Is Cloud an option for Canadian Healthcare healthcare and medical research organizations?

Yes, Canadian healthcare and medical research organizations are moving to the cloud. The cloud market is expected to grow in Canada significantly through 2027.

There are several reasons why Canadian healthcare and medical research organizations are moving to the cloud. 

• Reduce costs by eliminating the need to invest in and maintain on-premises infrastructure. 
• Enable the healthcare research community to drive their research more expediently to clinical outcomes
• Improve patient satisfaction by making it easier for patients to access their health information and communicate with their providers.
• Improve the quality of care by providing access to patient data and records from anywhere in the country. 

Overall, the transition to the cloud is a positive development for Canadian healthcare and medical research organizations. 

Canadian healthcare providers face many challenges before they can move to the cloud, such as addressing security and privacy concerns, data sovereignty issues, and ensuring interoperability. To help them overcome these challenges, it is important to provide Healthcare Data Custodians, Infrastructure Architects, and Research Leads with clear guidance on how the cloud can align with Canadian Healthcare Regulations. This will allow them to have a practical understanding of what is required to enhance their cloud journey and facilitate a smoother transition to the cloud.

iSecurity and MD+A Health are actively assisting Canadian healthcare and medical research organizations in comprehending the risks and exploring pathways to embrace the cloud. Through extensive research and analysis, iSecurity and MD+A Health have evaluated Google Cloud as a suitable platform for healthcare. Their diligent efforts have resulted in the production of comprehensive documents that detail their findings via a Threat Risk Assessment (TRA) and a Privacy Impact Report (PIA).

Why a Threat Risk Assessment? 

A threat risk assessment is a process of identifying and evaluating threats to an organization and then determining the likelihood and impact of those threats. The goal of a threat risk assessment is to identify the most serious threats and develop mitigation strategies to reduce the likelihood and impact of those threats.

A threat risk assessment typically involves the following steps:

1. Identify threats: The first step is to identify all potential threats to the organization. This can be done by brainstorming, interviewing experts, or reviewing historical data.
2. Evaluate threats: Once the threats have been identified, they need to be evaluated in terms of their likelihood and impact. The likelihood of a threat is the probability that it will occur, while the impact of a threat is the severity of the consequences if it does occur.
3. Prioritize threats: The threats need to be prioritized based on their likelihood and impact. The most serious threats should be addressed first.
4. Develop mitigation strategies: Once the threats have been prioritized, mitigation strategies need to be developed to reduce the likelihood and impact of those threats. Mitigation strategies can include things like implementing security controls, training employees, and developing contingency plans.
5. Implement mitigation strategies: The mitigation strategies need to be implemented and tested to ensure that they are effective.
6. Monitor and review: The threat risk assessment should be monitored and reviewed regularly to ensure that it is still effective.

Why a Privacy Impact Assessment?

A Privacy Impact Assessment (PIA) is a process that organizations use to identify and assess the privacy risks associated with a new or changed information technology (IT) system or project. The goal of a PIA is to help organizations protect the privacy of individuals whose personal information is collected, used, or disclosed by the IT system or project.

PIAs typically include the following steps:

1. Identifying the purpose of the IT system or project and the types of personal information that will be collected, used, or disclosed.
2. Identifying the privacy risks associated with the IT system or project.
3. Assessing the likelihood and severity of the risks.
4. Developing and implementing controls to mitigate the risks.
5. Monitoring the effectiveness of the controls.

PIAs are an important tool for organizations to help them follow privacy laws and regulations. They can also help organizations build trust with their patients, employees and the research community by demonstrating their commitment to protecting privacy.

The benefits of conducting a PIA:

• Helps organizations identify and assess privacy risks
• Helps organizations develop and implement controls to mitigate privacy risks
• Helps organizations comply with privacy laws and regulations
• Helps organizations build trust with customers and employees

Why Google Cloud?

