アクセス制御とセキュリティ

<サービス名>.<リソース>.<動詞>

例
compute.instance.delete
compute.instance.start
compute.instance.setMachineType

$ gcloud GROUP add-iam-policy-binding RESOURCE --member=MEMBER --role=ROLE_ID

# 例：プロジェクト my-project のユーザー my-user@example.com に閲覧者の役割を付与する
$ gcloud projects add-iam-policy-binding my-project --member=user:my-user@example.com --role=roles/viewer

# 例：組織 my-organization のユーザー my-user@example.com に閲覧者の役割を付与する
$ gcloud organizations add-iam-policy-binding my-organization --member=user:my-user@example.com --role=roles/viewer

$ gcloud GROUP remove-iam-policy-binding RESOURCE --member=MEMBER --role=ROLE_ID

# 例：プロジェクト my-project のユーザー my-user@example.com から閲覧者のロールを取り消す
$ gcloud projects remove-iam-policy-binding my-project --member=user:my-user@example.com --role=roles/viewer

$ gcloud projects get-iam-policy PROJECT_ID --format=FORMAT > FILE_PATH

# 例
$ gcloud projects get-iam-policy my-project --format json > ~/policy.json
{
  "bindings": [
    {
      "role": "roles/owner",
      "members": [
        "user:fatima@example.com"
      ]
    },
    {
      "role": "roles/editor",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:wei@example.com"
      ]
    }
  ],
  "etag": "BwUjMhCsNvY=",
  "version": 1
}

$ gcloud projects set-iam-policy PROJECT_ID FILE_PATH

# ファイル例
{
  "bindings": [
    {
      "role": "roles/owner",
      "members": [
        "user:fatima@example.com"
      ]
    },
    {
      "role": "roles/editor",
      "members": [
        "serviceAccount:service-account-13@appspot.gserviceaccount.com",
        "user:wei@example.com"
      ]
    }
  ]
}

# 組織レベルの場合
$ gcloud iam roles create role-id --organization=organization-id \
  --file=yaml-file-path

# プロジェクトレベルの場合
$ gcloud iam roles create role-id --project=project-id \
  --file=yaml-file-path

title: role-title
description: role-description
stage: launch-stage
includedPermissions:
- permission-1
- permission-2

# 組織レベルの場合
$ gcloud iam roles create role-id --organization=organization-id \
  --title=role-title --description=role-description \
  --permissions=permissions-list --stage=launch-stage

# プロジェクトレベルの場合
$ gcloud iam roles create role-id --project=project-id \
  --title=role-title --description=role-description \
  --permissions=permissions-list --stage=launch-stage

$ gcloud projects COMMAND [GCLOUD_WIDE_FLAG ...]

$ gcloud projects --help # コマンドの help

# プロジェクトの作成
$ gcloud projects create [PROJECT_ID]

# プロジェクトの一覧を取得 # プロジェクトが作成されていることを確認する
$ gcloud projects list
PROJECT_ID                    NAME                          PROJECT_NUMBER
qwiklabs-gcp-02-eac86d9938ef  qwiklabs-gcp-02-eac86d9938ef  264608401336 # これが作成したプロジェクトとする

# プロジェクトの IAM ポリシーを取得 # 権限毎にユーザ・グループ・サービスアカウントが表示される
$ gcloud projects get-iam-policy qwiklabs-gcp-02-eac86d9938ef
bindings:
- members:
  - serviceAccount:qwiklabs-gcp-02-eac86d9938ef@qwiklabs-gcp-02-eac86d9938ef.iam.gserviceaccount.com
  - user:student-02-843d65d5d79e@qwiklabs.net # 現在のユーザ
  role: roles/editor
- members:
  - serviceAccount:qwiklabs-gcp-02-eac86d9938ef@qwiklabs-gcp-02-eac86d9938ef.iam.gserviceaccount.com
  role: roles/owner
- members:
  - serviceAccount:qwiklabs-gcp-02-eac86d9938ef@qwiklabs-gcp-02-eac86d9938ef.iam.gserviceaccount.com
  - user:student-02-843d65d5d79e@qwiklabs.net # 現在のユーザ
  role: roles/viewer
etag: BwW_ToiGehg=
version: 1

