Deploy a resource with Assured Workloads

This topic describes how to set up Assured Workloads and deploy your first resource.

Overview

Assured Workloads requires you to create and register a folder before deploying a Assured Workloads environment. Depending on the selected compliance regime you choose, you are responsible for creating encryption keys and resources in the environment.

Note: Assured Workloads environments can only be deployed into folders that have been successfully registered.

Warning: You should only use Assured Workloads if your Google Cloud use case is actively subject to regulatory compliance. If you choose to use Assured Workloads, we recommend you select only the compliance regime for your use case. This is because the compliance regime you select can enforce restrictions, including, but not limited to, personnel restrictions, reporting requirements, the Google Cloud services that are available to you, and regions where those services are available.

To set up your environment and first workload, do the following:

1. If you haven't already, set up an organization, as follows:

   1. Set up Cloud Identity and verify your domain.

   2. Create an organization prior to using Assured Workloads.

2. Select a compliance regime.

3. Create a folder for Assured Workloads environments.

4. Create a folder in the Assured Workloads environment that supports your compliance regime, as follows:

   • Create a new folder in a workload environment (IL4, CJIS).
   • Create a new folder in a workload environment (FedRAMP, US Regions & Support).

5. Create and obtain a customer-managed encryption key (CMEK).

6. Deploy a resource into your Assured Workloads environment. Assured Workloads supports a variety of resources. Examples include:

   • Creating a Cloud Storage workload.

   • Creating a Persistent Disk workload.

   • Creating a BigQuery workload.

What's next

• Learn about Assured Workloads.
• Learn how to support compliance with key management.