[MUSIC PLAYING]
NITIN DESAI: to the Google Cloud Security Showcase,
a special web series where we will focus on security
use cases that customers can solve with Google Cloud.
My name is Nitin Desai, and I'm an Engineering Manager at GCP.
Today, we will be walking through one
of the top questions we get from customers.
How can I control access to my web apps and VMs GCP
without VPN?
Let's jump into the demo.
My company has built this new web
application called Bookstore, which we have hosted on GCP.
We want to give access to this application
to internal employees without using VPN.
Let's say I'm Bob.
As Bob, I'm going to access this application.
I'm going to use the browser to access the application.
I have this application bookmarked,
so I'm just going to go to this Bookstore application.
It lets me log in.
I need to enter my password.
And voila!
I have access to this application.
Let's try another user, Alice.
She also goes and accesses this application,
again without using VPN directly.
So here comes Alice.
I'm going to enter the password.
And looks like Alice does not have access
to this web application.
Let's find out why.
So if you go to GCP Admin Console,
under Security there is a protocol Identity-Aware Proxy.
So this web application is behind Identity-Aware Proxy.
And here is this web application displayed.
If I look here, I see that only Bob has access
to this application, along with a bunch of other users.
But Alice does not have access to this application.
In case of Bob, I also see an interesting access condition
here called Mac OS Version.
Let's dig deeper into it.
If I go under Access Context Manager on the left side,
here you can select the project.
And let me find out the access level called Mac OS Version.
And what it says is, for Bob to access this application,
Bob needs to make sure that his Mac OS version needs
to be at least 10.14.5.
And based on the data, we know that Bob's Mac OS
version is 10.14.5.
Let's say there is a security issue with 10.14.5
and we want all of the users to access this application
to at least have 10.14.6 as the minimum Mac OS version.
Let's go and edit this access level in Access Context Manager
and change the Mac OS version from 10.14.5 to 10.14.6.
And let's save this access level.
Now let's also go to Access Context Manager
to look at what are other resources that you
can control access to.
So along with HTTP resources, you
can look here under SSH and TCP Resources.
This lists all the virtual machines
and you can control access to VMs for both SSH and RDP
just similar to any web applications.
Now let's go back to Bob and see whether Bob still
has access to this application or not
because Bob is running 10.14.5 and we
have changed our minimum Mac OS Version to 10.14.6.
Looks like Bob does not have access to this application
anymore.
This shows how you can use Google's Contextual
Access to control access to your web applications
and VMs on GCP without using VPN.
Thank you for listening in.
Please visit cloud.google.com/security
for more content from Google Cloud experts.
[MUSIC PLAYING]