Securing virtual machines with IAP

Console

To allow RDP and SSH access to all VM instances in your network, do the following:

1. Open the Firewall Rules page.

   Open the Firewall Rules page

   The remaining steps appear in the Google Cloud console.

2. Select a Google Cloud project. Show me.
3. On the Firewall Rules page, click Create firewall rule.
4. Configure the following settings:
   • Name: allow-ingress-from-iap
   • Direction of traffic: Ingress
   • Target: All instances in the network
   • Source filter: IP ranges
   • Source IP ranges: 35.235.240.0/20
   • Protocols and ports: Select TCP and enter 22,3389 to allow both RDP and SSH.
5. Click Create.

gcloud

To allow RDP access to all VM instances in your network, run:

gcloud compute firewall-rules create allow-rdp-ingress-from-iap \
  --direction=INGRESS \
  --action=allow \
  --rules=tcp:3389 \
  --source-ranges=35.235.240.0/20

For SSH access, run:

gcloud compute firewall-rules create allow-ssh-ingress-from-iap \
  --direction=INGRESS \
  --action=allow \
  --rules=tcp:22 \
  --source-ranges=35.235.240.0/20

For other protocols, run

gcloud compute firewall-rules create allow-ingress-from-iap \
  --direction=INGRESS \
  --action=allow \
  --rules=tcp:PORT \
  --source-ranges=35.235.240.0/20

where PORT is the port used by the protocol.

Console

1. Open the IAM & Admin page in the Google Cloud console.

   Open the IAM & Admin page

   The remaining steps appear in the Google Cloud console.

2. On the IAM & Admin page, click Add and configure the following:
   • New principals: Specify the user or group you want to grant access.
   • Select a role: Select Cloud IAP > IAP-Secured Tunnel User.
3. Optionally, click Add condition and configure a condition:
   • Title: Enter a name for the condition.
   • Expression: Enter a condition that a user must meet to gain the permissions in the IAP-Secured Tunnel User role.

   For example, the following CEL expression grants access only to port 22:

   destination.port == 22

   You can also grant access based on the access level:

   destination.port == 22 &&
   "FULL_ACCESS_LEVEL_NAME" in request.auth.access_levels

   Where FULL_ACCESS_LEVEL_NAME is an existing access level and uses the following format:

   accessPolicies/POLICY_NAME/accessLevels/ACCESS_LEVEL_NAME

4. Click Add another role and configure the following:
   • Select a role Select Compute Engine > Compute Instance Admin (v1).
5. Click Save.

gcloud

Grant the two roles to the user by running the following commands:

gcloud projects add-iam-policy-binding PROJECT_ID \
    --member=user:EMAIL \
    --role=roles/iap.tunnelResourceAccessor
gcloud projects add-iam-policy-binding PROJECT_ID \
    --member=user:EMAIL \
    --role=roles/compute.instanceAdmin.v1

Replace the following:

• PROJECT_ID: ID of the project
• EMAIL: email address of the user you want to grant access, for example user@example.com.

Console

1. Open the IAP admin page and select the SSH and TCP Resources tab.

   Open the Chrome Enterprise Premium admin page

   The remaining steps appear in the Google Cloud console.

2. On the SSH and TCP Resources tab of the IAP admin page, select the VM instances that you want to configure.
3. Click Show info panel if the info panel is not visible.

4. Click Add principal and configure the following:

   • New principals: Specify the user or group you want to grant access.
   • Select a role: Select Cloud IAP > IAP-Secured Tunnel User.

5. Optionally, click Add condition and configure a condition:

   • Title: Enter a name for the condition.
   • Expression: Enter a condition that a user must meet to gain the permissions in the IAP-Secured Tunnel User role.

   For example, the following CEL expression grants access only to port 22:

         destination.port == 22

   You can also grant access based on the access level:

       destination.port == 22 &&
       "FULL_ACCESS_LEVEL_NAME" in request.auth.access_levels

   Where FULL_ACCESS_LEVEL_NAME is an existing access level and uses the format accessPolicies/POLICY_NAME/accessLevels/ACCESS_LEVEL_NAME.

6. Click Save.

API

To edit your application's policy.json file, follow the process below. See Managing access to Chrome Enterprise Premium-secured resources for more information about using the IAM API to manage access policies.