Google Cloud is committed to providing Canadian healthcare organisations with an environment to expand both their clinical and research environments. Google Cloud has invested significant resources into building out a cloud environment based on best practices coming from Google’s experience running some of the world’s largest platforms.  

Some highlights include:

• Built-in security features that help protect your data and applications from unauthorized access, use, disclosure, disruption, modification, or destruction.
• A comprehensive security management platform that helps you assess, prioritize, and address security risks across your organization.
• A team of security experts who can help you design, implement, and manage your security solutions.
• A wide range of security training and resources to help you learn about and stay up-to-date on the latest security threats and best practices.

For a look ahead at the trends that will animate the retail industry this year, let’s take a look back at the 2022 National Retail Federation (NRF) “Big Show” in NYC.

Attendees at January’s event were treated to tangible examples of how retail challenges are being solved today, including new solutions to help them parse customer expectations and buying patterns, adapt stores into omni-channel experience hubs, and improve data visibility and actionability.

NRF 2022 also took the “omni-channel everything” theme of last year’s show to the logical next level: Enabling the best hybrid experiences. The message came through loud and clear of the importance of integration and interoperability in this new hybrid world – making everything work well together.

The need for modern digital infrastructure to enable this blending of physical and digital retail smoothly is paramount. To that end, technology vendors demonstrated how digital transformation initiatives, such as contactless and real time IoT and mobile applications, need to be built on cloud, edge, and secure connectivity to allow retailers to achieve the modern seamless hybrid retail that today’s consumer wants.

Other prominent themes and technologies highlighted at NRF included: extending engagement in the metaverse, sustainability, physical and digital security, and the agility and adaptability imperative.

The Metaverse and Hybrid (Omni-channel) Experiences

Today, the metaverse is an extension of our lives, enhanced by technology, which exists as a series of virtual worlds. In the future, the metaverse will be an interconnected, endless world where digital and physical lives fully converge. Imagine waiting for an appointment at a real booth on the NRF show floor while your avatar roams a fully fleshed-out digital NRF, meeting other virtual attendees, stopping for coffee at the digital Starbucks, and paying for a coffee that an in-the-flesh Starbucks employee brings to them. Digital and physical selves merge seamlessly in the metaverse, as the worlds draw closer together.

In the metaverse, brands have a digital presence, too. Nike filed seven trademarks late last year, including those for “Nike,” “Just Do It,” and its swoosh logo, and posted openings for virtual designer roles, indicating its intent to make and sell virtual branded sneakers and apparel. It subsequently purchased RTFKT Studios, a company that already makes and sells NFTs and digital sneakers. (In one collaboration with teenage artist FEWOCiOUS, the company sold 600 pair/NFTs of sneakers in just six minutes to the tune of more than $3.1 million.)

The metaverse also opens possibilities for gathering data about consumers and product demand. Imagine a sneaker drop in the virtual world. Certain styles of new kicks sell like gangbusters, giving the brand insight into what might sell IRL, intelligence that leads to trend-right production and less inventory headed for markdown or landfills. The metaverse can be a vehicle for more sustainable operations.

The metaverse further bridges the narrowing gap between digital worlds and physical worlds. Most consumers aren’t outfitting an avatar, but they are moving between online and offline and expect retailers to accommodate those hybrid omni-channel journeys seamlessly. Those demands have accelerated around last-mile delivery and experiences such as buying online and picking up in store (BOPIS) or at curbside, shopping in store and returning merchandise online, adding items to a BOPIS purchase when at the store, or communicating a substitution to the third-party grocery delivery service

Hybrid experiences open opportunities to please the consumer in new ways, but they also add expense and complexity. The need to meet this demand while enabling profitability was a major theme behind many of the technologies discussed at NRF. These included artificial intelligence (AI) for recommending the right product, return logistics software for defining and guiding product-specific reverse logistics workflows, order orchestration and fulfillment applications for omni-channel shopping, and last-mile delivery visibility for optimizing customer experience, to name a few. Also on display were task management applications help to improve and optimize in-store employee engagement, as well as touch-free applications to allow for faster payments and customer self-service checkout. RFID continues to improve inventory accuracy and inventory locating on the shelf, throughout the store, and the supply chain.

