Score:1

Server

Limit access to GCP

남유송

11/4/22, 11:19 AM

Our company recently start using GCP. Mainly, we use bigquery to store data. We provide access to GCP based on user account(gmail). Now, we want more secure access to all GCP services because the staff can connect to bigquery everywhere as long as they have account created by our company. We want to limit access to GCP services if they are not in head offices or branch offices physically. We want to secure data stored in Big Query not with user account information but in a more secure way.

Below are the solutions that I came up with.

allow access to company's project in GCP only thru company's VPN(= allow certain ip addresses(vpn ip addresses) only using VPC Service Controls?)
allow company's ip addresses only which are dynamic ip addresses(but can expectable)

Since I am very new to GCP. I am not sure these suggestions realistically work. Or, wonder what other most cost-effective options to acheive this. If possible, I also want to know if there is way to download credential file per user and access to GCP only if using user account and downloaded credential file(This credential file will be downloded in company's devices only)

160

2 + 3

vpn

google-cloud-platform

Serhii Rohoza

11/4/22, 3:31 PM

Does [this](https://stackoverflow.com/a/62704832/12428794) answer your question?

남유송

11/6/22, 1:34 PM

@Serhii Rohoza it helped me a lot. Thank you so much! i will try to study more about it.

Serhii Rohoza

11/6/22, 5:43 PM

*@user770239* Thank you! I posted that solution as a community wiki answer here, please upvote/accept it if it was useful for you.

Score:0

Server

Serhii Rohoza

11/6/22, 5:40 PM

I posted an answer provided by @Felipe Hoffa at Stackoverflow to make it more visible. Feel free to change or enhance it.

You can have BigQuery behind the VPC:

Access from the internet to managed resources within a service perimeter is denied by default. Optionally, you can enable access based on the context of the request. To do so, you can create access levels that control access based on a number of attributes, such as the source IP address. Requests made from the internet are denied if they do not meet the criteria defined in the access level.

0 + 0

Score:0

Server

rriovall

11/4/22, 7:57 PM

As you are getting onboard into GCP I would recommend to check on this article about Google Cloud Service Account.
Aswell here you have the predefined roles and permissions for BigQuery.
Lastly to avoid any suprises I would recomend to deep into controlling BigQuery cost

0 + 1

남유송

11/6/22, 1:37 PM

Thank you so much! This is the feature I was looking for. I might not know how to use it, but i will study the links you provided me. I really appreciate it. I will be back with more questions again since I might struggle with settings of these cloud service accounts.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Limit access to GCP

TH: จำกัดการเข้าถึง GCP

RO: Limitați accesul la GCP

RU: Ограничить доступ к GCP

VI: Giới hạn quyền truy cập vào GCP

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.