Network access

Outbound IP addresses

Some DoiT platform integrations make outbound connections from DoiT's infrastructure to your environment or to your cloud provider's APIs. These connections are routed through Google Cloud VPC and Cloud NAT and originate from the following IP addresses:

34.9.10.28
34.10.151.130
34.44.47.236
34.60.197.212
34.69.217.183
34.72.143.128
34.121.183.173
34.134.111.192
34.134.157.59
35.192.89.77

If your environment restricts inbound access by source IP address (for example, with firewall rules or API access lists), allowlist all addresses.

VPC Service Controls

If you use VPC Service Controls to protect your Google Cloud environment, your service perimeter blocks DoiT's requests by default. This section describes how to allow them.

DoiT calls Google Cloud APIs in your organization by impersonating the service account you created when you connected your Google Cloud account, for example doit-cmp@PROJECT_ID.iam.gserviceaccount.com. Every request to your resources is authenticated as that service account, but it originates from DoiT's infrastructure, which is outside your perimeter. VPC Service Controls evaluates both the identity and the origin of a request, so a request from outside is denied even when it uses a service account that belongs to a project inside the perimeter.

There are two ways to allow DoiT:

• Option 1 allows requests by identity: your own DoiT service account, from any origin. This is the smallest grant and the recommended option. You can configure it yourself.
• Option 2 allows requests by origin: DoiT's VPC networks. Choose it if your policy does not allow identity-only rules. This option requires a support ticket before you start, because saving the configuration needs a permission on DoiT's side.

The examples use these placeholders: POLICY_ID is the numeric ID of your access policy, PERIMETER_NAME is the name of your service perimeter, PROJECT_ID is the project where you created your DoiT service account, and ORG_ID is your Google Cloud organization ID.

Option 1: Allow your DoiT service account

Step 1: Add an ingress rule for your DoiT service account

The rule allows requests authenticated as your own service account, from any source, to all services. It grants nothing beyond what the service account can already do: what it can access is still controlled by the IAM roles you granted it. Allow all services rather than a list, because the APIs DoiT features use change over time.

Note

You can find the service account email on the Google Cloud settings page in the DoiT console. If you connected individual BigQuery datasets, the service account name has a suffix, for example doit-cmp-IDENTIFIER@PROJECT_ID.iam.gserviceaccount.com. Add each service account you created.

Google Cloud console

1. Navigate to VPC Service Controls and open your service perimeter.

2. Select Ingress policies, then Add rule.

3. Under FROM: select Identities & groups and enter the email address of the service account you created for DoiT. Set Source to All sources.

4. Under TO: select the projects DoiT accesses, then under Services select All services.

5. Save the rule.

gcloud CLI

Save the following as doit-ingress.yaml:

- ingressFrom:
    identities:
      - serviceAccount:doit-cmp@PROJECT_ID.iam.gserviceaccount.com
    sources:
      - accessLevel: "*"
  ingressTo:
    resources:
      - "*"
    operations:
      - serviceName: "*"

Then add it to your perimeter:

gcloud access-context-manager perimeters update PERIMETER_NAME --policy=POLICY_ID --add-ingress-policies=doit-ingress.yaml

Terraform

Add to the status (or spec, for a dry-run perimeter) block of your google_access_context_manager_service_perimeter:

ingress_policies {
  ingress_from {
    identities = ["serviceAccount:doit-cmp@PROJECT_ID.iam.gserviceaccount.com"]
    sources {
      access_level = "*"
    }
  }
  ingress_to {
    resources = ["*"]
    operations {
      service_name = "*"
    }
  }
}

Step 2: Add an ingress rule for the log sink writer

Skip this step if your perimeter does not restrict BigQuery APIs.

BigQuery Intelligence creates an organization-level log sink that writes into a dataset in your project. The sink uses a Google-managed identity in your organization, [email protected].

Google Cloud console

1. In your service perimeter, select Ingress policies, then Add rule.

2. Under FROM: select Identities & groups and enter [email protected]. Set Source to All sources.

3. Under TO: select the project where you created your DoiT service account, then under API operations select BigQuery API and All methods.

4. Save the rule.

gcloud CLI

Save the following as doit-logsink-ingress.yaml:

- ingressFrom:
    identities:
      - serviceAccount:service-org-ORG_ID@gcp-sa-logging.iam.gserviceaccount.com
    sources:
      - accessLevel: "*"
  ingressTo:
    resources:
      - projects/PROJECT_NUMBER
    operations:
      - serviceName: bigquery.googleapis.com
        methodSelectors:
          - method: "*"

Replace PROJECT_NUMBER with the number of the project where you created your DoiT service account, then add it to your perimeter:

gcloud access-context-manager perimeters update PERIMETER_NAME --policy=POLICY_ID --add-ingress-policies=doit-logsink-ingress.yaml

Terraform

ingress_policies {
  ingress_from {
    identities = ["serviceAccount:[email protected]"]
    sources {
      access_level = "*"
    }
  }
  ingress_to {
    resources = ["projects/PROJECT_NUMBER"]
    operations {
      service_name = "bigquery.googleapis.com"
      method_selectors {
        method = "*"
      }
    }
  }
}

Step 3: Allow token generation for your DoiT service account

Skip this step if your perimeter does not restrict the IAM Service Account Credentials API (iamcredentials.googleapis.com).

