Configure VPC Service Controls for Google Security Operations

Supported in:

Google secops

Note: This feature is covered by Pre-GA Offerings Terms of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the Google SecOps Technical Support Service guidelines and the Google SecOps Service Specific Terms.

Google Cloud VPC Service Controls lets you set up a service perimeter to guard against data exfiltration. Configure Google Security Operations with VPC Service Controls so that Google SecOps can access resources and services outside its service perimeter.

Before you begin

• Make sure that you have the required roles to configure VPC Service Controls at the organization level.

Limitations

• VPC Service Controls supports only Google Cloud Identity authentication and Google SecOps Bring Your Own Identity (BYOID) and Workforce Identity Federation.
• Google SecOps feature RBAC must be enabled to use VPC Service Controls.
• VPC Service Controls supports only Google SecOps chronicle.googleapis.com and chronicleservicemanager.googleapis.com APIs. You can continue to use other Google SecOps APIs, but you might need to configure special rules to continue to use them, and the data and services using those other APIs aren't protected by VPC Service Controls perimeter restrictions.
• VPC Service Controls supports export of Google SecOps Unified Data Model (UDM) data only to a self-managed BigQuery project or using Advanced BigQuery Export. You can continue to use other Google SecOps export methods, but you might need to configure special rules to continue to use them, and exporting data using those methods isn't protected by VPC Service Controls perimeter restrictions. For more information, reach out to your Google SecOps representative.
• VPC Service Controls doesn't support Cloud Monitoring. However, to prevent non-compliant access, you can revoke permissions to view Cloud Monitoring data. You can continue to use Cloud Monitoring, but you might need to configure special rules to continue to use it, and the data transmission isn't protected by the VPC Service Controls perimeter restrictions. For more information, reach out to your Google SecOps representative.
• VPC Service Controls doesn't support Looker dashboards. VPC Service Controls supports only Google SecOps Dashboards. You can continue to use Looker dashboards, but you might need to configure special rules to continue to use them, and Looker dashboards aren't protected by VPC Service Controls perimeter restrictions.
• VPC Service Controls doesn't support Xenon feeds. You need to create the Cloud Storage feeds with the GOOGLE_CLOUD_STORAGE_V2 source type. You can continue to use Xenon feeds, but you might need to configure special rules to continue to use those feeds, and the use of Xenon feeds isn't protected by VPC Service Controls perimeter restrictions.
• VPC Service Controls doesn't support Google SecOps Security Validation to test your security by simulating attacks in your Google Cloud environment. You can continue to use Security Validation, but you might need to configure special rules to continue to use it, and the use of Security Validation isn't protected by VPC Service Controls perimeter restrictions.
• VPC Service Controls doesn't support DataTap.
• If you use customer-managed encryption keys (CMEK), Google strongly recommends that you either keep your Cloud Key Management Service project in the same perimeter as your Google Cloud project or keep your keys inside the Google Cloud project itself.

Configure the ingress and egress rules

Configure ingress and egress rules based on the service perimeter configuration. For more information, see Service perimeter overview.

Warning: After you set up the ingress and egress rules, run Google SecOps with VPC Service Controls in dry-run mode for the first couple of weeks. Audit your Cloud Audit Logs for any violations before moving the setup to enforced mode.

If you encounter issues with VPC Service Controls, use the VPC Service Controls violation analyzer to debug and analyze the issue. For more information, see Diagnose an access denial in violation analyzer.

Configure rules for SOAR

This section describes how to configure VPC Service Controls for Google SecOps SOAR.

Complete the following tasks for the Google Cloud user account that you specified when you set up Google SecOps:

1. Configure the following ingress rules:

   - ingressFrom:
       identityType: ANY_SERVICE_ACCOUNT
       sources:
       - accessLevel: "*"
     ingressTo:
       operations:
       - serviceName: secretmanager.googleapis.com
         methodSelectors:
         - method: "*"
       resources:
       - projects/PROJECT_NUMBER
   - ingressFrom:
       identities:
       - serviceAccount: [e-mail]
       sources:
       - accessLevel: "*"
     ingressTo:
       operations:
       - serviceName: binaryauthorization.googleapis.com
         methodSelectors:
         - method: "*"
       - serviceName: monitoring.googleapis.com
         methodSelectors:
         - method: "*"
       resources:
       - projects/PROJECT_NUMBER
   

