Migrate VPC firewall rules that use network tags and service accounts

To centralize management and consistently enforce security policies across your Virtual Private Cloud (VPC) networks, migrate your VPC firewall rules that use network tags and source service accounts to a global network firewall policy. By doing so, you can reduce your attack surface, optimize your firewall configurations, and tighten security boundaries by identifying and addressing overly permissive rules.

This document is intended for network administrators, security engineers, and security architects who configure and manage network security policies.

To migrate rules that don't use network tags or service accounts, see Migrate VPC firewall rules that don't use network tags and service accounts.

To complete this migration, you perform the following tasks:

  1. Assess your environment.
  2. List existing network tags and service accounts.
  3. Create secure tags for each network tag and source service account.
  4. Map the network tags and service accounts to the secure tags that you create.
  5. Bind secure tags to virtual machine (VM) instances.
  6. Migrate VPC firewall rules to a global network firewall policy.
  7. Review the new network firewall policy.
  8. Complete the postmigration tasks.

Before you begin

  1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  3. Verify that billing is enabled for your Google Cloud project.

  4. Enable the Compute Engine API.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the API

  5. Install the Google Cloud CLI.

  6. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  7. To initialize the gcloud CLI, run the following command: 

    gcloud init

  8. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  9. Verify that billing is enabled for your Google Cloud project.

  10. Enable the Compute Engine API.

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the API

  11. Install the Google Cloud CLI.

  12. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  13. To initialize the gcloud CLI, run the following command: 

    gcloud init
  14. Make sure that you have the Compute Security Admin role (roles/compute.securityAdmin).

Assess your environment

Before you migrate your VPC firewall rules to a global network firewall policy, assess your existing environment and Identity and Access Management (IAM) roles and permissions:

  1. Identify the number of VPC firewall rules in your VPC network.
  2. Make a note of the priorities associated with each VPC firewall rule.
  3. Make sure that you have the required IAM roles and permissions to create, associate, modify, and view global network firewall policies.

  4. Make sure that you have the required IAM roles and permissions to create, update, and delete secure tag definitions.

    The following table provides a summary of the various roles that are required to create and manage secure tags:

    Role name Tasks performed
    Tag Administrator role (roles/resourcemanager.tagAdmin) Create, update, and delete tag definitions. For more information, see Administer tags.
    Tag Viewer role (roles/resourcemanager.tagViewer) View tag definitions and tags that are attached to resources.
    Tag User role (roles/resourcemanager.tagUser) Add and remove tags that are attached to resources.

List existing network tags and service accounts

Determine whether your VPC firewall rules use any network tags or service accounts, and create a JSON file to save the details of the existing network tags and service accounts.

To export the network tags and service accounts in your network to a mapping JSON file, use the gcloud beta compute firewall-rules migrate command with the --export-tag-mapping flag:

gcloud beta compute firewall-rules migrate \
    --source-network=NETWORK_NAME \
    --export-tag-mapping \
    --tag-mapping-file=TAG_MAPPING_FILE

Replace the following:

  • NETWORK_NAME: the name of the VPC network containing the VPC firewall rules that you want to migrate.
  • TAG_MAPPING_FILE: the name of the mapping JSON file.

If your VPC firewall rules contain only service accounts, the generated JSON file contains only service accounts. Similarly, if your VPC firewall rules contain only network tags, the generated JSON file contains only network tags. The service accounts are prefixed with sa, and network tags don't have any prefix.

For example, the following generated JSON file contains a network tag sql-server and a service account example@example.com.

{"sql-server": null, "sa:example@example.com": null}

Create secure tags

Based on the network tags and source service accounts listed in the mapping file, you must create the corresponding secure tags in your network.