Allow Vulnerability Assessment for Google Cloud to access VPC Service Controls perimeters

This document describes how to add ingress and egress rules to allow Vulnerability Assessment for Google Cloud to scan VMs in your VPC Service Controls perimeters. Perform this task if your organization uses VPC Service Controls to restrict services in projects that you want Vulnerability Assessment for Google Cloud to scan. For more information about Vulnerability Assessment for Google Cloud, see Enable and use Vulnerability Assessment for Google Cloud for Google Cloud.

Before you begin

Make sure that you have the following role or roles on the organization: Access Context Manager Editor (roles/accesscontextmanager.policyEditor).

Check for the roles

  1. In the Google Cloud console, go to the IAM page.

    Go to IAM
  2. Select the organization.
  3. In the Principal column, find all rows that identify you or a group that you're included in. To learn which groups you're included in, contact your administrator.

  4. For all rows that specify or include you, check the Role column to see whether the list of roles includes the required roles.

Grant the roles

  1. In the Google Cloud console, go to the IAM page.

    Go to IAM
  2. Select the organization.
  3. Click Grant access.
  4. In the New principals field, enter your user identifier. This is typically the email address for a Google Account.

  5. In the Select a role list, select a role.
  6. To grant additional roles, click Add another role and add each additional role.
  7. Click Save.

Create the egress and ingress rules

To allow Vulnerability Assessment for Google Cloud to scan the VMs in VPC Service Controls perimeters, add the required egress and ingress rules in those perimeters. Perform these steps for each perimeter that you want Vulnerability Assessment for Google Cloud to scan.

For more information, see Updating ingress and egress policies for a service perimeter in the VPC Service Controls documentation.

Console

  1. In the Google Cloud console go to the VPC Service Controls page.

    Go to VPC Service Controls

  2. Select your organization or project.
  3. If you selected an organization, click Select an access policy and then select the access policy associated with the perimeter that you want to update.
  4. Click the name of the perimeter that you want to update.

    To find the service perimeter you need to modify, you can check your logs for entries that show RESOURCES_NOT_IN_SAME_SERVICE_PERIMETER violations. In those entries, check the servicePerimeterName field:

    accessPolicies/ACCESS_POLICY_ID/servicePerimeters/SERVICE_PERIMETER_NAME
  5. Click Edit perimeter.
  6. Click Egress policy.
  7. Click Add an egress rule.
  8. In the FROM section, set the following details:

    1. For Identity, select Select identities & groups.
    2. Click Add identities
    3. Enter the email address of the Security Center service agent. The service agent's address has the following format:

      service-org-ORGANIZATION_ID@security-center-api.iam.gserviceaccount.com

      Replace ORGANIZATION_ID with your organization ID.

    4. Select the service agent or press ENTER, and then click Add identities.
  9. In the TO section, set the following details:

    1. For Project, select All projects.
    2. For Operations or IAM roles, select Select operations.
    3. Click Add operations, and then add the following operations:

      • Add the compute.googleapis.com service.
        1. Click Select methods.
        2. Select the DisksService.Insert method.

        3. Click Add selected methods.
  10. Click Ingress policy.
  11. Click Add an ingress rule.
  12. In the FROM section, set the following details:

    1. For Identity, select Select identities & groups.
    2. Click Add identities
    3. Enter the email address of the Security Center service agent. The service agent's address has the following format:

      service-org-ORGANIZATION_ID@security-center-api.iam.gserviceaccount.com

      Replace ORGANIZATION_ID with your organization ID.

    4. Select the service agent or press ENTER, and then click Add identities.
    5. For Sources, select All sources
  13. In the TO section, set the following details:

    1. For Project, select All projects.
    2. For Operations or IAM roles, select Select operations.
    3. Click Add operations, and then add the following operations:

      • Add the compute.googleapis.com service.
        1. Click Select methods.
        2. Select the following methods:

          • DisksService.Insert
          • InstancesService.AggregatedList
          • InstancesService.List
        3. Click Add selected methods.
  14. Click Save.

gcloud

  1. If a quota project isn't already set, then set it. Choose a project that has the Access Context Manager API enabled.

    gcloud config set billing/quota_project QUOTA_PROJECT_ID

    Replace QUOTA_PROJECT_ID with the ID of the project that you want to use for billing and quota.

  2. Create a file named egress-rule.yaml with the following contents:

    - egressFrom:
        identities:
        - serviceAccount:service-org-ORGANIZATION_ID@security-center-api.iam.gserviceaccount.com
      egressTo:
        operations:
        - serviceName: compute.googleapis.com
          methodSelectors:
          - method: DisksService.Insert
        resources:
        - '*'

    Replace ORGANIZATION_ID with your organization ID.

  3. Create a file named ingress-rule.yaml with the following contents:

    - ingressFrom:
        identities:
        - serviceAccount:service-org-ORGANIZATION_ID@security-center-api.iam.gserviceaccount.com
        sources:
        - accessLevel: '*'
      ingressTo:
        operations:
        - serviceName: compute.googleapis.com
          methodSelectors:
          - method: DisksService.Insert
          - method: InstancesService.AggregatedList
          - method: InstancesService.List
        resources:
        - '*'

    Replace ORGANIZATION_ID with your organization ID.

  4. Add the egress rule to the perimeter:

    gcloud access-context-manager perimeters update PERIMETER_NAME \
        --set-egress-policies=egress-rule.yaml

    Replace the following:

    • PERIMETER_NAME: the name of the perimeter. For example, accessPolicies/1234567890/servicePerimeters/example_perimeter.

      To find the service perimeter you need to modify, you can check your logs for entries that show RESOURCES_NOT_IN_SAME_SERVICE_PERIMETER violations. In those entries, check the servicePerimeterName field:

      accessPolicies/ACCESS_POLICY_ID/servicePerimeters/SERVICE_PERIMETER_NAME
  5. Add the ingress rule to the perimeter:

    gcloud access-context-manager perimeters update PERIMETER_NAME \
        --set-ingress-policies=ingress-rule.yaml

    Replace the following:

    • PERIMETER_NAME: the name of the perimeter. For example, accessPolicies/1234567890/servicePerimeters/example_perimeter.

      To find the service perimeter you need to modify, you can check your logs for entries that show RESOURCES_NOT_IN_SAME_SERVICE_PERIMETER violations. In those entries, check the servicePerimeterName field:

      accessPolicies/ACCESS_POLICY_ID/servicePerimeters/SERVICE_PERIMETER_NAME

See Ingress and egress rules for more information.