How to provide access to only one instance to users in Google Compute Engine

googlegoogle-cloud-platformgoogle-compute-engineservice-accounts

I'm trying to find a solution to provide an external worker access to an instance in our project but not all resources.

I have done some research and found two methods on how to do this.

First would be to provide the contractor a private key to ssh into the selected instance.

But I would like to try and use the other method which is to assign the service account user role for the contractor.

From what I understand with service accounts. They are declared as both a resource and an identity. I would have to create a new instance under a newly created service account with limited defined permissions.

[service account] >>> permissions >>> [instances]

[user] >>> service account user role >>> [service account]

so I think the service account user role is like a proxy for the service account. I have tried to assign permissions to the service account and assigned a user with the service account user role. I would think that after this was done that the user would have the permissions assigned on to the service account. But unfortunately that isn't the case and I would like some assistance.

Best Answer

Using a private key like you suggested would be the ideal solution here, as that is the only way to make sure your contractor won't have access to other instances or information about the status of your project. Nonetheless, what you described (SSH into a machine using a service account) can be done, and, indeed, service accounts are both an identity and a resource.

If you give a user the Service Account User role for a service account with the necessary permissions to SSH into a machine, that will allow the user to do just that. Keep in mind however that the minimum set of permissions this service account would require in order for this to work would allow the service account (and, consequently, the user too) to SSH into any Compute instance. This alone is an indicator that doing this won't give you the granularity you seem to want.

In order for the scenario you've conjured to be possible, you'd need to do the following:

  1. Create a service account and give it the Service Account User role and 4 granular permissions, compute.instances.get, compute.instances.setMetadata, compute.projects.get, and compute.zoneOperations.get (you should probably create a custom role for these permissions). This can be done in the IAM & admin section of the Console;
  2. Give the user itself some sort of permissions onto the project through the Console or gcloud. I'd suggest giving the Compute Viewer role;
  3. Instruct the user to install the Google Cloud SDK and initialize it with their credentials;
  4. Have the user SSH into the appropriate instance by using gcloud compute ssh SERVICE_ACCOUNT_USERNAME@INSTANCE_IP_OR_HOSTNAME --zone ZONE_OF_INSTANCE.

I'd suggest having the user SSH into the target machine through Cloud Shell, as it would avoid having to do step 3 altogether. Don't forget about firewall rules as well, as the public IPs assigned to Cloud Shell don't seem to fall under the common Google Public IP ranges.

Don't be surprised if you see a message like Updating project ssh metadata...failed. This is to be expected, as the service account only has permissions to add SSH keys into the metadata of instances.

Related Topic