Skip to content

Terraform Google VPC Service Controls Module#

This module provides a flexible and reusable solution for configuring VPC Service Controls in Google Cloud Platform. It simplifies the creation of service perimeters and access levels, allowing you to protect your projects and services from data exfiltration. The module is built on top of the official terraform-google-modules/vpc-service-controls/google module, providing a streamlined interface for common and advanced use cases.

Compatibility#

This module is compatible with Terraform version ~> 1.0 and has been tested with the following provider versions:

  • Google Provider: >= 6.28.0, < 7.0.0
  • Google Beta Provider: >= 6.28.0, < 7.0.0

Features#

  • Dynamic Service Perimeters: Easily create and manage service perimeters to protect your sensitive GCP projects.
  • IP-Based Access Control: Automatically creates a baseline access level to grant access from a list of trusted IP sub-networks.
  • Support for Existing Access Levels: Integrate more complex, pre-existing access levels into your perimeters.
  • Granular Ingress/Egress Rules: Define detailed ingress and egress policies to control traffic flow to and from your perimeter, specifying sources, identities, services, and methods.
  • VPC Accessible Services: Restrict which services can be accessed from within the perimeter, preventing data exfiltration while allowing necessary APIs to function.
  • Assumes Existing Policy: Designed to work with your organization's single, pre-existing Access Context Manager Policy, avoiding conflicts.

Usage#

Here is an example of how to use this module to create a service perimeter with custom ingress and egress rules.

module "vpc_sc" {
  source = "./modules/terraform-google-vpc-sc"

  parent_id             = "277065288615"
  policy_name           = "test_access_policy"
  protected_project_ids = ["acme-audit"]
  perimeter_name        = "production_perimeter"

  # Services to lock down inside the perimeter
  restricted_services = [
    "storage.googleapis.com",
    "bigquery.googleapis.com"
  ]

  # Creates an access level named 'corporate_network' for these IPs
  access_level_name = "public_network"
  ip_subnetworks    = ["77.29.40.49/32"]

  # Allow services inside the perimeter to reach specific APIs
  vpc_accessible_services = [
    "iam.googleapis.com",
    "logging.googleapis.com"
  ]
  # Allow a CI/CD service account from an external project to write to GCS
  ingress_policies = [
    {
      from = {
        sources = {
          resources = ["projects/1073141748285"]
        }
        identity_type = "ANY_IDENTITY"
      }
      to = {
        resources = ["*"]
        operations = {
          "storage.googleapis.com" = {
            methods = ["*"]
          }
        }
      }
    }
  ]

  # Allow identities inside the perimeter to read from a public dataset
  egress_policies = [
    {
      from = {
        identity_type = "ANY_IDENTITY"
      }
      to = {
        resources = ["*"]
        operations = {
          "bigquery.googleapis.com" = {
            methods = ["*"]
          }
        }
      }
    }
  ]
}

Limitations#

  • Single Access Policy: This module can handle only one access policy.
  • Simplified Access Levels: The module's primary function is to create a basic IP-based access level. For more complex access levels (e.g., based on device policy or combining other levels), you must create them outside of this module and provide their full names via the access_levels variable.

Software#

This module requires the following software dependencies:

Service Account#

The service account used to run this module must have the following IAM roles:

  • roles/accesscontextmanager.policyAdmin - To create and manage VPC Service Controls policies
  • roles/accesscontextmanager.policyEditor - To edit access levels and service perimeters
  • roles/resourcemanager.organizationViewer - To view organization resources
  • roles/serviceusage.serviceUsageViewer - To view enabled services

APIs#

The following GCP APIs must be enabled in the target organization:

  • Access Context Manager API (accesscontextmanager.googleapis.com)
  • Cloud Resource Manager API (cloudresourcemanager.googleapis.com)
  • Service Usage API (serviceusage.googleapis.com)

License#

This module is covered by a commercial license. Please see LICENSE for details.

Support#

This module is developed and maintained by MyOps Limited. For any support inquiries, please contact us at info@myops.co.il.

Requirements#

Name Version
terraform ~> 1
google >= 6.28.0, < 7.0.0
google-beta >= 6.28.0, < 7.0.0
time ~> 0.13

Providers#

Name Version
google >= 6.28.0, < 7.0.0
time ~> 0.13

Modules#

Name Source Version
access_context_manager_policy terraform-google-modules/vpc-service-controls/google ~> 7.1
access_level_ip terraform-google-modules/vpc-service-controls/google//modules/access_level ~> 7.1
standard_perimeter terraform-google-modules/vpc-service-controls/google//modules/regular_service_perimeter ~> 7.1

Resources#

Name Type
time_sleep.wait_for_access_level resource
google_project.protected data source

Inputs#

Name Description Type Default Required
access_level_name The name of the access level. string "trusted_ips" no
access_levels A list of access level names to apply to the perimeter. If null, defaults to the IP-based access level created by this module. list(string) null no
description A description for the perimeter. string "Standard service perimeter" no
egress_policies A list of egress policies to apply to the perimeter. any [] no
ingress_policies A list of ingress policies to apply to the perimeter. any [] no
ip_subnetworks A list of IP sub-networks to allow access from. list(string) [] no
parent_id The parent ID to apply the VPC Service Controls to. Must be in the format 'organizations/organization_id'. string n/a yes
perimeter_name The name of the service perimeter. string "standard_perimeter" no
policy_name The name of the access policy. string n/a yes
protected_project_ids A list of project IDs to protect with the service perimeter. list(string) 
[
 "test-test"
]
 no
restricted_services A list of services to restrict. list(string) [] no
vpc_accessible_services A list of services that are accessible from within the perimeter. list(string) null no

Outputs#

Name Description
access_level The created access level.
perimeter The created service perimeter.