Troubleshoot policy and access problems

This document provides an overview of Google Cloud access policy enforcement controls and the tools that are available to help troubleshoot access problems. This document is for support teams who want to help customers in their organization to resolve issues related to accessing their Google Cloud resources.

Google Cloud access policy enforcement controls

This section describes the policies that you or your organization administrator can implement that affect access to your Google Cloud resources. You implement access policies by using all or some of the following products and tools.

Labels, tags, and network tags

Google Cloud offers several ways to label and group resources. You can use labels, tags, and network tags to help enforce policies.

Labels are key-value pairs that help you organize your Google Cloud resources. Many Google Cloud services support labels. You can also use labels to filter and group resources for other use cases, for example, to identify all the resources that are in a test environment as opposed to resources that are in production. In the context of policy enforcement, labels can identify where resources should be located. For example, the access policies that you apply to resources that are labeled as test are different from the access policies that you apply to resources that are labeled as production resources.

Tags are key-value pairs that provide a mechanism for identifying resources and applying policy. You can attach tags to an organization, folder, or project. A tag applies to all resources at the hierarchy level that the tag is applied to. You can use tags to conditionally allow or deny access policies based on whether a resource has a specific tag. You can also use tags with firewall policies to control traffic in a Virtual Private Cloud (VPC) network. Understanding how tags are inherited and combined with access and firewall policies is important in troubleshooting.

Network tags are different from the preceding resource manager tags. Network tags apply to VM instances, and they are another way that you can control network traffic to and from a VM. On Google Cloud networks, network tags identify which VMs are subject to firewall rules and network routes. You can use network tags as source and destination values in firewall rules. You can also use network tags to identify which VMs a certain route applies to. Understanding network tags can help you to troubleshoot access problems because network tags are used to define network and routing rules.

VPC firewall rules

You can configure VPC firewall rules to allow or deny traffic to and from your virtual machine (VM) instances and products built on VMs. Every VPC network functions as a distributed firewall. Although VPC firewall rules are defined at the network level, connections are allowed or denied on a per-instance basis. You can apply VPC firewall rules to the VPC network, VMs grouped by tags, and VMs grouped by service accounts.

VPC Service Controls

VPC Service Controls provides a perimeter security solution that helps mitigate data exfiltration from Google Cloud services such as Cloud Storage and BigQuery. You create a service perimeter that creates a security boundary around Google Cloud resources, and you can manage what is allowed in and out of the perimeter. VPC Service Controls also provides context-aware access controls by implementing policies based on contextual attributes such as IP address and identity.

Resource Manager

You use Resource Manager to set up an organization resource. Resource Manager provides tools that let you map your organization and the way you develop applications to a resource hierarchy. Along with helping you to group resources logically, Resource Manager provides attach points and inheritance for access control and organization policies.

Identity and Access Management

Identity and Access Management (IAM) lets you define who (identity) has what access (role) for which resource. An IAM policy is a collection of statements that defines who has what type of access, such as read or write access. The IAM policy is attached to a resource and the policy enforces access control whenever a user attempts to access the resource.

A feature of IAM is IAM Conditions. When you implement IAM Conditions as part of your policy definition, you can choose to grant resource access to identities (principals) only if configured conditions are met. For example, you can use IAM Conditions to limit access to resources only for employees making requests from your corporate office.