Worker VM security and hardening

When you run data pipelines, maintaining a secure environment and meeting compliance requirements are critical challenges. Dataflow addresses these issues by automatically hardening and securing the virtual machines (VMs) that run your workers, which helps to protect your data and minimize security risks without manual effort.

Dataflow worker VM operating system

Dataflow worker VMs run on a Google-maintained, hardened version of Container-Optimized OS. Container-Optimized OS is designed and optimized by Google for running containerized workloads securely and efficiently on Google Cloud.

Dataflow uses Container-Optimized OS as the base for Dataflow worker VMs because of its security advantages:

  • Minimal attack surface: Container-Optimized OS includes the minimum set of packages necessary to run containers. This reduces the potential attack surface compared to general-purpose operating systems.
  • Security-centric design: Container-Optimized OS is built with security as a core principle. It has a read-only file system (except for essential writeable paths), a locked-down firewall, and other secure-by-default configurations.
  • Regular security updates: Google's security teams continuously monitor for vulnerabilities and provide timely patches and updates to the Container-Optimized OS image. Dataflow integrates these updates into its VM images.
  • Managed environment: As a fully managed service, Dataflow manages the entire lifecycle of the worker VM OS. This helps to ensure consistency, reliability, and the application of security best practices across all worker VMs.

Dataflow VM image hardening and security practices

Beyond the inherent security benefits of Container-Optimized OS, Google applies additional hardening and security practices to the Dataflow worker VM images:

  • Vulnerability scanning: Google regularly scans Dataflow-owned VM images and container images for known vulnerabilities by using internal vulnerability management systems that are integrated with industry-standard CVE feeds.
  • Timely patching: Google triages identified vulnerabilities and applies patches based on severity, adhering to defined Service Level Objectives (SLOs) and compliance programs like FedRAMP.
  • Compliance: Dataflow has achieved FedRAMP High certification, demonstrating adherence to stringent security standards and practices required by the US Federal government. This includes controls around vulnerability management and system hardening. For more information, see the Google Cloud compliance offerings.
  • Security bulletins: For significant vulnerabilities requiring customer action (for example, updating a long-running streaming pipeline), Dataflow publishes security bulletins.

Why custom OS images aren't supported

As a managed service, Dataflow abstracts the underlying infrastructure complexity. This includes the operating system. This approach helps Google provide a highly optimized, secure, and reliable service. You can't use custom OS images (such as an in-house hardened Debian) on Dataflow workers for these reasons:

  • Managed service integrity: Using custom images can decrease the stability and performance of Dataflow services while introducing security risks.
  • Direct integration: Dataflow components are directly integrated with the specific Container-Optimized OS environment, including networking, agents, and container runtimes.
  • Operational complexity: Managing and supporting a wide variety of custom OS images would introduce significant operational overhead and risk.
  • Security responsibility: Using custom images confuses the lines of responsibility for OS-level security and patching.

For more information on the division of security responsibilities, see the Dataflow shared responsibility model.

What's next