🔐 New: A CISO’s benchmark for authorization maturity ➔ [Download the ebook](https://solutions.cerbos.dev/authorization-maturity-model-a-cisos-benchmark)

# Deploy Cerbos on Google Compute Engine

Run the Cerbos PDP on Compute Engine VMs as a standalone binary or container alongside your application workloads.

[Binary installation](https://docs.cerbos.dev/cerbos/latest/installation/binary.html) [Container installation](https://docs.cerbos.dev/cerbos/latest/installation/container.html)

### Binary or container

Run Cerbos as a native binary managed by systemd or as a Docker container on your Compute Engine VMs

### Managed Instance Groups

Scale Cerbos automatically with Managed Instance Groups, each instance runs independently

### Service account

Use GCP service accounts to grant Cerbos access to policy sources stored in Google Cloud services

## What is Cerbos?

Cerbos is an open-source authorization layer that decouples access control from your application code. It runs as a stateless Policy Decision Point (PDP) that evaluates fine-grained policies at request time.

Authorization policies are written in human-readable YAML supporting [RBAC](/content/features-benefits-and-use-cases/rbac/index.html), [ABAC](/content/features-benefits-and-use-cases/abac/index.html), and [conditional rules](/content/features-benefits-and-use-cases/pbac/index.html). They can be updated, tested, and deployed independently of your application.

Deploying Cerbos via Google Cloud Compute Engine gives you a production-ready authorization service that scales horizontally and fits naturally into your existing infrastructure and observability stack.

[Policy-as-code Human-readable YAML policies managed like source code](/content/features-benefits-and-use-cases/human-readable-authorization/index.html) [Scalable PDP Stateless policy decision point with sub-millisecond latency](/content/features-benefits-and-use-cases/scalability/index.html) [Centralized management Manage, test, and deploy policies from a single control plane](/content/features-benefits-and-use-cases/centralized-management/index.html)

### How to deploy Cerbos on Compute Engine

1. **Create a VM instance**, Choose a machine type and configure firewall rules to allow traffic on the Cerbos HTTP (3592) and gRPC (3593) ports.
2. **Install Cerbos**, Download the static binary or run the official Docker container image on the VM.
3. **Configure policy loading**, Point Cerbos at a local policy directory, Git repository, or Cerbos Hub for policy storage.
4. **Connect your application**, Use a Cerbos SDK to send authorization checks from your services to the PDP.

## FAQ

### How do I deploy Cerbos on Compute Engine?

Download the Cerbos binary onto your VM and run it as a systemd service, or use Docker to run the official Cerbos container image. Configure your policy source and expose the gRPC and HTTP ports.

### Does Cerbos require any external dependencies?

No. Cerbos is a single static binary with no external dependencies. It requires no database or message queue. Policies load from the filesystem, a Git repository, or Cerbos Hub.

### How should I scale Cerbos on Compute Engine?

Run Cerbos on multiple VMs behind a Cloud Load Balancer. Cerbos is stateless, so each instance operates independently with no coordination required. Use Managed Instance Groups for automatic scaling.

## Cerbos + Google Cloud Compute Engine

- Cerbos runs alongside your workloads in Google Cloud Compute Engine
- No external databases or message queues required
- Built-in metrics, distributed tracing, and structured logging
- Stateless PDP instances scale horizontally