Sustainability

NRF 2022 saw a strong focus on sustainability. An NRF/IBV study released at the show highlighted the significant embrace of sustainable shopping by consumers. According to the survey, 62% of shoppers are “willing to change their purchasing habits to reduce environmental impacts.” About half indicated a willingness to pay a premium – on average a 70% premium – for sustainable products and brands.

Retailers are working to improve sustainability and reduce carbon footprint across operations by using sustainable sourcing through the supply chain, the store, and even returns. Tech vendors unveiled a variety of solutions enabled by cloud/edge, AI, computer vision, and IoT/RFID to allow retailers to effectively measure and record their environmental efforts, with the goal of reducing their impact.

Several cloud and digital infrastructure providers showcased sustainability clouds and other technology aimed at asset management with the goal of reducing energy consumption, water usage, waste. Examples included using IoT sensors to reduce water usage, optimizing re-use of store assets, and dashboards that allow retailers to accurately monitor and measure carbon output. However, such sustainability solutions can be most successful when running on the next-generation digital infrastructure that helps retailers better compete and differentiate in today’s omni-channel world.

Physical and Digital Security

According to a 2021 NRF survey, 57% of U.S. retailers reported the pandemic led to an increase in organized retail crime, while 50% reported an increase in shoplifting. When IDC’s Future Enterprise Resiliency & Spending Survey, Wave 10 (November 2021) asked retailers which digital infrastructure investments would provide the greatest strategic advantage in 2022, their #1 response was “cybersecurity and recovery investments.”

A wide range of technology vendors acknowledged retailer concerns with regards to security, fraud, and loss prevention:

• Networking, connectivity, and edge vendors highlighted multilayer security solutions that promise to protect data from a range of IoT applications that utilize customer and associate data. Many offer security consulting services to address varied threats including ransomware, retail crime, and loss prevention.
• Security and e-commerce security vendors showcased solutions to prevent fraud and abuse in e-commerce applications as well as omni-channel applications such as BOPIS and curbside pickup, using AI-based analysis for identifying “bad”/risky customers and mitigating risk.
• Cloud vendors highlighted how retail clouds provide consistent, reliable identity management and data security.
• POS/payments/store technology vendors emphasized their ability to handle payments securely from any platform with multifactor tokenization, improved identity techniques such as biometrics and voice authentication, as well as AI-enabled and computer vision solutions for loss prevention at checkout and at the door.

The Agility and Adaptability Imperative

On display at the show were multiple flavors of the digital infrastructure technology that retailers need to achieve agile, personalized, data-driven, integrated seamless operations across the many channels of today’s retail landscape. The emphasis was apt. More than half of retailers plan to boost investment in business agility and operational agility over the next 12 months, according to IDC’s Future Enterprise Resiliency & Spending Survey, Wave 10 (November 2021).

Technology vendors highlighted their connectivity investments to enable business and operational agility and their technology investments for better ease of integration, scalability, and the ability to more easily swap out or mix and match applications with integrated platforms, open systems, hybrid cloud, and retail industry clouds.

Vendors also showed off infrastructure to better harness data while enabling its visibility, maximizing its value, and providing the data-driven personalization essential for competitive advantage and differentiation. Highlights included fast, secure connectivity, 5G and Wifi-6, and edge- and cloud-enabled data and AI platforms to generate real-time insights – all designed to enable today’s omni-channel retail.

Advice for the technology buyer

Retailers should consider these key themes from NRF 2022 when making technology investment decisions for 2022 and beyond. To avoid lagging behind those retailers already moving toward thriving into the future, take action to:

• Enable the seamless, contactless omni-channel approach that today’s consumers want and expect.
• Replace legacy infrastructure that was not built to handle the modern retail environment that requires the agility and adaptability to seamlessly connect rapidly increasing volumes of data securely and more quickly than ever.

