Requirements and Prerequisites for GCP Connector

For all capabilities: Create a dedicated service account in GCP, or identify an existing GCP service account for this connector. The connector configuration wizard generates a IAM policy list that you can use to assign required privileges to this service account. Make sure you have permissions in GCP to upload this IAM policy list.

The recommended method for applying the permission in the IAM policy list to the service account is through the CLI.

Each VPC can belong to only one GCP connector. An Secure Workload cluster can have multiple GCP connectors. Gather the information described in the tables in Create a GCP Connector, below.

This connector does not require a virtual appliance.

• For gathering labels and inventory: No additional prerequisites are required.

• For ingesting flow logs: VPC level flow log definitions are required in order to trigger the collection of flow logs.

  To use the flow log ingestion, user is required to enable flow logs on the desired VPCs and setup a log router sink.

  Inclusion filter for the log router sink:

  1. resource.type="gce-subnetwork"

  2. log_name="projects/<project_id>/logs/compute.googleapis.com%2Fvpc_flows"

  Choose the sink destination as a cloud storage bucket and then choose the desired storage bucket.

  While configuring the GCP connector with ingress flow logs, it is mandatory to enter the storage bucket name.

  Only flow logs from VPC can be ingested.

  Flow logs must be published to Google storage bucket; Secure Workload cannot collect flow data from Google Cloud Operations Suite.

  Secure Workload can ingest flow logs from an Google Storage bucket associated with any account, if the GCP user account provided during connector creation have access to both the VPC flow logs and the Google storage bucket.

  The following flow log attributes (in any order) are required in the flow log: Source Address, Destination Address, Source Port, Destination Port, Protocol, Packets, Bytes, Start Time, End Time, Action, TCP Flags, Interface-ID, Log status and Flow Direction. Any other attributes are ignored.

  Flow logs must capture both Allowed and Denied traffic.

• For segmentation: Enabling segmentation requires Gather Labels to be enabled.

  Back up your existing security groups before enabling segmentation in the connector, as all existing rules will be overwritten when you enable segmentation policy enforcement for a VPC.

  See also Best Practices When Enforcing Segmentation Policy for GCP Inventory, below.

• For managed Kubernetes services (GKE): If you enable the Kubernetes option, see requirements and prerequisites in the Managed Kubernetes Services Running on GCP (GKE) section below, including required access privileges.