Network access

Outbound IP addresses

Some DoiT platform integrations make outbound connections from DoiT's infrastructure to your environment or to your cloud provider's APIs. These connections are routed through Google Cloud VPC and Cloud NAT and originate from the following IP addresses:

34.9.10.28
34.10.151.130
34.44.47.236
34.60.197.212
34.69.217.183
34.72.143.128
34.121.183.173
34.134.111.192
34.134.157.59
35.192.89.77

If your environment restricts inbound access by source IP address (for example, with firewall rules or API access lists), allowlist all addresses.

VPC Service Controls

If you use VPC Service Controls to protect your Google Cloud environment, add the following configuration to your existing service perimeter to allow access from DoiT.

Step 1: Create an access level

1. In the Google Cloud console, navigate to Access Context Manager. If prompted, select your organization.

2. Create a basic access level with the following settings:

   1. In the Access level title field, enter a name such as DoiT Platform Access.

   2. Select Basic mode.

   3. For the When condition is met, return option, select TRUE.

   4. In the Conditions section, select Add attribute, IP Subnetworks, then select Private IP.

   5. Choose Select VPC networks, in the Import options list, select Manually enter VPC network address, and enter //compute.googleapis.com/projects/me-doit-intl-com/global/networks/doit-vpc-ca4b552.

   6. Select Add VPC network again and enter //compute.googleapis.com/projects/doitintl-shared-vpc-host/global/networks/shared-vpc with both subnet ranges 10.0.240.0/20 and 10.124.0.0/14.

   7. Save the configuration.

   注意

   If you previously configured a DoiT access level with only the me-doit-intl-com/doit-vpc-ca4b552 network, add the doitintl-shared-vpc-host/shared-vpc network condition from step 6 to your existing access level.

3. In your service perimeter, open the Access level pane and add the access level you just created.

Step 2: Add directional policies

Depending on which APIs your perimeter restricts, add the following policies.

If you restrict iamcredentials.googleapis.com: add an egress rule.

1. In your service perimeter, select Egress policies, then Add rule.

2. Under FROM: set Identity type to Any service account and enable Restrict sources, selecting the access level from step 1.

3. Under TO: set Resources to All resources, then under API operations select IAM Service Account Credentials API and All methods.

4. Save the rule.

The broad identity type is bounded by the source restriction: only requests arriving from DoiT's VPC networks (defined in the access level from step 1) can match this rule. IAM still controls who can generate tokens for each service account.

If you restrict BigQuery APIs: add an ingress rule for the org-level log sink writer.

BigQuery Intelligence calls several BigQuery-family APIs (BigQuery, BigQuery Reservation, BigQuery Data Policy, BigQuery Data Transfer, BigQuery Migration) and Cloud Logging from DoiT's networks. All of these are covered by the access level from step 1, so no additional rules are needed for those APIs beyond the ingress rule below.

1. In your service perimeter, select Ingress policies, then Add rule.

2. Under FROM: select Identities & groups and enter [email protected] (replace ORG_ID with your Google Cloud organization ID).

3. Under TO: select the project where you created your DoiT service account, then under API operations select BigQuery API and All methods.

4. Save the rule.