The query hit the firewall, but the database never saw it.
That is the goal of GCP Database Access Security Segmentation: reducing every path between an attacker and your data until nothing unnecessary remains. In Google Cloud Platform, it means dividing network routes, user roles, and service permissions into precise, minimal zones. Each segment contains only what it needs to function—and nothing more.
At the core is Identity and Access Management (IAM). Define roles per database, per environment, and sometimes down to a single table. Avoid broad roles like roles/editor for database operations. Instead, map each service account to narrow, specific permissions. This segmentation stops lateral movement if one account is compromised.
VPC Service Controls add another layer. A GCP database inside a protected service perimeter will reject incoming requests from outside the perimeter’s network, even if the credentials are valid. Combine this with private IP connectivity to Cloud SQL, Spanner, or Bigtable, and public exposure drops to zero.
Network segmentation is physical in design and logical in enforcement. Use separate subnets for dev, staging, and production databases. Apply firewall rules that only allow required sources. If a VM or container doesn’t need database access, it should have no route to the subnet.