Content production is increasingly happening in the cloud. While moving a creative process that spans three centuries into the modern era brings challenges and risks, MovieLabs is one organization that takes digital transformation seriously.

A nonprofit research and development group founded by a consortium of the major Hollywood studios, MovieLabs describes their mission as “exploring innovative solutions to industry challenges shared by both our member studios and the broader production, post-production and distribution ecosystem.”

In more than 50 pages of densely-packed ideas and principles, MovieLab’s The Evolution of Media Production lays out an ambitious and revelatory vision for streamlining media production in the cloud. The key themes are summarized in 10 declarative statements, which envision a new modality for media production by the year 2030:

1. All assets are created or ingested straight into the cloud and do not need to be moved.
2. Applications come to the media.
3. Propagation and distribution of assets is a “publish” function.
4. Archives are deep libraries with access policies matching speed, availability and security to the economics of the cloud.
5. Preservation of digital assets includes the future means to access them and edit them.
6. Every individual on a project is identified and verified, and their access permissions are efficiently and consistently managed.
7. All media creation happens in a highly secure environment that adapts rapidly to changing threats.
8. Individual media elements are referenced, accessed, tracked and interrelated using a universal linking system.
9. Media workflows are non-destructive and dynamically created using common interfaces, underlying data formats and metadata.
10. Workflows are designed around real-time iteration and feedback.

The four bolded statements above are further explored in a follow-up whitepaper from MovieLabs, The Evolution of Production Security, which likewise offers six statements about what secure production in the cloud should look like:

1. Security is Intrinsic and does not Inhibit Creative Processes
2. The Security Architecture Addresses Challenges Specific to Cloud Workflows
3. Production Workflows, Processes, and Assets are Secure, even on Untrusted Infrastructure
4. The Content Owner Controls Security and Workflow Integrity
5. The Security Can Be Scaled to Appropriate Levels and Can Integrate
6. The Security Architecture Limits the Spread of any Breach and is Adaptable

The key to understanding these two papers is repeated in their titles: Evolution. Neither document is meant to outline solely what’s possible today; rather they are beacons guiding us toward a future in which the movie business is truly transformed by the cloud operating model. That means a future where media productions run much more like software supply chains: with speed, agility, and scale, and without sacrificing availability or security.

The good news is that it is possible to deploy secure production workloads in the cloud today. Using some of the built-in security features of Google Cloud, content producers can achieve Common Security Architecture for Production (CSAP) “Level 100” security for their assets (using the CSAP scale L100-L300). 

However, we think that “evolution” word is important. As many companies have learned, operating an infrastructure cloud can be costly and often presents new threat vectors for attackers. Our mission at Google Cloud is to provide scalable, reliable services for traditional IT functions and to accelerate the abilities of every organization to digitally transform its business. 

We believe the era of the transformation cloud is dawning, and companies who have been successfully operating in the cloud for years are now looking for ways to reduce costs while maintaining the cloud-scale advantages of agility and global reach. This aligns perfectly with the evolutionary vision of the MovieLabs papers, which envision media workflows changing radically to embrace cloud dynamism without all the unnecessary asset movement and complexity.

An important part of that vision from Google Cloud is that cloud service providers should remain open and interoperable with other clouds and infrastructures.

Here is a quickstart guide to mapping the L100 CSAP requirements to Google Cloud:

As you can see in the diagram, external identity providers (IdPs) such as Okta or Active Directory can serve as core security components of a CSAP L100 architecture. Alternatively, Google Cloud services such as Cloud Identity or Managed AD could be substituted.

Next, Google Cloud’s Identity-Aware Proxy (IAP) can be used in combination with Access Context Manager (ACM) to act as the first Policy Enforcement Point. This is an optional step, since it is somewhat redundant with the routing and authorization function performed by the native HP/Teradici Connection Brokers. However, IAP and ACM are core components of Google Cloud’s BeyondCorp architecture, on which CSAP is based. Additionally, adopting IAP with ACM offers productions the ability to swap out the Teradici PCoIP protocol for an alternative, such as Unity’s Parsec, without sacrificing security.

The Teradici Connection Broker is also a Policy Enforcement Point, since groups and role membership can be used to enforce access to specific workstations. 

Finally, the identity context for each user is passed through to the storage layer. For some productions, Google Cloud Storage (GCS) buckets may offer enough functionality; GCS offers an S3-compatible API which should make it easy to immediately adopt OSS tools built for S3. Other options for this include the managed NetApp Cloud Volumes and Dell PowerScale for Google Cloud services. Both of these are managed shared storage services which offer file-level access controls using standard SMB/NFS permissions. There are also a variety of third-party filers available in the Google Cloud Marketplace, such as Nasuni. You can read more about those here.