Whether sustainability, adaptability, the metaverse, or security are top concerns, addressing business needs holistically and strategically should be job #1.

Continue the conversation by downloading our Transforming retail and CPG markets whitepaper today.

The financial services industry is evolving at a rapid pace, with shifting consumer expectations, new technologies, and developing regulatory requirements. Financial services firms need the right technology to help them stay agile and prepare for the future. 

The cloud is a key point of leverage for firms looking to improve performance across a broad range of activities. Moving to the public cloud can advance operational resiliency, improve staff productivity, increase regulatory compliance and enhance business model innovation. 

However, there are a number of financial services companies that are still hesitant in their cloud journeys. The barriers to adoption vary, from the complexity of legacy systems, to trust and skills gaps, regulatory uncertainty, and fragmentation of compliance requirements. Although many companies have embraced the benefits of cloud technology, more robust cloud adoption—especially around core back-office functions—will require additional facilitation, including through regulatory harmonization and streamlining.

A new comprehensive study on cloud adoption in financial services

To better understand the challenges and opportunities of cloud adoption in financial services Google Cloud, together with the Harris Poll, surveyed more than 1,300 leaders from the financial services industry across the United States, Canada, France, Germany, United Kingdom, Hong Kong, Japan, Singapore and Australia. 

There were five noteworthy takeaways from the study:  

1. A vast majority of financial services companies are already using some form of public cloud. A large number of surveyed financial services companies (83%) report they are deploying cloud technology as part of their primary computing infrastructures. Of those using cloud technology, the most popular architecture of choice is hybrid cloud (38%), followed by single cloud (28%), and multicloud (17%). Notably, of respondents without a multicloud deployment, 88% reported they are considering adopting a multicloud strategy in the next 12 months.

2. Financial services institutions in North America are leading in cloud adoption. Of the financial services companies who are implementing a cloud strategy, the highest levels of cloud workload adoption were reported in North America, with institutions in the U.S. (54%) and Canada (52%) leading the way. The lowest level of cloud adoption was reported in Japan (42%).

3. As financial services companies continue to use the cloud, more core functionalities can and will be migrated. While many financial services companies have migrated substantial workloads to the cloud, the industry is far from full adoption when it comes to core, back-office workloads. Of financial services companies currently using a majority cloud strategy in the United States, for example, only half (54%) of their workloads are fully deployed in the cloud. Data and IT security (74%), regulatory reporting (57%), and fraud detection and prevention (57%) rank among the highest workload adoption. Core underwriting activity (40%) and data reconciliation (48%) ranked lowest. Across Europe, cloud usage for core activities like underwriting also scored low with the UK listing only 30% adoption.

4. Among respondents, there is a very strong positive perception of the potential for cloud technology to assist in business operations and regulatory compliance. Nearly all respondents (>88%) agreed that cloud adoption can:

1. help adapt to changing customer behaviors and expectations,  
2. enhance operational resilience, 
3. support the creation of innovative new products and services, 
4. enhance financial services institutions’ data security capabilities, and 
5. better connect siloed legacy software infrastructure within financial services institutions. 

5. Certain regulator-induced challenges, including the complexity of sectorial compliance frameworks and fragmentation, create hurdles to cloud adoption for financial services companies. While 88% of respondents had a positive view of current regulatory efforts to provide guidance and clarity for cloud implementation, the results showed that more needs to be done to facilitate adoption. Most respondents (84%) agree that regulatory reviews and approvals take too long because of regulatory fragmentation across regulatory bodies. And 78% say that regulatory uncertainty over the use of public cloud prevents their organizations from adopting cloud technologies that would otherwise provide benefit to them. Additionally, a third of all on-premises respondents (38%) say that the large investment of resources for the regulatory approval process is a reason why they’re not using cloud services.