# メンバーにプロジェクトの権限を付与する # なお、リソースはプロジェクトなのでロールは基本ロールの「'roles/browser'」「'roles/editor'」「'roles/owner'」のみ
gcloud projects add-iam-policy-binding [PROJECT_ID] --member=MEMBER --role=ROLE

$ BUCKET_NAME=pepese_enron_corpus
$ gsutil mb gs://${BUCKET_NAME}

gsutil cp gs://enron_emails/allen-p/inbox/1. .


# Cloud KMS を有効にする
$ gcloud services enable cloudkms.googleapis.com

# データを暗号化するには、キーリングと暗号鍵を作成する必要がある
# キーリングは鍵をグループ化する際に役立ち、鍵は環境別（テスト、ステージング、本番など）、またはその他の概念別にグループ化できる
# ここでは、キーリングの名前は test、暗号鍵の名前は qwiklab 
$ KEYRING_NAME=test CRYPTOKEY_NAME=qwiklab
# キーリングの作成
$ gcloud kms keyrings create $KEYRING_NAME --location global
# キーリングをしようして暗号鍵の作成
$ gcloud kms keys create $CRYPTOKEY_NAME --location global \
      --keyring $KEYRING_NAME \
      --purpose encryption

# メールの base64 エンコード（Base-64 エンコードを行うと、バイナリデータであってもプレーンテキストとして扱うことができる）
$ PLAINTEXT=$(cat 1. | base64 -w0)

# 暗号化
$ curl -v "https://cloudkms.googleapis.com/v1/projects/$DEVSHELL_PROJECT_ID/locations/global/keyRings/$KEYRING_NAME/cryptoKeys/$CRYPTOKEY_NAME:encrypt" \
  -d "{\"plaintext\":\"$PLAINTEXT\"}" \
  -H "Authorization:Bearer $(gcloud auth application-default print-access-token)"\
  -H "Content-Type: application/json"
* Connected to cloudkms.googleapis.com (64.233.187.95) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use h2
* Server certificate:
*  subject: C=US; ST=California; L=Mountain View; O=Google LLC; CN=upload.video.google.com
*  start date: Apr 13 10:16:07 2021 GMT
*  expire date: Jul  6 10:16:06 2021 GMT
*  subjectAltName: host "cloudkms.googleapis.com" matched cert's "*.googleapis.com"
*  issuer: C=US; O=Google Trust Services; CN=GTS CA 1O1
*  SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x563024fbefb0)
> POST /v1/projects/qwiklabs-gcp-02-b49ebfd3b4b8/locations/global/keyRings/test/cryptoKeys/qwiklab:encrypt HTTP/2
> Host: cloudkms.googleapis.com
> User-Agent: curl/7.64.0
> Accept: */*
> Authorization:Bearer ya29.a0AfH6SMB-LBTO6PGarRHEadU4ULHrPMT5yYFmIoTZD1clCWU9TapTOUMXgIuGjyfyBCMFQS6m4_CsMCnixMMTEpJWhVg5wFbUiAy_LyaI5rXj5v53a_6P4wDFDXWrkkopWWMex1oXMNTYqOR6XZBQOlhCDSDI_Dqd9DjR1KADeHSj7_PCFekQRbGs-5hNAxOIZj7O_zLtvfEE-5ONOHhWUhOqXbbc49ibOOGnweOXfQeYqWLY789gdfubPPFMtr6jP9QiNw
> Content-Type: application/json
> Content-Length: 2384
>
* Connection state changed (MAX_CONCURRENT_STREAMS == 100)!
* We are completely uploaded and fine
< HTTP/2 200
< content-type: application/json; charset=UTF-8
< vary: X-Origin
< vary: Referer
< vary: Origin,Accept-Encoding
< date: Wed, 19 May 2021 11:40:29 GMT
< server: ESF
< cache-control: private
< x-xss-protection: 0
< x-frame-options: SAMEORIGIN
< x-content-type-options: nosniff
< accept-ranges: none
<
{