For added security, both NetApp and PowerScale should be configured to use the private services access model in Google Cloud. This effectively limits any external access to these resources by only allowing traffic from user-managed VPCs into the Google-managed and peered VPC.

Following this architecture, you can see how to achieve CSAP L100 compliance by using either only Google Cloud services or a mix of managed and cloud-first services. In either scenario, access is managed through a unified control plane and based on both user identity and role. Zero Trust principles such as context-aware access and dynamic rulesets could further be applied to the Authentication step using either Google Cloud IAP or the equivalent services from Okta, Active Directory, or others.

At this weekend’s National Association of Broadcasters conference, Google experts will be talking about the cloud and content production, and the intersection of AI and media. The journey to 2030 is only just beginning.

At AirAsia, we operate a fleet of more than 270 aircraft across 23 markets, fly to more than 150 destinations and carry 100m guests each year. We’ve also been named the world’s best low-cost carrier for 11 years running. To accomplish all of this, we rely heavily on our 22,000 Allstars (employees). As AirAsia co-founder Tony Fernandes likes to say, “it has always been about the people.”

With Cloud Identity in place, our IT department can spend less time worrying about managing multiple on-premises directory servers and and can instead focus on delivering value to our Allstar employees.
–Declan Hogan, Group CIO, AirAsia

In my role as CIO, it’s critical that I give our Allstars the tools and technology they need to get their jobs done, while at the same time ensuring that our company’s data is protected and secure. While this is challenging enough in normal circumstances, we’re also in the midst of rapidly moving from legacy on-premises technologies to the cloud. Google Cloud has been a critical partner for us in this journey.

Identity Challenges

AirAsia, like many other enterprises, has relied on a legacy on-premises directory for many years. As our company has quickly grown and expanded to new markets and regions, we’ve had to manage multiple servers across a number of on-premises data centers and the public cloud, which has proved costly and time-consuming.

Our Allstars, located all across Asia, need to easily access a number of legacy on-premises apps in addition to a growing number of SaaS apps. As a business, we also needed a more seamless integration between our HR system of record and our identity solution for user provisioning and lifecycle management.

Deploying Cloud Identity is a key step towards enabling the BeyondCorp (or zero trust) security model, which we feel is the best approach to strengthen our security posture and fight modern threats.
–Declan Hogan, Group CIO, AirAsia

Solving these challenges with our existing on-premises directory was simply not feasible for us.

In recent years, we partnered with Google Cloud to help drive our digital transformation, including moving dozens of workloads and apps to Google Cloud Platform (GCP), deploying G Suite as our collaboration and productivity solution for all of our employees, and replacing thousands of Windows laptops with fast and secure Chromebooks.

We brought up our identity concerns with the Google Cloud team, and after a number of conversations, we decided to deploy Cloud Identity, Google’s cloud-based identity and access management solution, to help address the identity challenges we were facing.

Why Cloud Identity for AirAsia?

We ended up choosing Cloud Identity for a few key reasons. Here at AirAsia, we are eager to move to the cloud as quickly as possible, and moving identity management to the cloud is a key enabler of this and our broader digital transformation. Managing identities from the cloud also enables us to have a single identity and set of credentials for each employee, which they can use to access all of the applications they need to be productive, both in the cloud and on-premises.

In addition, deploying Cloud Identity is a key step towards enabling the BeyondCorp (or zero trust) security model, which we feel is the best approach to strengthen our security posture and fight modern threats.

Cloud Identity also integrates seamlessly with our existing technologies, which includes not only Google Cloud products like GCP, G Suite, and Chrome OS, but also third party tools like Citrix, Papercut, and others.

And finally, Cloud Identity offered us significant cost and resource savings. With Cloud Identity in place, our IT department can spend less time worrying about managing multiple on-premises directory servers and and can instead focus on delivering value to our Allstar employees.

In the fall of 2022, we announced new policy constructs for Google Cloud Firewall, a scalable, cloud-first firewall service that helps secure traffic flow to and from workloads in Google Cloud, and whose distributed architecture enables simplified, granular control including micro-segmentation. Whereas legacy VPC firewall rules included network tags that were not governed by our IAM infrastructure, Cloud Firewall’s new network firewall policies with IAM-governed tags conform to our hierarchical control model and can help improve security operations. 

We recommend that customers migrate from VPC firewall rules to the newly introduced network firewall policies. To assist with the migration, we developed a migration tool that creates a global network firewall policy and converts existing VPC firewall rules into the new policy.

