GCP Cloud

This guide explains what capabilities StrongDM can provide for managing access to the Google Cloud Platform (GCP) Cloud Console via a service account. It also provides setup and configuration instructions to add GCP as a resource in StrongDM and begin using StrongDM to control access for users who wish to access your GCP console via a CLI application such as gcloud. StrongDM users are authenticated with GCP and granted the level of access that you configure on the GCP side.

In addition to access control and auditing, GCP access through StrongDM can be a part of a variety of use cases and access control methodologies:

• Least Privilege: For GCP CLI/SDK (Service Account) clouds, least privilege can be accomplished by setting up multiple instances of the console as StrongDM resources. Each resource would connect to GCP using a different service account with different permissions granted to it.
• Just-in-Time Access: StrongDM users are able to use any access workflows you set up to request access to GCP, allowing you the choice between granting Just-in-Time (JIT) access with requests, or providing standing access to particular users or roles within your StrongDM organization. For more details, see the Access Workflows section.
  To avoid confusion during access requests, if there are multiple GCP cloud resources in StrongDM, it may be useful to name them in such a way that indicates the level of access, so that users know the name of the resource to request.
• Context-Based Policy: StrongDM policies that restrict or enable users’ ability to connect to GCP resources based on their context can be used to limit availability of your GCP console to users in particular geographic locations or with good device trust scores. Policies can also be used to provide an MFA challenge prior to connection, and help solve for many more use cases. For more details, see the Policies section.

Limitations #

• There is no SDK, Terraform, Ansible, or other such support for GCP.
• The GCP driver does nothing to limit privilege escalation. It is the responsibility of the resource creator not to provide credentials that can be used to create more credentials.

GCP Cloud Properties #

• GCP supports the gcloud command-line tool.

Prerequisites #

• In StrongDM, you must have the Admin permission level.
• You must have administrator access to your GCP environment and be familiar with gcloud.

Configuration #

Generate credentials #

1. In the Google cloud console, create a service account.
2. Create a service account key (JSON key file) and save it.

Admin UI setup #

If you prefer to set up your Azure resource in StrongDM using the CLI, skip this step and read CLI setup. If you want to set up GCP cloud in the StrongDM Admin UI, go to Resources > Clouds in the Admin UI and click the Add cloud button.

Set the following properties:

Click Create to save the configuration settings.

CLI setup #

If you would rather set up GCP cloud using the CLI, open your terminal. While logged in to StrongDM, use the following command:

sdm admin clouds add gcp

You can view all help text and options by appending --help or -h to the same command:

NAME:
   sdm admin clouds add gcp - create GCP CLI/SDK (Service Account) cloud

USAGE:
   sdm admin clouds add gcp [command options] <name>

OPTIONS:
   --bind-interface value    bind interface (default: "127.0.0.1")
   --egress-filter value     apply filter to select egress nodes e.g. 'field:name tag:key=value ...'
   --port-override value     port profile override (default: -1)
   --proxy-cluster-id value  proxy cluster id
   --scopes value            Space separated scopes that this login should assume into when authenticating (required)
   --secret-store-id value   secret store id
   --subdomain value         This will be used as your local DNS address. (e.g. app-prod1 would turn into app-prod1.<your-org-name>.sdm.network)
   --svc-keyfile value       The service account keyfile to authenticate with (required, secret)
   --tags value              tags e.g. 'key=value,...'
   --template, -t            display a JSON template
   --timeout value           set time limit for command

Logs #

In the Cloud logs section of the Admin UI (Logs > Cloud), you can find all of the activities of the users who accessed the GCP resource. Note that StrongDM makes an attempt to drop the Authorization header of logs for display in the Admin UI. Note that any secrets displayed in the cloud logs are placeholder values. No actual keys or secrets are ever exposed in plaintext in the Admin UI.

CLI Usage #

When the resource is created and configured, you are ready for users to connect to the resource. In order for your organization’s users to access the GCP cloud resource via StrongDM, users need to install the following:

• The StrongDM Desktop application
• The latest version of the StrongDM CLI. If the CLI is already installed, you can run sdm update in the CLI to update it. Alternatively, if any updates are available, you can open the desktop app and click the Upgrade button.
• The gcloud command-line tool

After installation, users must exit and restart the desktop app, and then select the GCP cloud resource to connect to.

Click to connect to the resource in the desktop app, or run sdm connect <RESOURCE> in the CLI. Once connected, users can use gcloud through StrongDM at their terminal, with the base syntax of sdm gcp or sdm gcloud instead of the usual gcloud.

You can use sdm gcp --help (or sdm gcloud --help) to view example usage and command options:

NAME:
   sdm gcp - gcp commands

USAGE:
   sdm gcp command [command options] [arguments...]

COMMANDS:
   cli  Execute a gcloud CLI command against a GCP resource.
   env  Print environment variables required to access a GCP resource.
   run  Execute an external command with environment variables configured to access a GCP resource.

OPTIONS:
   --name value     The name of the GCP resource to access. By default if there is only one connected GCP resource, that resource is used. [$SDM_GCP_NAME]
   --project value  The ID of the GCP project to access for project commands. By default, the project configured in the GCP resource is used. (default: "strongdm") [$SDM_GCP_PROJECT]
   --help, -h       show help

gcp cli #

The gcp cli command is followed by a gcloud CLI command that you wish to run against your connected GCP resource. For more information about gcloud CLI commands, see the Google Cloud CLI documentation.

gcp env #

The gcp env command outputs the environment variables that are required in order to access a GCP resource. This output is a similar format of the output of the standard env command, but only contains the relevant environment variables for connecting to GCP.

gcp run #

The gcp run command is followed by a command that you wish to run against the connected resource, which is sent along with the necessary environment variables. An example of a use for gcp run would be if you have a pre-existing script for managing GCP resources that uses gcloud commands. Instead of altering the script to work with StrongDM, you could use gcp run shellscript.sh and run the script.

–name #

If your organization has multiple GCP cloud resources, and you are connected to more than one at once, you may specify a --name value in commands in order to specify which you intend to execute the command on. For example, sdm gcp --name <RESOURCE_NAME> cli. The flag must come before the cli portion of the command in order to preserve the ability to use the command as normal with a single GCP cloud resource connected.

–project #

As a convenience to users, administrators can set a GCP Project ID on a resource during configuration. This enables users to skip the --project flag when running commands against a GCP CLI/SDK (Workforce Identity Federation) resource. If the Project ID field is not filled out during resource configuration, users still need to specify a project in the situations that they normally would when running GCP commands. Either the project number (95464132584) or an actual Project ID (example-favorite-project-1411) can be used, but Google recommends the Project ID for most cases as the best practice.

Error Cases #

Should you attempt to use a cloud resource without the client running, you encounter an error such as the following:

ERROR: gcloud crashed (TransportError): HTTPSConnectionPool(host='oauth2.googleapis.com', port=443): Max retries exceeded with url: /token (Caused by ProxyError('Cannot connect to proxy.', NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x10c7c9d30>: Failed to establish a new connection: [Errno 61] Connection refused')))

Should you attempt to use a cloud resource when you are not connected to it, StrongDM’s CLI commands warn you. You can get around this warning in some contexts (for example, by setting environment variables in your terminal). In these cases, you may encounter SSL errors, and nothing happens when you run commands.