Can you restrict Google Cloud web console logins to an ip address range?

Question

I'm meeting some resistance with using Google Cloud Platform and specifically Big Query from IT security where I work. The argument is that anyone could potentially sign in from anywhere. Is there any way to only allow GCP access from a specific ip range? Or is there possibly another way that I could reassure IT security?

It seems like this is pretty easy to implement in Azure but when I search online I get very little about restricting access in Google Cloud.

Thanks

Answer 1

You can have BigQuery behind the VPC:

• https://cloud.google.com/vpc-service-controls
• https://cloud.google.com/vpc-service-controls/docs/overview

Access from the internet to managed resources within a service perimeter is denied by default. Optionally, you can enable access based on the context of the request. To do so, you can create access levels that control access based on a number of attributes, such as the source IP address. Requests made from the internet are denied if they do not meet the criteria defined in the access level.

Answer 2

Now it's possible to limit whole Google Cloud Console and gcloud SDK access by IP range by using BeyondCorp Enterprise (formerly named context-aware access).

The required steps as following:

1. Create an access level in Access Context Manager, which is your allowed IP range.
2. Create a group of users to be bound by BeyondCorp Enterprise restrictions, e.g. the users whom you want to limit access.
3. Obtain the required Identity and Access Management permissions under GCP Organization, the BeyondCorp Enterprise is under GCP Organization level.
4. Create an access binding that enforces context-aware rules for the Cloud Console and the Google Cloud APIs, which link your access level created in step 1 and the group of users you created in step 2.

More detailed info can refer to the BeyondCorp Enterprise documentation

For example, if you created an access level with an IP range, and bounded to all users.

Once any of the users access the Google Cloud Console or gcloud SDK outside the IP range, they'll only see the You don't have access error message shown on Google Cloud Console, access_denied on gcloud SDK.