With Google Cloud’s network firewall policies, we offer rules defined on a per-VPC network basis, either for all regions of the network (global network firewall policies) or a single region (regional network firewall policies). Granular controls enforced at the virtual machine (VM) level using IAM-governed Tags deliver intra-subnet micro-segmentation with pervasive policy coverage that automatically applies to workloads wherever they are deployed, independent of network architecture. 

Network firewall policies allow for: 

• Batch editing of multiple rules within a single policy, which saves time, simplifies rule management, and eliminates race conditions created by single rule update patterns
• A single resource to contain all the firewall rule sets applied to a VPC network, making it easy to modify and update the firewall configurations with unified APIs on the single resource
• Granular IAM controls based on your needs and requirements, such as separate IAM permissions for firewall policy creation, update, and association 
• Sharing and attaching of firewall configurations across VPC networks in the same project, which simplifies configuration and management

With these increased capabilities, the combination of the new policy structures and the IAM-governed tags can help simplify operations, while achieving more reliable granular control and the implementation of least-privilege policies. 

Going forward, all new enhancements and features for Cloud Firewall will only be supported through firewall policies. Network firewall policies and Tags integration are part of the Cloud Firewall Essentials tier, which is offered to customers at no additional charge. We encourage customers to migrate to network firewall policies to take advantage of future Cloud Firewall product enhancements, such as the Threat Intelligence, FQDN, and geo-location filtering features introduced in the Cloud Firewall Standard tier. For more details, please see our Cloud Firewall Standard announcement blog.

Network firewall policy migration tool overview 

The new migration tool helps you convert existing VPC firewall rules into the new policy. This tool does not delete or affect existing VPC firewall rules. Once the new global network firewall policy is created, you can attach the network firewall policy to a VPC. You also have the option to swap the evaluation order of network firewall policies and VPC firewall rules. 

Existing VPC firewall rules can be removed after you confirm the newly created network firewall policy works as intended. The best way to verify this is to enable firewall logging on both the existing VPC firewall rules and the new network firewall policy. After the evaluation order has been swapped to evaluate the new global policy first, you can review the firewall logs to confirm that the new network firewall policy rules are evaluated and hit as intended, and the hit count for the equivalent VPC firewall rules are shadowed and no longer getting hits. Support for the hit count and shadowed rule analysis will also be available in the upcoming release of Firewall Insights. More details can be found in the migration tool guide. 

You can access the migration tool as a gcloud command. There are two mandatory arguments in this command: (1) the source VPC Network (SOURCE_VPC_NETWORK) and (2) the target network firewall policy (TARGET_NETWORK_FIREWALL_POLICY).

gcloud compute firewall-rules migrate --source-network=SOURCE_VPC_NETWORK –target-firewall-policy=TARGET_NETWORK_FIREWALL_POLICY [OTHER_FLAGS]

Please note, a network firewall policy with the same name cannot exist before running this command, since the migration tool will create it.

Additionally, logging will remain unchanged for any migration, meaning that if a VPC firewall rule has logging turned on, the migration tool will leave it on and if logging is turned off, the migration tool will keep it off.

For a more detailed guide, including information on how to change the rule evaluation order, and how to migrate from VPC firewall rules that contain network tags and/or service accounts, please refer to the migration guide. 

Migrate today 

We encourage you to migrate your firewall configuration from VPC firewall rules to the newly introduced network firewall policies to enhance your security posture with a fully distributed, cloud-first stateful inspection firewall service. In addition, migrating to network firewall policies ensures you will have access to the latest firewall features, such as Cloud Firewall Standard. The migration tool is here to help you with this transition. Check out the guide to learn more.

We opened our Sydney cloud region in 2017 and, since then, we have continued to invest and expand across Australia and New Zealand to support the digital future of organizations of all sizes. In Australia, Google Cloud supports almost A$3.2 billion in annual gross benefits to businesses and consumers. This includes A$686 million to businesses using Google Workspace and Google Cloud Platform, another A$698 million to Google Cloud partners, and A$1.8 billion to consumers.¹ 

For customers in Australia, New Zealand and across Asia Pacific, we’re excited to announce that our new Google Cloud region in Melbourne is now open. Designed to help businesses build highly available applications for their customers, the Melbourne region is our second Google Cloud region in Australia and 11th to open in Asia Pacific. 

We’re celebrating the occasion with a digital event where federal minister for the Digital Economy, Jane Hume, and customers Australia Post, Trade Me, Bendigo and Adelaide Bank, The Australian Football League and Macquarie Bank will share their perspectives. Come join us!