1. Export the following variables.

   export IAP_BASE_URL=https://iap.googleapis.com/v1/projects/PROJECT_NUMBER/iap_tunnel
   # Replace POLICY_FILE.JSON with the name of JSON file to use for setIamPolicy
   export JSON_NEW_POLICY=POLICY_FILE.JSON
   

2. Get the IAM policy for the Compute Engine instance using the getIamPolicy method. The empty data bit at the end turns the curl request into POST instead of GET.

   curl -i -H "Authorization: Bearer $(gcloud auth print-access-token)" \
        ${IAP_BASE_URL}/zones/ZONE_NAME/instances/INSTANCE_ID or INSTANCE_NAME:getIamPolicy \
        -d ''

3. Grant the iap.tunnelResourceAccessor role to your principals by modifying the IAM policy JSON file.
   

4. Optionally, grant the role only to principals that meet specific criteria, based on IAM Conditions and access levels.

   The following is an example of an edited policy.json file that grants the iap.tunnelResourceAccessor role to a group of VM instance admins, giving them access to Chrome Enterprise Premium-secured tunnel resources. An IAM condition has been added to make the resources accessible only to principals in the VM instance admins group with a private IP address of 10.0.0.1 on port 22 using the destination.ip and destination.port IAM Conditions. They must also meet the requirements of the ACCESS_LEVEL_NAME access level.

   Note that if a principal has the Owner role, they have permission to use IAP for TCP forwarding.

   
   Example policy.json file

   {
     "policy": {
       "bindings": [
         {
           "role": "roles/iap.tunnelResourceAccessor",
           "members": ["group:instance-admins@example.com"],
           "condition": {
             "expression": "\"accessPolicies/POLICY_NAME/accessLevels/ACCESS_LEVEL_NAME\" in request.auth.access_levels && destination.ip == \"10.0.0.1\" && destination.port == 22",
             "title": "CONDITION_NAME"
           }
         }
       ]
     }
   }

   To find a policy name , call accessPolicies.list:

   GET https://accesscontextmanager.googleapis.com/v1/accessPolicies
   

5. Set your new policy.json file using the setIamPolicy method.

   curl -i -H "Content-Type:application/json" \
             -H "Authorization: Bearer $(gcloud auth print-access-token)" \
             ${IAP_BASE_URL}/zones/ZONE_NAME/instances/INSTANCE_ID or INSTANCE_NAME:setIamPolicy \
             -d @${JSON_NEW_POLICY}

Console

To connect to your instance, use the SSH button in the Google Cloud console. Your instance's access configuration (defined through IAM permissions) must allow TCP tunneling through IAP.

gcloud

To connect to your instance, use the gcloud compute ssh command. Your instance's access configuration (defined through IAM permissions) must allow TCP tunneling through IAP.

gcloud compute ssh INSTANCE_NAME

Replace INSTANCE_NAME with the name of the instance to SSH into.

If the instance doesn't have an external IP address, the connection automatically uses IAP TCP tunneling. If the instance does have an external IP address, the connection uses the external IP address instead of IAP TCP tunneling.

You can use the --tunnel-through-iap flag so that gcloud compute ssh always uses IAP TCP tunneling.

Use the --internal-ip flag so that gcloud compute ssh never uses IAP TCP tunneling and instead directly connects to the internal IP of the VM. Doing so is useful for clients that are connected to the same VPC network as the target VM.

IAP Desktop

You can use IAP Desktop to connect to a VM instance by using SSH and IAP TCP forwarding.

1. In the application, select File > Add Google Cloud project.

2. Enter the ID or name of your project and click OK.

3. In the Project Explorer window, right-click the VM instance you want to connect to and select Connect.

For more information on IAP Desktop, see the GitHub project page.

PuTTY app

You can set up the PuTTY Windows terminal emulator app so that it uses IAP TCP forwarding to connect to a VM instance. Your instance's access configuration (defined through IAM permissions) must allow TCP tunneling through IAP.

Before you configure the PuTTY app, use the gcloud compute ssh command once to ensure that you have a private SSH key on your local computer and that your public SSH key is published to Compute Engine:

1. Open a command prompt and run the following command to connect to the VM instance:

   gcloud compute ssh INSTANCE_NAME `
     --tunnel-through-iap `
     --project PROJECT_ID `
     --zone ZONE

   Replace the following:

   • INSTANCE_NAME: name of the instance to connect to
   • PROJECT_ID: project ID of the project the VM instance is located in
   • ZONE: zone where the VM instance is located

   If necessary, confirm that you want to generate SSH keys by pressing Y.