“While many banks have already deployed hybrid cloud environments, others are still in various stages of planning and deploying,” said Jerry Silva, research vice president for IDC Financial Insights. “Clearly, hybrid infrastructure is a reality, and financial institutions must focus not only on leveraging the modern infrastructure model to gain efficiencies, resilience and agility, but also on taking the necessary steps to manage such environments, including the security and compliance of cloud services.”

Future recommendations for financial services regulators

Financial services firms should continue to maximize the potential of technology by migrating more core workloads to the cloud, and actively considering multicloud and hybrid-cloud strategies. Such strategies enhance resiliency of existing IT infrastructure and reduce concerns over vendor lock-in. 

The research also points to steps that regulators could take to provide additional clarity and guidance, such as aligning regulatory reviews across agencies to avoid fragmentation; developing regulatory “safe harbors” for cloud adopters based on adherence to accepted standards and best practices; training regulatory staff on emerging tech; and advancing data reporting requirements via cloud and related technologies.

In the past few years, many regulators across the globe have taken a robust approach to rationalizing rules and guidance to cloud adoption in the financial sector, which has helped significantly stimulate adoption. But further assurances and harmonization of best practices around supervision is needed to advance risk-based and secure digital innovation.  

At Google Cloud, we’re committed to working with financial services customers and regulators to provide them with controls and assurances on risk management, data locality, transparency, and compliance. We are constantly engaging with regulators to share information, respond to their considerations and concerns, and address questions in the interest of transparency and building trust. 

To learn more about these findings and more, download our infographic and our full report. 

^{Research methodology}

^{The survey was conducted online by the Harris Poll on behalf of Google Cloud, from December 7, 2020, to January 4, 2021, among 1,363 senior executives in France (n=113), Germany (n=178), the UK (n=192), Hong Kong (n=99), Indonesia (n=100), Japan (n=142), Singapore (n=71), Australia (n=134), Canada (134), and the United States (n=200) who are employed full-time, part-time, or self-employed whose main functional role is in risk/compliance or IT at a company in the banking, finance, or financial services industry with a title of director level or higher. The data in each country were weighted by the number of employees to bring them into line with actual company size proportions in the population. A global post-weight was applied to ensure equal weight of each country in the global total.}

I’m excited to share our first Cloud CISO Perspectives post of 2022. It’s already shaping up to be an eventful year for our industry and we’re only in month one. There’s a lot to recap in this post, including the U.S. government’s recent efforts to address critical security issues, like open source software security and zero trust architectures. We’ve also released new resources from our Google Cybersecurity Action Team like the Cloud Security Megatrends and the Boards of Directors whitepaper on cloud risk governance. 

Cloud Security Megatrends 

We’re often asked if the cloud is more secure than on-prem (and why) so we shared our answer in a recent blog post. At Google Cloud, security by design is our priority. We’ve long adopted zero-trust principles for our baseline security architectures and built a global network that relies on defense in depth layers to protect against configuration errors and attacks. But security is always evolving and that is why we also take advantage of the following megatrends:

1. Economy of scale: Decreasing the marginal cost of security raises the baseline level of security. 
2. Shared fate: A flywheel of increasing trust drives more transition to the cloud, which compels even higher security and even more skin-in-the-game from the cloud provider.
3. Healthy competition: The race by deep-pocketed cloud providers to create and implement leading security technologies is the tip of the spear of innovation. 
4. Cloud as the digital immune system: Every security update the cloud gives the customer is informed by some threat, vulnerability, or new attack technique often identified by someone else’s experience. Enterprise IT leaders use this accelerating feedback loop to get better protection.
5. Software-defined infrastructure: Cloud is software defined, so it can be dynamically configured without customers having to manage hardware placement or cope with administrative toil. From a security standpoint, that means specifying security policies as code, and continuously monitoring their effectiveness.
6. Increasing deployment velocity: Because of cloud’s vast scale, providers have had to automate software deployments and updates, usually with automated continuous integration/continuous deployment (CI/CD) systems. That same automation delivers security enhancements, resulting in more frequent security updates.
7. Simplicity: Cloud becomes an abstraction-generating machine for identifying, creating and deploying simpler default modes of operating securely and autonomically. 
8. Sovereignty meets sustainability: The cloud’s global scale and ability to operate in localized and distributed ways creates three pillars of sovereignty. This global scale can also be leveraged to improve energy efficiency.

