Enhance security with VPC Service Controls (original) (raw)

Google Cloud Search supports VPC Service Controls to enhance the security of your data. VPC Service Controls allows you to define a service perimeter around Google Cloud Platform resources to constrain data and help mitigate data exfiltration risks.

Prerequisites

Before you begin,install the gcloud command-line interface.

To enable VPC Service Controls:

Obtain the project IDs and project numbers for the Google Cloud Platform project you want to use. To obtain the project IDs and numbers, refer toIdentifying projects.
Use gcloud to create an access policy for your Google Cloud Platform organization:
Create a service perimeter with Cloud Search as a restricted service by running the following gcloud command:

gcloud access-context-manager perimeters create NAME \  
    --title=TITLE \  
    --resources=PROJECTS \  
    --restricted-services=RESTRICTED-SERVICES \  
    --policy=POLICY_NAME

Where:

NAME is the name of the perimeter.
TITLE is the human-readable title of the perimeter.
PROJECTS is a comma-separated list of one or more project numbers, each preceded by the string projects/. Use the project numbers obtained in step 1. For example, if you had two projects, project 12345 and 67890, your setting would be --resource=projects/12345, project/67890 .This flag only supports project numbers; it doesn’t support names or IDs.
RESTRICTED-SERVICES is a comma-separated list of one or more services. Use cloudsearch.googleapis.com.
POLICY_NAME is the numeric name of your organization's access policy obtained in step 2c.
For further information on how to create a service perimeter, refer toCreating a service perimeter.

(optional) If you want to apply IP or region-based restrictions, create access levels and add them to the service perimeter created in step 3:
1. To create an access level, refer toCreating an basic access level. For an example on how to create an access level condition that only allows access from a specific range of IP addresses, such as those within a corporate network, refer toLimit access on a corporate network.
2. After you have created an access level, add it to the service perimeter. For instructions on adding an access level to a service perimeter, refer toAdding an access level to an existing perimeter. This change can take up to 30 minutes for this change to propagate and take effect.
Use the Cloud Search Customer Service REST API to update the customer settings with your VPC Service Controls perimeter-protected project:
Obtain an OAuth 2.0 access token from the Google Authorization Server. For information on obtaining the token, refer to step 2 ofUsing OAuth 2.0 to Access Google APIs. When obtaining the access token, use one of the following OAuth scopes:https://www.googleapis.com/auth/cloud_search.settings.indexing,https://www.googleapis.com/auth/cloud_search.settings, or https://www.googleapis.com/auth/cloud_search
Run the following curl command to set the project in VPC Service Controls settings under Customer settings in Google Cloud Search:

curl --request PATCH \  
  'https://cloudsearch.googleapis.com/v1/settings/customer' \  
  --header 'Authorization: Bearer [YOUR_ACCESS_TOKEN]' \  
  --header 'Accept: application/json' \  
  --header 'Content-Type: application/json' \  
  --data '{ "vpc_settings": { "project": "projects/PROJECT_ID" } }' \  
  --compressed

Where:

YOUR_ACCESS_TOKEN is OAuth 2.0 access token obtained in step 5a.
PROJECT_ID is the project ID obtained in step 1.
If successful, you should receive a 200 OK response accompanied by the updated customer settings.

After the above steps are completed successfully, the VPC Service Controls restrictions, as defined in the service perimeter, are applied to all Google Cloud Search APIs, searches at cloudsearch.google.com, and viewing and changing configuration or reports using the Admin console. Further requests to the Google Cloud Search API that don’t follow access levels receive aPERMISSION_DENIED “Request is prohibited by organization’s policy” error.