2. On the VM, determine your username by running the following command:

   whoami

   You need this username later.

You can now configure the PuTTY app to use IAP TCP forwarding:

1. Open the PuTTY app and select the category Connection > Proxy.

2. Configure the following proxy settings:

   • For Proxy type, select Local.

   • In the Telnet command, or local proxy command field, enter the following:

     gcloud.cmd compute start-iap-tunnel %host %port --listen-on-stdin --project PROJECT_ID --zone ZONE

     Replace the following:

     • PROJECT_ID: Project ID of the project the VM instance is located in
     • ZONE: Zone where the VM instance is located

   • For Print proxy diagnostics in the terminal window, select Only until session starts.

3. Select the category Connection > SSH > Auth.

4. Click Browse and paste the following file name, then click Open:

   %USERPROFILE%\.ssh\google_compute_engine.ppk

5. Select the category Session.

6. Configure the following proxy settings:

   • In the Host name (or IP address) field, enter the following:

     USERNAME@INSTANCE_NAME

     Replace the following:

     • USERNAME: the Linux username you determined earlier
     • INSTANCE_NAME: the name of the VM instance that you want to connect to

   • Saved sessions: Enter a name for the session.

7. Click Save.

8. Click Open to start the SSH session.

ssh

You can directly use the ssh command with a ProxyCommand option that uses gcloud to start the tunnel. Use this to generate the full ssh command:

gcloud compute ssh INSTANCE_NAME --dry-run

IAP Desktop

You can use IAP Desktop to connect to the Remote Desktop of one or more VM instances by using IAP TCP forwarding.

1. In the application, select File > Add Google Cloud project.

2. Enter the ID or name of your project and click OK.

3. In the Project Explorer window, right-click the VM instance you want to connect to and select Connect.

For more information on IAP Desktop, see the GitHub project page.

gcloud

To connect to the Remote Desktop of a VM instance, you first create a tunnel.

1. Use the gcloud compute start-iap-tunnel command to create an encrypted tunnel to the RDP port of the VM instance.

   gcloud compute start-iap-tunnel INSTANCE_NAME 3389 \
       --local-host-port=localhost:LOCAL_PORT \
       --zone=ZONE

   Replace INSTANCE_NAME with the name of the VM instance you want to connect to. Replace LOCAL_PORT with the localhost port where you want the proxy to be bound or use 0 to have an unused one selected automatically. Replace ZONE with the zone where the VM instance is located.

2. gcloud performs a connectivity test with the VM instance, then opens a tunnel and shows a port number.

   Listening on port [LOCAL_PORT].

   All traffic sent to localhost:LOCAL_PORT is forwarded to the VM instance. The port is only accessible by applications running on your local computer.

3. Leave gcloud running and open the Microsoft Windows Remote Desktop Connection app.

4. Enter the tunnel endpoint as computer name:

   localhost:LOCAL_PORT

   Replace LOCAL_PORT with the port number shown when the tunnel was opened by gcloud.

5. Click Connect.

gcloud

Create an encrypted tunnel to a port of the VM instance:

gcloud compute start-iap-tunnel INSTANCE_NAME INSTANCE_PORT \
    --local-host-port=localhost:LOCAL_PORT \
    --zone=ZONE

Replace INSTANCE_NAME and INSTANCE_PORT with the name and port of the VM instance you want to connect to. Replace LOCAL_PORT with the localhost port where you want the proxy to be bound. Replace ZONE with the zone where the VM instance is located.

gcloud performs a connectivity test with the VM instance, then opens a tunnel and shows a port number.

Listening on port [LOCAL_PORT].

All traffic sent to localhost:LOCAL_PORT is forwarded to the VM instance. The port is only accessible by applications running on your local computer.

Linux

To install NumPy using pip in Unix platforms, run the following command in a new terminal instance:

$(gcloud info --format="value(basic.python_location)") -m pip install numpy

If the error message persists after installing NumPy, complete the following step: Run the following command to allow gcloud to access external packages:

export CLOUDSDK_PYTHON_SITEPACKAGES=1

Windows

To install NumPy using pip in Windows platforms, run the following command in a new PowerShell instance:

start (gcloud info --format="value(basic.python_location)") "-m pip install numpy"

If the message still persists after installing NumPy, another step is necessary. Run the following command to allow gcloud to access external packages:

$env:CLOUDSDK_PYTHON_SITEPACKAGES="1"