  "name": "projects/qwiklabs-gcp-02-b49ebfd3b4b8/locations/global/keyRings/test/cryptoKeys/qwiklab/cryptoKeyVersions/1",
  "ciphertext": "CiQAPf2F4KxBEXLJ7mMPZZc2UIUrL1VWG8BQjxJslgnqH7MIi1cSmQ4ABtJuq1/nd6d0qw84pcMhVW+h2Wp11h6MFR1F2nnCBVtQJ/yxYvSZnOREbgDmbL7+Iaf040iMuv+9eg5EojWnwltibPEoLOuDLV46jQzAUIIpJoHlfW1s+2gWzGX71gybgVol1X1o/UBY1Vlbdm7+YWP6L0baYTl6PsCknLorcgr+NTIueNIa31NktGIipPO5X3V4dVZjdc8eHSPK8YQuSs+fiAeUw2JipSnSk3K/jFiiC5lKVw178ySPBTuIpRZR2HYD2bRpGAbBNb/RMFkic8yxnQQ5YDWPgpLAxnegCLY4ShgREXGwHPePCl8HvY0zClW/T99BGuzMcMLSbzUyhum4DkC5G++B1AQi0nCUgDF6E8R07q4CiH23j0hB4La+CvulQYfZ7Gf3x/xZ0cTx44KPHDufZS5odKFY3i1ZpEvzJEDbUFcPu4WSCPaoSTk9aDHZGFOoXiEQRdvGzqsbZT0176WX5AX8YPX4FH+pAwkMnsbQP+XbONBGz1UYnxz/S1tbmxymvwozZ2ol8PWeNh0JxRxXGVQ1eDaKhPkbshaLF6O1O0j5eKvtTFgujwQgzYZGffjej1nwW/pWocsSWDM9KJmCRxa5uTe93JGk8FvFMS/VoxSCR+6yhBlYhyUlyAfErPsslcKJ1wu1y/C3oZBsHZHg22LLijgulSZEeGjW5t6Ejdu73b+hG0c/mki7GbBoRj3w6ovipJAEvkvjbYpMODG4B4w1NcMbsN+6u6bHCf8T3nZWxNvCrIPFgh7g8Z4khpLGBMjnia3aQH6+/bOEdNqOQc9AC4ZUKxPZyD0q5EUDZyqZIpEfB8s74OKdsjblK//E4zZoQIGehn9w7WTfd7OHRf1FZo2WzhV0hzTf/aEW4z+apQZYyiq4SsKTcp1aVjgB9xrW6iIC2Ii+I3v6kxVupSfYh8Vahun3qYfMj4fB9kNLeb8eRVE7yM77nD16gfK+3CN7yxm90uhW0gizleY3aMBCfNC7UYqTAu2dsms/7kjC1QgyD37xkj124AIHg13InqubAlrYadZEcHEeeQ772J8nmNpobAvzANKZWTQ2aXKaz+O9cQQ6PTjvIMi/l0lzCvMqHTn7x+G13kRWQPWaaCpoaTrDg87hpDOG2UDNjhpb0xtoQptsaiFwjG/Jj7FV/kJ43L6pEqA2DF1GCcBdL5NOd4qmVqXckDhAXbQYHuflTRxnxbtxR9zPLEkyIxCkG1mjtYmlll9sfZk/X5LtxCJZY8Boo2/ArGvL51e8IdoAMck08+kjTgY+ZN1lj0q/oy0vh8n1aBBbN7pYrD6dBrsymhzxUggBbskJEQbzgK3vgBEnTUmKK3SnhyKiWSBTjbyeNe2//D2X+vvSApp+rCkYO5vgQTslVEB63eZaNpU9kHD5m4I7YkoSNAqwle+X96W92l0fOAgVeiJkOUzipMQDvCSnZsdGIzw//Rj5NhJ/8jttHSJsPpcxief3XaM2+0uUT6VgmqJTv2AYphTEjA8HbfwtQo+VhqkH+BsLpdD5jnFP0gYlxVs5G4uEug2qyjlHKMSSXLuZ3PNeFJHPv0BSIjQHZKhkeax65xuPPkMoi8FSPefqZUUUS6Q4t72kNifri6HDc7xtXkMBX8s1FEgf0U+noBOf1UXWCaXiJ3xJRAUP06DrAC0uYRs6/I0bu5ALS7xkEZRI2fIC6AoPjREjF1y1iLKWQGGmqf57fK8L0dGze27R/iKatUNRJsoosPjKo36Hml1BWdXflx7VOyQkztyARI9xGM0di0ZjvAvOQsioPowvWJ6+QnjLPKzFPC1YO/sm9C8MrM3M4m6gdiStPMxoJSYgl+vCVJUTPP+ayGRjcTM9uEz0vmsq4GEF1lAxM8qvZ9ERYnDvq63+AyarXVw5O9xgegcB6dfMB0AHJlwk+/gfTHu8/n51G38Iy2pQcGMx2eySPQ9fRa2i+0GG1C+w+wO4ZkN3J9GxWFpLpiM0OQFuJWc+eYzyvjRbjHoKyCRBb81jf6HdDCUD9iSp3KWATWs4oZkfo0fxTO7HOoVTsRzVMe8Re2jYr0LROMcNstr67c/22wOBxC3L8lII4m3vWLS2gw4rbmjVkVru8zMvS/6rNDVSWJqtVxYFq5Oi49qaZTegLgL0q2hnrUP6r+eknioUzrsy9Bre1LM1R+oCHzngbsgW81kElcvm7e3kuNcMEjv8r+mvluTadL+HPAJ66OMBGPfPBIJyZcgv73vPi7Su35bORKMjvTsyHLxoi3u0K5EO1E7sU1Oz0EZ/Xkwwah3U9mGLRPnqndVdo+Vx263WV4KXpJR8WqM0qWqTNziDGWnyGfgcByuvhgu6CZIeAZIwMVzyrMwflrwoQAZX3+U4HQYWGb/DNcclP1AAK4XyWX2fEwfdVL832BJbDQSKtXh58aiH5eWsT6symA==",
  "ciphertextCrc32c": "4146537015",
  "protectionLevel": "SOFTWARE"
}
* Connection #0 to host cloudkms.googleapis.com left intact