If you’re an IT decision maker, pay attention to these megatrends that will continue to drive and reinforce cloud security and will outpace the security of on-prem infrastructure well into the future. 

U.S. Federal government cybersecurity momentum 

• Open source software security: Earlier this month, Google participated in the White House Summit on open source software security. The meeting came at a critical time for the industry following December’s Log4j vulnerabilities and was both a recognition of the challenge and an important first step towards addressing it. The open source software ecosystem is not homogenous, despite the fact that the industry often thinks of or treats it this way. Some of it, like Linux, is highly curated, while other critical software is supported through diffuse communities including technology companies and other stakeholders. There is also a long tail of many other critical projects driven by a dedicated community of maintainers around the world, including Googlers. In light of this reality, we welcomed the chance to share our recommendations to advance the future of open source software security. Some work we’ve done includes founding the Open Source Security Foundation, which has been instrumental already in making security improvements. We’ve also helped drive a number of key security initiatives within the open source community including security scorecards, the SLSA framework to improve the security and integrity of open source packages, and Secure Open Source Rewards to financially incentivize improvements to critical open source security projects.  
• OMB’s Federal zero trust strategy: The publication of the Office of Management and Budget’s zero trust architecture strategy marks an important step for the U.S. federal government’s efforts to modernize under Executive Order 14028. Google Cloud supports this approach, which recognizes the immense security benefits offered by modern computing architectures. For the past decade, Google has successfully applied zero trust principles through our BeyondCorp and BeyondProd frameworks for providing end-user access and securing our cloud workloads. And we’ve brought these best practices from our own journey to global governments and businesses of any size through solutions like BeyondCorp Enterprise and capabilities like Binary Authorization and Anthos Service Mesh, which are embedded in Anthos, our managed application platform. For Federal agencies embarking on this zero trust journey, the Google Cybersecurity Action Team will offer our expertise by conducting Zero Trust Foundations strategy workshops, which can help organizations in the public and private sectors develop actionable and achievable strategies and plans for zero trust implementation. 

Google Cybersecurity Action Team Highlights 

Here are the latest updates, products, services and resources across our security teams this month: 

Security

• Democratizing security operations: We recently announced that Siemplify, a leading security orchestration, automation and response (SOAR) provider, is joining Google Cloud to help companies better manage their threat response. Providing a proven SOAR capability with Chronicle’s approach to security analytics is an important step forward in our vision to advance invisible security and democratize security operations for every organization.
• Security by design: The Highmark Health security team is using “secure-by-design” techniques to address the security, privacy, and compliance aspects of its Living Health solution with Google Cloud’s Professional Services Organization (PSO). Google has long advocated for and followed security by design principles, which is why we’re continuously building enhanced security, controls, resiliency and more into our cloud products and services. 
• Secure collaboration for hybrid work environments: The Google Workspace team shared its recommendations for businesses as they prepare for the future of work,  where the hybrid/flexible work model is becoming standard practice and a new approach to security is essential.
• Anthos Policy Controller CIS Benchmark enforcement: A big part of our shared fate philosophy is to build secure products and not just security products. A recent example of this in action is embedding CIS benchmark policy conformance in the Anthos Policy Controller. We believe the more we embed approaches like this into our products, the more application and infrastructure teams can intrinsically embed security at the start and reduce toil for the security team.
• DevOps for technology-driven organizations and startups: A key success factor for many security programs is the partnership and integration with development teams, and there are some great resources and lessons in our DORA research.
• Security by design with Chrome OS: ABN AMRO’s Asia-Pacific region team recently shared how they are using Chrome OS and CloudReady to work securely in the cloud, reduce total cost of ownership, and add flexibility for employees. This is a great example of secure by design principles in the use of Chromium.

