Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Keamanan adalah tanggung jawab bersama. Dataflow mengamankan infrastruktur skalabel yang Anda gunakan untuk menjalankan pipeline Dataflow dan menyediakan alat serta kontrol keamanan untuk melindungi data, kode, dan model Anda.
Meskipun bukan daftar lengkap, dokumen ini mencantumkan tanggung jawab bagi
Google dan pelanggan.
Tanggung jawab Google
Melindungi infrastruktur: Google bertanggung jawab menyediakan infrastruktur yang aman untuk layanannya, termasuk keamanan fisik pusat data, keamanan jaringan, dan keamanan aplikasi.
Mengamankan platform: Google bertanggung jawab untuk mengamankan platformnya, termasuk mengelola kontrol akses, memantau insiden keamanan, dan merespons peristiwa keamanan. Google juga memberi pelanggan alat untuk mengelola setelan dan konfigurasi keamanannya sendiri.
Mempertahankan kepatuhan: Google mempertahankan kepatuhan terhadap hukum dan peraturan perlindungan data yang relevan. Pelajari lebih lanjut
kepatuhan Google Cloud.
Memperkuat dan menerapkan patch pada image: Google memperkuat dan menerapkan patch pada sistem operasi
image dasar yang digunakan oleh
image milik Dataflow. Google segera menyediakan patch apa pun ke
gambar ini.
Buletin keamanan disediakan
untuk kerentanan yang diketahui
Tanggung jawab pelanggan
Gunakan dan update lingkungan Anda ke versi terbaru
container Dataflow dan image VM:
Dataflow menyediakan container dan image VM bawaan untuk menyederhanakan
penggunaan layanannya. Google akan membuat versi baru image ini saat
kerentanan teridentifikasi. Anda bertanggung jawab untuk memantau
berita keamanan dan mengupdate
lingkungan Anda dengan segera saat versi baru tersedia.
Anda bertanggung jawab memastikan bahwa Anda telah mengonfigurasi layanan dengan benar untuk menggunakan versi terbaru, atau untuk mengupgrade ke versi terbaru secara manual. Untuk menggunakan VM terbaru, mulai ulang
tugas yang berjalan lama dengan
mengupdate tugas. Untuk mengetahui informasi selengkapnya, lihat Mengupgrade dan menerapkan patch pada VM Dataflow.
Untuk mengelola masalah keamanan secara responsif, sebaiknya gunakan
image container kustom.
Jika menggunakan
image container kustom
atau
template kustom,
Anda bertanggung jawab untuk memindai dan menerapkan patch pada image kustom untuk mengurangi
kerentanan.
Jika Anda menggunakan
image dasar Template Flex,
untuk memastikan keamanan dan mengurangi risiko kerentanan, gunakan image dasar Distroless
jika memungkinkan.
Mengelola kontrol akses: Anda bertanggung jawab untuk mengelola kontrol akses ke data dan layanan Anda sendiri. Hal ini termasuk mengelola akses pengguna, melakukan autentikasi, dan mengontrol otorisasi, serta mengamankan aplikasi dan data Anda sendiri. Pelajari lebih lanjut Keamanan dan izin Dataflow.
Mengamankan aplikasi: Anda bertanggung jawab untuk mengamankan aplikasi Anda sendiri yang berjalan di Dataflow, termasuk menerapkan praktik coding yang aman dan melakukan pengujian terhadap kerentanan secara rutin.