# 上記は長いので暗号化部分のみ取り出す
$ curl -v "https://cloudkms.googleapis.com/v1/projects/$DEVSHELL_PROJECT_ID/locations/global/keyRings/$KEYRING_NAME/cryptoKeys/$CRYPTOKEY_NAME:encrypt" \
  -d "{\"plaintext\":\"$PLAINTEXT\"}" \
  -H "Authorization:Bearer $(gcloud auth application-default print-access-token)"\
  -H "Content-Type:application/json" \
| jq .ciphertext -r > 1.encrypted

# 暗号化されたデータが複合化可能か確認
$ curl -v "https://cloudkms.googleapis.com/v1/projects/$DEVSHELL_PROJECT_ID/locations/global/keyRings/$KEYRING_NAME/cryptoKeys/$CRYPTOKEY_NAME:decrypt" \
  -d "{\"ciphertext\":\"$(cat 1.encrypted)\"}" \
  -H "Authorization:Bearer $(gcloud auth application-default print-access-token)"\
  -H "Content-Type:application/json" \
| jq .plaintext -r | base64 -d

# 暗号化されたデータを Cloud Storage バケットへアップロード
$ gsutil cp 1.encrypted gs://${BUCKET_NAME}

$ gcloud kms keyrings add-iam-policy-binding $KEYRING_NAME \
    --location global \
    --member user:$USER_EMAIL \
    --role roles/cloudkms.admin

$ gcloud kms keyrings add-iam-policy-binding $KEYRING_NAME \
    --location global \
    --member user:$USER_EMAIL \
    --role roles/cloudkms.cryptoKeyEncrypterDecrypter

