보안은 공동의 책임입니다. Dataflow는 Dataflow 파이프라인을 실행하는 데 사용하는 확장 가능한 인프라를 보호하고 데이터, 코드, 모델을 보호하는 도구와 보안 제어를 제공합니다.
이 문서에는 전체 목록은 아니지만 Google과 고객 모두의 책임이 나와 있습니다.
Google의 책임
인프라 보호: Google은 데이터 센터의 물리적 보안, 네트워크 보안, 애플리케이션 보안을 비롯한 서비스에 대한 보안 인프라를 제공합니다.
플랫폼 보호: Google은 액세스 제어 관리, 보안 사고 모니터링, 보안 이벤트 대응을 포함하여 플랫폼 보안을 담당합니다. 또한 Google은 자체 보안 설정 및 구성을 관리할 수 있는 도구를 고객에게 제공합니다.
규정 준수 유지: Google은 관련 데이터 보호법 및 규정을 준수합니다. Google Cloud 규정 준수를 자세히 알아보세요.
이미지 강화 및 패치: Google은 Dataflow 소유 이미지에서 사용하는 기본 이미지의 운영체제를 강화하고 패치합니다. Google은 이러한 사용 가능한 이미지에 대한 모든 패치를 즉시 제공합니다.
알려진 취약점을 위해 보안 게시판이 제공됩니다.
고객의 책임
최신 버전의 Dataflow 컨테이너와 VM 이미지 사용 및 환경 업데이트: Dataflow는 사전 빌드된 컨테이너 및 VM 이미지를 제공하여 서비스 사용을 간소화합니다. 취약점이 식별되면 Google에서 이러한 이미지의 새 버전을 만듭니다. 보안 게시판을 모니터링하고 새 버전이 출시되면 즉시 환경을 업데이트하는 것은 개발자 책임입니다.
개발자는 최신 버전을 사용하도록 서비스를 올바르게 구성하거나 최신 버전으로 수동으로 업그레이드해야 합니다. 최신 VM을 사용하려면 작업을 업데이트하여 장기 실행 작업을 다시 시작합니다. 자세한 내용은 Dataflow VM 업그레이드 및 패치 적용을 참조하세요.
보안 문제를 신속하게 관리하려면 커스텀 컨테이너 이미지를 사용하는 것이 좋습니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eSecurity within Dataflow is a shared responsibility between Google, which secures the infrastructure and platform, and the customer, who manages their own data and applications.\u003c/p\u003e\n"],["\u003cp\u003eGoogle ensures the security of its infrastructure, platform, compliance, and base images, while also providing tools for customers to manage their own security settings.\u003c/p\u003e\n"],["\u003cp\u003eCustomers are responsible for updating their environment to the latest versions of Dataflow containers and VM images, including managing custom images and using distroless base images where applicable.\u003c/p\u003e\n"],["\u003cp\u003eCustomers must manage access controls, secure their own applications, monitor for security incidents, and promptly report any vulnerabilities to Google.\u003c/p\u003e\n"],["\u003cp\u003eIt is important for customers to subscribe to Dataflow security bulletins, follow Dataflow release notes, follow Apache Beam release notes, and avoid the deprecated Monitoring agent option.\u003c/p\u003e\n"]]],[],null,["# Dataflow shared responsibility\n\nSecurity is a shared responsibility. Dataflow secures the scalable\ninfrastructure that you use to run your Dataflow pipelines and\nprovides you tools and security controls to protect your data, code, and models.\nWhile not an exhaustive list, this document lists the responsibilities for both\nGoogle and the customer.\n\nGoogle's responsibilities\n-------------------------\n\n- **Protect the infrastructure**: Google is responsible for providing secure\n infrastructure for its services, including physical security of data centers,\n network security, and application security.\n\n- **Secure the platform**: Google is responsible for securing its platform,\n including managing access controls, monitoring for security incidents, and\n responding to security events. Google also provides customers with tools to\n manage their own security settings and configurations.\n\n- **Maintain compliance** : Google maintains compliance with relevant data\n protection laws and regulations. Learn more about\n [Google Cloud compliance](/security/compliance).\n\n- **Harden and patch images** : Google hardens and patches the operating system\n of [base images](/software-supply-chain-security/docs/base-images) used by the\n Dataflow-owned images. Google promptly makes any patches to\n these images available.\n [Security bulletins](/dataflow/docs/security-bulletins) are provided\n for known vulnerabilities\n\nCustomer's responsibilities\n---------------------------\n\n- **Use and update your environment to the latest versions of\n Dataflow containers and VM images** :\n Dataflow provides prebuilt containers and VM images to simplify\n the use of its services. Google will create new versions of these images when\n vulnerabilities are identified. It is your responsibility to monitor for\n [security bulletins](/dataflow/docs/security-bulletins) and update your\n environment promptly when new versions are available.\n\n You are responsible for ensuring\n that you properly configured your services to use the latest version, or to\n manually upgrade to the latest version. To use the latest VMs, restart\n long-running jobs by\n [updating the job](/dataflow/docs/guides/updating-a-pipeline). For more\n information, see\n [Upgrade and patch Dataflow VMs](/dataflow/docs/concepts/security-and-permissions#upgrade-patch).\n To manage security issues responsively, it is recommended that you use\n custom container images.\n\n If you're using a\n [custom container image](/dataflow/docs/guides/using-custom-containers)\n or a\n [custom template](/dataflow/docs/guides/templates/creating-templates),\n you're responsible for scanning and patching the custom images to mitigate\n vulnerabilities.\n\n If you're using a\n [Flex Template base image](/dataflow/docs/reference/flex-templates-base-images),\n to ensure security and reduce vulnerability risks, use Distroless base images\n when possible.\n- **Manage access controls** : You are responsible for managing access\n controls to your own data and services. This includes managing user access,\n authentication, and authorization controls, and securing your own\n applications and data. Learn more about\n [Dataflow security and permissions](/dataflow/docs/concepts/security-and-permissions).\n\n- **Secure applications**: You are responsible for securing your own\n applications running on Dataflow, including\n implementing secure coding practices and regularly testing for\n vulnerabilities.\n\n Learn more about\n [Customer-managed encryption keys](/dataflow/docs/guides/customer-managed-encryption-keys),\n [networks and VPC Service Controls](/dataflow/docs/guides/specifying-networks),\n and [permissions best practices](/dataflow/docs/concepts/security-and-permissions#best-practices).\n- **Monitor for security incidents**: You are responsible for monitoring\n your own applications for security incidents, and reporting any\n incidents to Google as necessary.\n\n - Subscribe to the [Dataflow security bulletins](/dataflow/docs/security-bulletins).\n - Follow the [Dataflow release notes](/dataflow/docs/release-notes).\n - Follow the [Apache Beam release notes](/dataflow/docs/resources/release-notes-apache-beam).\n - Learn more about [Monitoring](/dataflow/docs/guides/using-cloud-monitoring) and [Audit logging](/dataflow/docs/audit-logging).\n\n | **Note:** When using the Monitoring agent, the `--experiments=enable_stackdriver_agent_metrics` option uses a deprecated container image that isn't maintained and might have unpatched vulnerabilities. We recommend that you don't use this option.\n\nWhat's next\n-----------\n\n- Learn more about [shared responsibilities on Google Cloud](/architecture/framework/security/shared-responsibility-shared-fate).\n- Learn about how to [protect your software supply chain](/software-supply-chain-security/docs/practices)."]]