Risk & Compliance

• Boards of Directors summary guide to cloud risk governance: The latest whitepaper from the Google Cybersecurity Action Team outlines how boards of directors can prioritize safe, secure, and compliant adoption processes for cloud technologies within their organizations.  
• TruSight Risk Assessment of Google Cloud: TruSight recently released a comprehensive
  risk assessment report on Google Cloud. Our Enterprise Trust team collaborated on this robust assessment of Google Cloud services to validate the design and implementation of controls. TruSight’s risk assessment of our security controls will help customers accelerate and complete their risk management due diligence.
• Data governance: Check out this new blog series on data governance where our teams explain the role of data governance, its importance, and the necessary processes to run an effective data governance program. Implementing data governance will help maximize value derived from business data, build user trust, and ensure compliance with required security measures.

Controls and Products

• Encrypting Data Fusion: To help meet the security, privacy and compliance requirements of customers in regulated industries like finance or public sector, we announced the general availability of Customer Managed Encryption Keys (CMEK) integration for Cloud Data Fusion, which enables encryption of both user data and metadata at rest with a key that customers can control through our Cloud Key Management Service (KMS). 

Don’t forget to sign-up for our newsletter if you’d like to have our Cloud CISO Perspectives post delivered every month to your inbox. We’ll be back next month with more updates and security-related news.

New locations in Eventarc

Back in August, we announced more Eventarc locations (17 new regions, as well as 6 new dual-region and multi-region locations to be precise). This takes the total number of locations in Eventarc to more than 30. You can see the full list in the Eventarc locations page or by running gcloud eventarc locations list . 

What does location mean in Eventarc?

An Eventarc location usually refers to the single region that the Eventarc trigger gets created in. However, depending on the trigger type, the location can be more than a single region:

• Pub/Sub triggers only support single-region locations.
• Cloud Storage triggers support single-region, dual-region, and multi-region locations.
• Cloud Audit Logs triggers support single-region locations and the special global region.

Before looking into trigger location in more detail, let’s look at other locations relevant in Eventarc.

What other locations are relevant in Eventarc?

Triggers connect event sources to event targets:

Each event source, event target, and trigger has its own location. Sometimes, these locations have to match and sometimes they can be different.  

Here’s an example of a trigger connecting Cloud Storage events from a bucket in the europe-west1 region to a Cloud Run service in the us-central1 region with a trigger located in the europe-west1 region:

  gcloud eventarc triggers create trigger-storage \
  --destination-run-service=hello \
  --destination-run-region=us-central1 \
  --location=europe-west1 \
  --event-filters="type=google.cloud.storage.object.v1.finalized" \
  --event-filters="bucket=my-bucket-in-europe-west1-region" \
  --service-account=$PROJECT_NUMBER-compute@developer.gserviceaccount.com

In many cases, you don’t have control over the location of the event source. In the example above, the Cloud Storage bucket is in the europe-west1 region. That’s the location that you need to work with and it has implications for the trigger location (which I’ll get to later). 

The location of the event target is the region of the service where you want the events to go. You get to choose this from one of the supported regions when you deploy your Cloud Run service. You typically want this to be in the same region as your event source for latency and data locality reasons (but this is not strictly a requirement). In the example above, the event source (bucket) is in europe-west1 but the event target (Cloud Run service) is in  us-central1 as specified by the --destination-run-region flag. 

The location of the trigger is dictated by the event source location, but the trigger type also comes into play. It is specified by the –location flag. Let’s take a look at the trigger location for each trigger type in more detail.

