[MUSIC PLAYING]
UJJWAL JAIN: Welcome to the Google Cloud Security Showcase,
a special web series where we focus on security
use cases the customer can solve with Google Cloud.
My name is Ujjwal Jain, and I am a software engineer
at Google Cloud.
Today, we will be walking through one
of the top questions we get from customers.
How do I provide organizational level security control using
hierarchical firewall policies?
Hierarchical firewall policies lets
you create a firewall policy across your GCP organization.
A firewall policy is a collection of firewall rules
that you can assign to your organization or any
of your folders.
Hierarchical firewall policies are
evaluated in hierarchical order, based
on where they are associated in the hierarchy.
For example, if you have associated a firewall policy
at organization, it would be evaluated first and then
any forward level policy, and then the network level
VPC firewall rules.
Let's start with the resource hierarchy.
I have an organization with two folders, production
and staging.
Each of these folders have GCP project
which hosts web servers.
You can apply the firewall policy
on the organization or any of these two folders.
Firewall policies are applied from top to bottom.
Today we'll apply a firewall policy at an organization.
But before we do that, let's check the VPC firewall rules
on production web servers.
As you can see, the admin of this VPC
has left the firewall completely open,
which can cause security risk to the GCP
resources underneath this VPC.
Hierarchical firewall policies can
help you avoid such situation.
As an organization admin, you can define a broader set
of firewall rules that you can enforce
across all your organization.
For example, in this case, I only want to allow SSH
and HTTP traffic within my organization.
Moreover, I only want to allow SSH traffic from certain IPs.
To do that, I'll first select my organization
and create a firewall policy.
I will add an SSH firewall rule which
allows access from certain IPs.
This rule will be applied on all the VMs, regardless of the VPC
level firewall routes.
Let us also add as HTTP firewall root.
For HTTP, I don't want to allow HTTP access on all the VMs.
Instead, I want to delegate the evaluation to lower level.
You can do that by using go to next rule, which
instructs GCP to look at the next lower level, VPC,
in this case.
So if the VPC on the VM allows HTTP traffic,
traffic would be allowed.
But if the VPC firewall disallowed HTTP traffic,
traffic would be denied.
So I go to next rule.
And I'll just select HTTP.
Let's also add a denial rule, which
will deny rest of the traffic.
This policy ensures that only HTTP traffic is allowed
if the VPC level firewall rules allow,
and SSH traffic is allowed from certain IPs.
The rest of the traffic is denied, regardless
of VPC level firewall rules.
Next, I'll associate this firewall policy
with my organization.
Firewall policy is now associated
with the organization.
GCP also allows you to view all the firewall, either coming
from hierarchical firewall policies or VPC firewall rules
at one place.
You can do that by going to the VM
and selecting Network Details page.
As you can see, on this VM, both hierarchical firewall policy,
which was defined in an organization,
and VPC level firewall rules are being applied.
We have an enforcement order.
First, the hierarchical firewall policies
will be applied, because they are applied on a higher level,
that is, at organization and at folder.
And then the network level VPC firewall rules are applied.
This ensures that your organization firewall
rules defined by your organization admin
are applied first, regardless of the VPC level firewall rules.
Thank you for tuning in.
Please visit cloud.google.com/security
for more content from Google Cloud experts.
[MUSIC PLAYING]