Ensure Private Service Connect is Used for Access to Google APIs

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

From Google Cloud CLI 1: Identify in-scope VPCs Determine which VPCs host production or sensitive workloads that access Google APIs (Cloud Storage, BigQuery, etc.). These VPCs should use Private Service Connect endpoints instead of public internet routes. List all VPCs in the project: gcloud compute networks list \ --format="table(name)" 2: For each in-scope VPC, check for Private Service Connect endpoint for Google APIs gcloud compute addresses list \ --filter="purpose=PRIVATE_SERVICE_CONNECT" \ --format="table(name,address,purpose,network)" For compliant configuration: - Atleast one PSC endpoint should exist per VPC that needs Google API access - The network field should match the VPC identified in Step 1 - The purpose should be PRIVATE_SERVICE_CONNECT If no PSC endpoints are returned for a VPC that uses Google APIs, workloads are accessing APIs over public internet. 3: Verify PSC endpoint points to Google APIs service attachment by listing global forwarding rules gcloud compute forwarding-rules list \ --global \ --format="table(name,IPAddress,network,target)" For compliant configuration, look for forwarding rules where: - The target references Google's service attachment (con...

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

From Google Cloud CLI 1. Create Private Service Connect endpoint for Google APIs Reserve an internal IP address for the PSC endpoint: gcloud compute addresses create psc-apis-endpoint \ --global \ --purpose=PRIVATE_SERVICE_CONNECT \ --addresses=192.168.1.5 \ --network=projects/PROJECT_ID/global/networks/VPC_NAME - Choose an IP address from RFC 1918 private range that doesn't conflict with existing subnet ranges in your VPC. Use gcloud compute networks subnets list --network=VPC_NAME to check existing subnet ranges. 2. Create the PSC endpoint forwarding rule targeting Google's all-apis service attachment: gcloud compute forwarding-rules create pscapis \ --global \ --network=VPC_NAME \ --address=psc-apis-endpoint \ --target-google-apis-bundle=all-apis 3. Configure DNS to resolve googleapis.com to PSC endpoint Create a private DNS zone for googleapis.com: gcloud dns managed-zones create googleapis-private-zone \ --description="Private zone for googleapis.com" \ --dns-name=googleapis.com. \ --networks=VPC_NAME \ --visibility=private Add wildcard A record pointing to the PSC endpoint IP: gcloud dns record-sets create '*.googleapis.com.' \ --zone=googleapis-private-zone \ --type=A \ -...