Configure identity groups and third-party identities in ingress and egress rules

This page describes how to use identity groups in ingress and egress rules to allow access to resources protected by service perimeters.

VPC Service Controls uses ingress and egress rules to allow access to and from the resources and clients protected by service perimeters. To further refine access, you can specify identity groups in your ingress and egress rules.

An identity group is a convenient way to apply access controls to a collection of users and lets you manage identities that have similar access policies.

To configure identity groups in the ingress or egress rules, you can use the following supported identity groups in the identities attribute:

For information about how to apply ingress and egress rule policies, see Configuring ingress and egress policies.

Before you begin

Configure identity groups in ingress rules

Console

When you update an ingress policy of a service perimeter or set an ingress policy during perimeter creation using the Google Cloud console, you can configure the ingress rule to use identity groups.

  1. When you create a perimeter or edit a perimeter in the Google Cloud console, select Ingress policy.

  2. In the From section of your ingress policy, select Select identities & groups from the Identities list.

  3. Click Add identities.

  4. In the Add identities pane, specify a Google group or a third-party identity to which you want to provide access to resources in the perimeter. To specify an identity group, use the format specified in Supported identity groups.

  5. Click Add identities.

  6. Click Save.

For information about the other ingress rule attributes, see Ingress rules reference.

gcloud

You can configure an ingress rule to use identity groups using a JSON file or a YAML file. The following sample uses the YAML format:

- ingressFrom:
    identities:
    - PRINCIPAL_IDENTIFIER
    sources:
    - resource: RESOURCE
      *OR*
    - accessLevel: ACCESS_LEVEL
  ingressTo:
    operations:
    - serviceName: SERVICE_NAME
      methodSelectors:
      - method: METHOD_NAME
    resources:
    - projects/PROJECT_NUMBER

Replace the following:

  • PRINCIPAL_IDENTIFIER: specify a Google group or a third-party identity to which you want to provide access to resources in the perimeter. To specify an identity group, use the format specified in Supported identity groups.

For information about the other ingress rule attributes, see Ingress rules reference.

After you update an existing ingress rule to configure identity groups, you need to update the rule policies of the service perimeter:

gcloud access-context-manager perimeters update PERIMETER_ID --set-ingress-policies=RULE_POLICY.yaml

Replace the following:

  • PERIMETER_ID: the ID of the service perimeter that you want to update.
  • RULE_POLICY: the path of the modified ingress rule file.

For more information, see Updating ingress and egress policies for a service perimeter.

Configure identity groups in egress rules

Console

When you update an egress policy of a service perimeter or set an egress policy during perimeter creation using the Google Cloud console, you can configure the egress rule to use identity groups.

  1. When you create a perimeter or edit a perimeter in the Google Cloud console, select Egress policy.

  2. In the From section of your egress policy, select Select identities & groups from the Identities list.

  3. Click Add identities.

  4. In the Add identities pane, specify a Google group or a third-party identity that can access the specified resources outside the perimeter. To specify an identity group, use the format specified in Supported identity groups.

  5. Click Add identities.

  6. Click Save.

For information about the other egress rule attributes, see Egress rules reference.

gcloud

You can configure an egress rule to use identity groups using a JSON file or a YAML file. The following sample uses the YAML format:

- egressTo:
    operations:
    - serviceName: SERVICE_NAME
      methodSelectors:
      - method: METHOD_NAME
    resources:
    - projects/PROJECT_NUMBER
  egressFrom:
    identities:
    - PRINCIPAL_IDENTIFIER

Replace the following:

  • PRINCIPAL_IDENTIFIER: specify a Google group or a third-party identity that can access the specified resources outside the perimeter. To specify an identity group, use the format specified in Supported identity groups.

For information about the other egress rule attributes, see Egress rules reference.

After you update an existing egress rule to configure identity groups, you need to update the rule policies of the service perimeter:

gcloud access-context-manager perimeters update PERIMETER_ID --set-egress-policies=RULE_POLICY.yaml

Replace the following:

  • PERIMETER_ID: the ID of the service perimeter that you want to update.
  • RULE_POLICY: the path of the modified egress rule file.

For more information, see Updating ingress and egress policies for a service perimeter.

Supported identity groups

VPC Service Controls supports the following identity groups from the IAM v1 API Principal identifiers:

Principal type Identifier
Group group:GROUP_EMAIL_ADDRESS
Single identity in a workforce identity pool principal://iam.googleapis.com/locations/global/workforcePools/POOL_ID/subject/SUBJECT_ATTRIBUTE_VALUE
All workforce identities in a group principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/group/GROUP_ID
All workforce identities with a specific attribute value principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/attribute.ATTRIBUTE_NAME/ATTRIBUTE_VALUE
All identities in a workforce identity pool principalSet://iam.googleapis.com/locations/global/workforcePools/POOL_ID/*
Single identity in a workload identity pool principal://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/subject/SUBJECT_ATTRIBUTE_VALUE
Workload identity pool group principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/group/GROUP_ID
All identities in a workload identity pool with a certain attribute principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/attribute.ATTRIBUTE_NAME/ATTRIBUTE_VALUE
All identities in a workload identity pool principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/*

For more information about these identities, see Principal identifiers for allow policies.

Limitations

  • Before using identity groups, understand the unsupported features in ingress and egress rules.
  • When you use identity groups in an egress rule, you can't set the resources field in the egressTo attribute to "*".
  • For information about ingress and egress rule limits, see Quotas and limits.

What's next