Location in Pub/Sub triggers

In a Pub/Sub trigger, you connect a Pub/Sub topic to an event target. Pub/Sub topics are global and not tied to a single region. However, when you create a Pub/Sub trigger, you need to specify a region for it (because Eventarc triggers need to live in a region) with the --location flag as follows:

  gcloud eventarc triggers create trigger-pubsub \
  --destination-run-service=hello \
  --destination-run-region=us-central1 \
  --location=us-central1 \
  --event-filters="type=google.cloud.pubsub.topic.v1.messagePublished" \
  --transport-topic=projects/your-projectid/topics/your-topic

By specifying a location, Eventarc automatically configures the geofencing feature in Pub/Sub such that events only persist in the specified location. As I noted above, you typically want to (but are not required to) choose the same region for the trigger and the Cloud Run service for lower latency and data locality. You can also use regional Pub/Sub service endpoints to publish to the topic to ensure that all of the data stays in a single region. 

Location in Cloud Storage triggers

In a Cloud Storage trigger, you connect a Cloud Storage bucket to an event target. A Cloud Storage bucket can be in a single-region (e.g. europe-west1), dual-region (e.g. eur4), or multi-region (e.g. eu) location. The location of the bucket dictates the location of the trigger and they have to match. The earlier trigger example was for a bucket in the  europe-west1 single-region location. Here’s another trigger connecting Cloud Storage events from a bucket in the eu multi-region location. Notice how the location flag matches the bucket region:

  gcloud eventarc triggers create trigger-storage \
  --destination-run-service=hello \
  --destination-run-region=us-central1 \
  --location=eu \
  --event-filters="type=google.cloud.storage.object.v1.finalized" \
  --event-filters="bucket=my-bucket-in-eu-multi-region" \
  --service-account=$PROJECT_NUMBER-compute@developer.gserviceaccount.com

If the bucket region and the trigger region do not match, you’ll see an error:

  ERROR: (gcloud.eventarc.triggers.create) INVALID_ARGUMENT: The request was invalid: Bucket "my-bucket-in-eu-multi-region" location "eu" does not match trigger location "europe-west1". Try again by creating the trigger in "eu".

Location in Cloud Audit Logs triggers

In a Cloud Audit Logs trigger, you connect any event source that emits Audit Logs to an event target. The location of the event source will dictate the trigger location. This is typically a single region but there is a special global region that’s necessary in some cases. 

For example, if you want to read Cloud Storage events from a bucket in the europe-west1 region with an Audit Logs trigger, you will create the trigger with the same location. Note that this will match all buckets in the europe-west1 region as there’s no filter by bucket in Audit Logs:

  gcloud eventarc triggers create trigger-auditlog \
  --destination-run-service=hello \
  --destination-run-region=us-central1 \
  --location=europe-west1 \
  --event-filters="type=google.cloud.audit.log.v1.written" \
  --event-filters="serviceName=storage.googleapis.com" \
  --event-filters="methodName=storage.objects.create" \
  --service-account=$PROJECT_NUMBER-compute@developer.gserviceaccount.com

On the other hand, if you want to match a dual-region or a multi-region bucket such as eu, you will create the trigger with the global location as Audit Logs triggers only support a single or global region. Note that this will match all buckets in all regions globally:

  gcloud eventarc triggers create trigger-storage \
  --destination-run-service=hello \
  --destination-run-region=us-central1 \
  --location=global \
  --event-filters="type=google.cloud.storage.object.v1.finalized" \
  --event-filters="bucket=my-bucket-in-europe-west1-region" \
  --service-account=$PROJECT_NUMBER-compute@developer.gserviceaccount.com

As you can see from this example, if you want to read Cloud Storage events, the native Cloud Storage trigger is a much better option, but this example illustrates a typical case in which a global Audit Log trigger is necessary. 

That wraps up this closer look at locations in Eventarc. Feel free to reach out to me on Twitter @meteatamel for any questions or feedback.