Memantau insiden keamanan: Anda bertanggung jawab untuk memantau insiden keamanan di aplikasi Anda sendiri, dan melaporkan insiden apa pun kepada Google jika diperlukan.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-18 UTC."],[[["\u003cp\u003eSecurity within Dataflow is a shared responsibility between Google, which secures the infrastructure and platform, and the customer, who manages their own data and applications.\u003c/p\u003e\n"],["\u003cp\u003eGoogle ensures the security of its infrastructure, platform, compliance, and base images, while also providing tools for customers to manage their own security settings.\u003c/p\u003e\n"],["\u003cp\u003eCustomers are responsible for updating their environment to the latest versions of Dataflow containers and VM images, including managing custom images and using distroless base images where applicable.\u003c/p\u003e\n"],["\u003cp\u003eCustomers must manage access controls, secure their own applications, monitor for security incidents, and promptly report any vulnerabilities to Google.\u003c/p\u003e\n"],["\u003cp\u003eIt is important for customers to subscribe to Dataflow security bulletins, follow Dataflow release notes, follow Apache Beam release notes, and avoid the deprecated Monitoring agent option.\u003c/p\u003e\n"]]],[],null,["# Dataflow shared responsibility\n\nSecurity is a shared responsibility. Dataflow secures the scalable\ninfrastructure that you use to run your Dataflow pipelines and\nprovides you tools and security controls to protect your data, code, and models.\nWhile not an exhaustive list, this document lists the responsibilities for both\nGoogle and the customer.\n\nGoogle's responsibilities\n-------------------------\n\n- **Protect the infrastructure**: Google is responsible for providing secure\n infrastructure for its services, including physical security of data centers,\n network security, and application security.\n\n- **Secure the platform**: Google is responsible for securing its platform,\n including managing access controls, monitoring for security incidents, and\n responding to security events. Google also provides customers with tools to\n manage their own security settings and configurations.\n\n- **Maintain compliance** : Google maintains compliance with relevant data\n protection laws and regulations. Learn more about\n [Google Cloud compliance](/security/compliance).\n\n- **Harden and patch images** : Google hardens and patches the operating system\n of [base images](/software-supply-chain-security/docs/base-images) used by the\n Dataflow-owned images. Google promptly makes any patches to\n these images available.\n [Security bulletins](/dataflow/docs/security-bulletins) are provided\n for known vulnerabilities\n\nCustomer's responsibilities\n---------------------------\n\n- **Use and update your environment to the latest versions of\n Dataflow containers and VM images** :\n Dataflow provides prebuilt containers and VM images to simplify\n the use of its services. Google will create new versions of these images when\n vulnerabilities are identified. It is your responsibility to monitor for\n [security bulletins](/dataflow/docs/security-bulletins) and update your\n environment promptly when new versions are available.\n\n You are responsible for ensuring\n that you properly configured your services to use the latest version, or to\n manually upgrade to the latest version. To use the latest VMs, restart\n long-running jobs by\n [updating the job](/dataflow/docs/guides/updating-a-pipeline). For more\n information, see\n [Upgrade and patch Dataflow VMs](/dataflow/docs/concepts/security-and-permissions#upgrade-patch).\n To manage security issues responsively, it is recommended that you use\n custom container images.\n\n If you're using a\n [custom container image](/dataflow/docs/guides/using-custom-containers)\n or a\n [custom template](/dataflow/docs/guides/templates/creating-templates),\n you're responsible for scanning and patching the custom images to mitigate\n vulnerabilities.\n\n If you're using a\n [Flex Template base image](/dataflow/docs/reference/flex-templates-base-images),\n to ensure security and reduce vulnerability risks, use Distroless base images\n when possible.\n- **Manage access controls** : You are responsible for managing access\n controls to your own data and services. This includes managing user access,\n authentication, and authorization controls, and securing your own\n applications and data. Learn more about\n [Dataflow security and permissions](/dataflow/docs/concepts/security-and-permissions).\n\n- **Secure applications**: You are responsible for securing your own\n applications running on Dataflow, including\n implementing secure coding practices and regularly testing for\n vulnerabilities.\n\n Learn more about\n [Customer-managed encryption keys](/dataflow/docs/guides/customer-managed-encryption-keys),\n [networks and VPC Service Controls](/dataflow/docs/guides/specifying-networks),\n and [permissions best practices](/dataflow/docs/concepts/security-and-permissions#best-practices).\n- **Monitor for security incidents**: You are responsible for monitoring\n your own applications for security incidents, and reporting any\n incidents to Google as necessary.\n\n - Subscribe to the [Dataflow security bulletins](/dataflow/docs/security-bulletins).\n - Follow the [Dataflow release notes](/dataflow/docs/release-notes).\n - Follow the [Apache Beam release notes](/dataflow/docs/resources/release-notes-apache-beam).\n - Learn more about [Monitoring](/dataflow/docs/guides/using-cloud-monitoring) and [Audit logging](/dataflow/docs/audit-logging).\n\n | **Note:** When using the Monitoring agent, the `--experiments=enable_stackdriver_agent_metrics` option uses a deprecated container image that isn't maintained and might have unpatched vulnerabilities. We recommend that you don't use this option.\n\nWhat's next\n-----------\n\n- Learn more about [shared responsibilities on Google Cloud](/architecture/framework/security/shared-responsibility-shared-fate).\n- Learn about how to [protect your software supply chain](/software-supply-chain-security/docs/practices)."]]