   Replace the following:

   • PROJECT_NUMBER: your Google Cloud SOAR project number, which you can get from your Google SecOps representative

2. Configure the following egress rule:

   - egressTo:
       operations:
       - serviceName: binaryauthorization.googleapis.com
         methodSelectors:
         - method: "*"
       - serviceName: monitoring.googleapis.com
         methodSelectors:
         - method: "*"
       resources:
       - projects/soar-infra-SOAR_REGION_ID
     egressFrom:
       identities:
         - serviceAccount: [e-mail]
       sources:
       - resource: projects/PROJECT_NUMBER
   

   Replace the following:

   • SOAR_REGION_ID: the code that Google assigns based on the SOAR region, which you can get from your Google SecOps representative
   • PROJECT_NUMBER: your Google Cloud bring your own project (BYOP) project number

Configure rule for Google SecOps SIEM

This section describes how to configure VPC Service Controls for Google SecOps SIEM.

Configure the following egress rule for the Google Cloud user account that you specified when you set up Google SecOps:

  - egressTo:
      operations:
      - serviceName: pubsub.googleapis.com
        methodSelectors:
        - method: "*"
      resources:
      - projects/389186463911
    egressFrom:
      identities:
      - user: "*"
      sources:
      - resource: PROJECT_NUMBER

Replace the following:

• PROJECT_NUMBER: your Google Cloud project number, which you can get from your Google SecOps representative

Note: 389186463911 is the project number of the malachite-oob project name, which is an internal Google project that handles the ingestion of log data from customer-provided files.

Configure rules for Google SecOps with Security Command Center

This section describes how to configure VPC Service Controls for Google SecOps with Security Command Center.

Note: In the Google SecOps platform, the Security Command Center integration is called Google Security Command Center. For more information, see Collect Security Command Center findings and Security Command Center issues.

Complete the following tasks for the Google Cloud user account that you specified when you set up Google SecOps:

1. Configure the following ingress rule:

   - ingressFrom:
       identityType: ANY_IDENTITY
       sources:
       - accessLevel: "*"
     ingressTo:
       operations:
       - serviceName: pubsub.googleapis.com
         methodSelectors:
         - method: "*"
       resources:
       - projects/PROJECT_NUMBER
   

   Replace the following:

   • PROJECT_NUMBER: your Google Cloud project number, which you can get from your Google SecOps representative

2. Configure the following egress rule:

   - egressTo:
       operations:
       - serviceName: pubsub.googleapis.com
         methodSelectors:
         - method: "*"
       - serviceName: securitycenter.googleapis.com
         methodSelectors:
         - method: "*"
       resources:
       - "*"
     egressFrom:
       identities:
       - serviceAccount: [e-mail]
       sources:
       - resource: projects/PROJECT_NUMBER
   

   Replace the following:

   • GOOGLE_ORGANIZATION_NUMBER: your Google Cloud organization number
   • PROJECT_NUMBER: your Google Cloud project number, which you can get from your Google SecOps representative

Configure rule when customer-managed encryption key is from different project

This section describes how to configure VPC Service Controls for Google SecOps if you use a customer-managed encryption key (CMEK) from a different project. CMEKs are encryption keys that you own, manage, and store in Cloud Key Management Service.

Note: If the key that you use is in the same project—or in a different project inside the same perimeter, this task isn't necessary.

Configure the following egress rule for the Google Cloud user account that you specified when you set up Google SecOps:

  - egressTo:
      operations:
      - serviceName: cloudkms.googleapis.com
        methodSelectors:
        - method: "*"
      resources:
      - projects/CMEK_PROJECT_NUMBER
    egressFrom:
      identityType: ANY_SERVICE_ACCOUNT
      sources:
      - resource: projects/PROJECT_NUMBER

Replace the following:

• PROJECT_NUMBER: your Google Cloud project number, which you can get from your Google SecOps representative
• CMEK_PROJECT_NUMBER: the project number from the different project

What's next

• Learn more about VPC Service Controls.
• See the Google Security Operations entry in the VPC Service Controls supported products table.