Before DoiT can act as your service account, it requests a short-lived token for it through the IAM Service Account Credentials API. Your perimeter evaluates that request with a DoiT production service account as the caller, and it requires both an egress rule and an ingress rule for the API.

All DoiT production service accounts that perform this step are members of the Google Group [email protected]. Reference the group rather than individual service accounts, so your rules stay valid when DoiT adds or replaces services.

Google Cloud console

1. In your service perimeter, select Egress policies, then Add rule.

2. Under FROM: select Identities & groups and enter [email protected].

3. Under TO: set Resources to All resources, then under API operations select IAM Service Account Credentials API and All methods.

4. Save the rule.

5. Select Ingress policies, then Add rule.

6. Under FROM: select Identities & groups and enter [email protected]. Set Source to All sources.

7. Under TO: select the project where you created your DoiT service account, then under API operations select IAM Service Account Credentials API and All methods.

8. Save the rule.

gcloud CLI

Save the following as doit-token-egress.yaml:

- egressFrom:
    identities:
      - group:service-accounts-[email protected]
  egressTo:
    resources:
      - "*"
    operations:
      - serviceName: iamcredentials.googleapis.com
        methodSelectors:
          - method: "*"

And the following as doit-token-ingress.yaml:

- ingressFrom:
    identities:
      - group:service-accounts-[email protected]
    sources:
      - accessLevel: "*"
  ingressTo:
    resources:
      - projects/PROJECT_NUMBER
    operations:
      - serviceName: iamcredentials.googleapis.com
        methodSelectors:
          - method: "*"

Then add both to your perimeter:

gcloud access-context-manager perimeters update PERIMETER_NAME --policy=POLICY_ID --add-egress-policies=doit-token-egress.yaml --add-ingress-policies=doit-token-ingress.yaml

Terraform

egress_policies {
  egress_from {
    identities = ["group:[email protected]"]
  }
  egress_to {
    resources = ["*"]
    operations {
      service_name = "iamcredentials.googleapis.com"
      method_selectors {
        method = "*"
      }
    }
  }
}

ingress_policies {
  ingress_from {
    identities = ["group:[email protected]"]
    sources {
      access_level = "*"
    }
  }
  ingress_to {
    resources = ["projects/PROJECT_NUMBER"]
    operations {
      service_name = "iamcredentials.googleapis.com"
      method_selectors {
        method = "*"
      }
    }
  }
}

Option 2: Allow DoiT's VPC networks

This option creates an access level that matches requests originating from DoiT's VPC networks and uses it as the source of your perimeter rules.

Caution

Saving an access level that references a VPC network in another organization requires the compute.networks.get permission on that network's project. Without it, saving fails with Permission 'compute.networks.get' denied on resource. Before you start, open a support ticket with the subject VPC Service Controls: network access level and include:

• The Google Group (preferred) or the Google account that will create and maintain the access level.
• Your Google Cloud organization ID.
• A short note on why Option 1 does not work for you.

DoiT grants the permission to the group or account you named and confirms in the ticket. Continue only after that confirmation.

Step 1: Create an access level

Use the Google account or a member of the group you named in the support ticket.

Google Cloud console

1. Navigate to Access Context Manager. If prompted, select your organization.

2. Create a basic access level with the following settings:

   1. In the Access level title field, enter a name such as DoiT Platform Access.

   2. Select Basic mode.

   3. For the When condition is met, return option, select TRUE.

   4. In the Conditions section, select Add attribute, IP Subnetworks, then select Private IP.

   5. Choose Select VPC networks, in the Import options list, select Manually enter VPC network address, and enter //compute.googleapis.com/projects/me-doit-intl-com/global/networks/doit-vpc-ca4b552.

   6. Select Add VPC network again and enter //compute.googleapis.com/projects/doitintl-shared-vpc-host/global/networks/shared-vpc with both subnet ranges 10.0.240.0/20 and 10.124.0.0/14.