A global network of regions

Melbourne joins the existing 26 Google Cloud regions connected via our high-performance network, helping customers better serve their users and customers throughout the globe. With this our second region in Australia, customers benefit from improved business continuity planning with distributed, secure infrastructure needed to meet IT and business requirements for disaster recovery, all the while maintaining data sovereignty in-country.

With this new region, Google Cloud customers operating in Australia and New Zealand will benefit from low latency and high performance of their cloud-based workloads and data. Designed for high availability, the region opens with three zones to protect against service disruptions, and offers a portfolio of key products, including Compute Engine, Google Kubernetes Engine, Cloud Bigtable, Cloud Spanner, and BigQuery. 

We also continue to invest in expanding connectivity across the Australia and New Zealand region by working with partners to establish subsea cables and new Dedicated Cloud Interconnect locations and points of presence in major cities including Sydney, Melbourne, Perth, Canberra, Brisbane and Auckland.

Collectively, this will deliver geographically distributed and secure infrastructure to customers across Australia and New Zealand – which is especially important for those in regulated industries such as Financial Services and the Public Sector.  

What customers and partners are saying

Navigating this past year has been a challenge for companies as they grapple with changing customers demands and greater economic uncertainty. Technology has played a critical role, and we’ve been fortunate to partner with and serve people, companies, and government institutions around the world to help them adapt. The Google Cloud region in Melbourne will help our customers adapt to new requirements, new opportunities and new ways of working.  

“We moved to Google Cloud to improve the stability and resilience of our infrastructure and become more cloud-native as part of a digital transformation program that keeps the customer at the heart of our business. We welcome Google Cloud’s investment in ANZ and the opportunities the Google Cloud Melbourne region presents to improve Trade Me’s agility and performance. – Paolo Ragone, Chief Technology Officer, Trade Me     

“We initially turned to Google Cloud to help us process parcels faster and gain deeper insights into our business and its processes. The relationship has continued to deliver benefits to our customers and our organization and we welcome Google Cloud’s opening of the Melbourne region as presenting even more opportunities for businesses to innovate and generate efficiencies.” – Munro Farmer, Chief Information Officer, Australia Post.

“We are well progressed with our multi-year strategy to grow and transform our organization to be Australia’s bank of choice. Google Cloud’s advanced data capabilities and renowned culture of innovation are strongly aligned to this strategy and will allow us to become even more innovative and agile in responding to our customers’ ever-changing needs. We were quick to run our workloads out of the Melbourne cloud region and we believe Google Cloud’s expanded investment in local infrastructure will further assist us on our business transformation journey.” – Andrew Cresp, Chief Information Officer, Bendigo and Adelaide Bank.

“We have a clear vision when it comes to innovating to deliver world-class service to our customers, and our partnership with Google Cloud is core to that strategy. The company’s continued investments in local infrastructure and technology present new opportunities for us as we advance our transformation journey in this digital-first era.” – Chris Smith, Vice President, Digital Service, Optus

Our global ecosystem of channel partners has expanded by more than 400% in the last two years, and we look forward to continuing our close relationships with partners  in Australia and New Zealand as we help customers modernize, innovate, scale and grow.

“Australian companies are increasingly realising the benefits of their cloud investments and are now looking to transform their organisations at scale. We are excited about the potential and new value that the Google Melbourne Cloud region will bring to our clients as we continue to work together on delivering intelligent and innovative solutions to Australian organisations.” – Tara Brady, CEO of Accenture Australia and New Zealand

“Google Cloud has always been there for its customers for the long haul and the opening of the new Melbourne Cloud region is great news. This increased resilience and scale will empower companies of all sizes to be bold in accelerating their digital transformation plans.” – Tony Nicol,  CEO of Servian

“We’re excited about the launch of the Melbourne Cloud region. It will cater to the needs of industries we work closely with including healthcare and financial services, and will further enhance how we jointly deliver on the compliance, privacy and security requirements of companies as they advance their digital transformation.” – Simon Poulton, CEO of Kasna

“The opening of the new Google Cloud region in Melbourne is fantastic news as it now enables DXC customers access to enhanced services for their mission critical application and data solutions across two regions within Australia.  As our customers modernise their application estate, many are seeking dual region cloud services, and DXC is excited to partner with Google Cloud to deliver these services to customers in Australia and New Zealand.” – Tim Fraser, Google Practice Lead ANZ at DXC Technology

Helping customers build their transformation clouds

Google Cloud is here to support businesses, helping them get smarter with data, deploy faster, connect more easily with people and customers throughout the globe, and protect everything that matters to their businesses. The cloud region in Melbourne offers new technology and tools that can be a catalyst for this change.  Click here to learn more about all our Google Cloud locations.

^{1. AlphaBeta, The Economic Impact of Google Cloud to Australia, July 2021}