Security in the cloud is complicated. It does not fit your mental model unless you dive DEEPLY into it. SANS SEC510 (by Brandon Evans) and the associated GPCS exam are the only places I have ever found the complexities analyzed & explained. But even that doesn't include everything. My favorite recent example is this part of a sentence: "When you create a LoadBalancer Service, GKE configures a Google Cloud pass-through load balancer…"