibilities to reduce concentrated privilege.
Used lab validation to find module and policy issues before production deployment.
Security & reliability
Private keys remained in cloud key-management services, permissions were separated by role, and CA activity was logged and alertable. Organization policies constrained project behavior around the PKI foundation.
Technologies
CA Service
Cloud KMS
IAM
Audit Logs
Org Policy
Private CA
KMS
IAM
Terraform
Outcome
The engagement produced aligned AWS and Google Cloud private-PKI foundations with reusable Terraform, explicit duties, protected keys and auditable operations.
Lessons & takeaways
Key takeaway
Multi-cloud security design should standardize the control objective, not force identical service names or implementation details across platforms.
Took over technical ownership of an enterprise customer’s advanced multi-account AWS landing zone, from pre-sign-off through implementation and operational handover.