   7. Save the configuration.

gcloud CLI

Save the following as doit-access-level.yaml:

- vpcNetworkSources:
    - vpcSubnetwork:
        network: "//compute.googleapis.com/projects/me-doit-intl-com/global/networks/doit-vpc-ca4b552"
    - vpcSubnetwork:
        network: "//compute.googleapis.com/projects/doitintl-shared-vpc-host/global/networks/shared-vpc"
        vpcIpSubnetworks:
          - "10.0.240.0/20"
          - "10.124.0.0/14"

Then create the access level:

gcloud access-context-manager levels create doit_platform_access --title="DoiT Platform Access" --basic-level-spec=doit-access-level.yaml --policy=POLICY_ID

Terraform

resource "google_access_context_manager_access_level" "doit_platform_access" {
  parent = "accessPolicies/POLICY_ID"
  name   = "accessPolicies/POLICY_ID/accessLevels/doit_platform_access"
  title  = "DoiT Platform Access"

  basic {
    conditions {
      vpc_network_sources {
        vpc_subnetwork {
          network = "//compute.googleapis.com/projects/me-doit-intl-com/global/networks/doit-vpc-ca4b552"
        }
      }
      vpc_network_sources {
        vpc_subnetwork {
          network            = "//compute.googleapis.com/projects/doitintl-shared-vpc-host/global/networks/shared-vpc"
          vpc_ip_subnetworks = ["10.0.240.0/20", "10.124.0.0/14"]
        }
      }
    }
  }
}

Note

If you previously configured a DoiT access level with only the me-doit-intl-com/doit-vpc-ca4b552 network, add the doitintl-shared-vpc-host/shared-vpc network condition to your existing access level.

Step 2: Add the access level to your perimeter

Google Cloud console

In your service perimeter, open the Access level pane and add the access level you just created.

gcloud CLI

gcloud access-context-manager perimeters update PERIMETER_NAME --policy=POLICY_ID --add-access-levels=doit_platform_access

Terraform

Add the level to the access_levels list in the status (or spec) block of your google_access_context_manager_service_perimeter:

access_levels = [google_access_context_manager_access_level.doit_platform_access.name]

Step 3: Allow token generation from DoiT's networks

Skip this step if your perimeter does not restrict the IAM Service Account Credentials API (iamcredentials.googleapis.com).

The access level covers the calls DoiT makes to your resources, but not the token request that precedes them. Before DoiT can act as your service account, it requests a short-lived token for it through the IAM Service Account Credentials API. Your perimeter evaluates that request with a DoiT production service account as the caller, and it requires both an egress rule and an ingress rule for the API. All DoiT production service accounts that perform this step are members of the Google Group [email protected].

The rules below combine both conditions: the caller must be a member of the group and the request must originate from DoiT's networks (the access level from step 1). Nothing is allowed from any other origin.

Google Cloud console

1. In your service perimeter, select Egress policies, then Add rule.

2. Under FROM: select Identities & groups and enter [email protected]. Enable Restrict sources and select the access level from step 1.

3. Under TO: set Resources to All resources, then under API operations select IAM Service Account Credentials API and All methods.

4. Save the rule.

5. Select Ingress policies, then Add rule.

6. Under FROM: select Identities & groups and enter [email protected]. Under Source, select the access level from step 1.

7. Under TO: select the project where you created your DoiT service account, then under API operations select IAM Service Account Credentials API and All methods.

8. Save the rule.

gcloud CLI

Save the following as doit-token-egress.yaml:

- egressFrom:
    identities:
      - group:service-accounts-[email protected]
    sourceRestriction: SOURCE_RESTRICTION_ENABLED
    sources:
      - accessLevel: accessPolicies/POLICY_ID/accessLevels/doit_platform_access
  egressTo:
    resources:
      - "*"
    operations:
      - serviceName: iamcredentials.googleapis.com
        methodSelectors:
          - method: "*"

And the following as doit-token-ingress.yaml:

- ingressFrom:
    identities:
      - group:service-accounts-[email protected]
    sources:
      - accessLevel: accessPolicies/POLICY_ID/accessLevels/doit_platform_access
  ingressTo:
    resources:
      - projects/PROJECT_NUMBER
    operations:
      - serviceName: iamcredentials.googleapis.com
        methodSelectors:
          - method: "*"

Then add both to your perimeter:

gcloud access-context-manager perimeters update PERIMETER_NAME --policy=POLICY_ID --add-egress-policies=doit-token-egress.yaml --add-ingress-policies=doit-token-ingress.yaml

Terraform

egress_policies {
  egress_from {
    identities         = ["group:[email protected]"]
    source_restriction = "SOURCE_RESTRICTION_ENABLED"
    sources {
      access_level = google_access_context_manager_access_level.doit_platform_access.name
    }
  }
  egress_to {
    resources = ["*"]
    operations {
      service_name = "iamcredentials.googleapis.com"
      method_selectors {
        method = "*"
      }
    }
  }
}

ingress_policies {
  ingress_from {
    identities = ["group:[email protected]"]
    sources {
      access_level = google_access_context_manager_access_level.doit_platform_access.name
    }
  }
  ingress_to {
    resources = ["projects/PROJECT_NUMBER"]
    operations {
      service_name = "iamcredentials.googleapis.com"
      method_selectors {
        method = "*"
      }
    }
  }
}

Step 4: Add an ingress rule for the log sink writer

Skip this step if your perimeter does not restrict BigQuery APIs.

Complete Option 1, step 2. The BigQuery Intelligence log sink writes from a Google-managed identity in your own organization, not from DoiT's networks, so that rule is identity-based in both options.