# 初期設定
$ gcloud config set compute/region us-central1
$ gcloud config set compute/zone us-central1-a

# VM インスタンス blue を作成
$ gcloud compute instances create blue \
   --tags=web-server \
   --metadata=startup-script='#! /bin/bash
     apt-get update
     sudo apt-get install nginx-light -y'
Created [https://www.googleapis.com/compute/v1/projects/qwiklabs-gcp-02-4e1179b11a90/zones/us-central1-a/instances/blue].
NAME  ZONE           MACHINE_TYPE   PREEMPTIBLE  INTERNAL_IP  EXTERNAL_IP     STATUS
blue  us-central1-a  n1-standard-1               10.128.0.2   104.198.156.96  RUNNING

# VM インスタンス green を作成
$ gcloud compute instances create green \
   --metadata=startup-script='#! /bin/bash
     apt-get update
     sudo apt-get install nginx-light -y'
Created [https://www.googleapis.com/compute/v1/projects/qwiklabs-gcp-02-4e1179b11a90/zones/us-central1-a/instances/green].
NAME   ZONE           MACHINE_TYPE   PREEMPTIBLE  INTERNAL_IP  EXTERNAL_IP    STATUS
green  us-central1-a  n1-standard-1               10.128.0.3   34.123.63.156  RUNNING

# VM インスタンス test-vm を作成
$ gcloud compute instances create test-vm --machine-type=f1-micro
Created [https://www.googleapis.com/compute/v1/projects/qwiklabs-gcp-02-4e1179b11a90/zones/us-central1-a/instances/test-vm].
NAME     ZONE           MACHINE_TYPE  PREEMPTIBLE  INTERNAL_IP  EXTERNAL_IP    STATUS
test-vm  us-central1-a  f1-micro                   10.128.0.4   35.232.124.24  RUNNING

# Cloud Console の Compute Engine ページから blue 、 green にログインして `/var/www/html/index.nginx-debian.html` を編集する。
$ gcloud compute ssh blue
$ sudo vi /var/www/html/index.nginx-debian.html
$ exit
$ gcloud compute ssh green
$ sudo vi /var/www/html/index.nginx-debian.html
$ exit

# ファイアウォールルール allow-http-web-server を作成
$ gcloud compute firewall-rules create allow-http-web-server \
    --action=allow \
    --direction=ingress \
    --source-ranges=0.0.0.0/0 \
    --target-tags=web-server \
    --rules=tcp:80,icmp

$ gcloud compute ssh test-vm
$ curl http://10.128.0.2     # blue の内部 IP -> アクセス可能
$ curl http://10.128.0.3     # green の内部 IP -> アクセス可能
$ curl http://104.198.156.96 # blue の外部 IP -> アクセス可能
$ curl http://34.123.63.156  # green の外部 IP -> アクセス不可能！
$ exit

$ gcloud compute ssh test-vm

$ gcloud compute firewall-rules list
ERROR: (gcloud.compute.firewall-rules.list) Some requests did not succeed:
 - Request had insufficient authentication scopes.

$ gcloud compute firewall-rules delete allow-http-web-server
ERROR: (gcloud.compute.firewall-rules.delete) Could not fetch resource:
 - Request had insufficient authentication scopes.

$ exit

$ gcloud compute firewall-rules list
NAME                    NETWORK  DIRECTION  PRIORITY  ALLOW                         DENY  DISABLED
allow-http-web-server   default  INGRESS    1000      tcp:80,icmp                         False
default-allow-icmp      default  INGRESS    65534     icmp                                False
default-allow-internal  default  INGRESS    65534     tcp:0-65535,udp:0-65535,icmp        False
default-allow-rdp       default  INGRESS    65534     tcp:3389                            False
default-allow-ssh       default  INGRESS    65534     tcp:22                              False

$ gcloud compute firewall-rules delete allow-http-web-server
ERROR: (gcloud.compute.firewall-rules.delete) Could not fetch resource:
 - Required 'compute.firewalls.delete' permission for 'projects/qwiklabs-gcp-02-4e1179b11a90/global/firewalls/allow
-http-web-server'