Access Context Manager in GCP - Mini Project: Build & Apply

Access Context Manager Setup in Google Cloud

📖 Scenario: You are working for a company that wants to control access to its Google Cloud resources based on user location and device security status. To do this, you will use Access Context Manager to create access levels and a service perimeter.

🎯 Goal: Build an Access Context Manager configuration that defines an access level with specific conditions and then create a service perimeter that uses this access level to protect resources.

📋 What You'll Learn

Create an access level named office_access with a condition that allows access only from IP addresses in the range 192.168.0.0/16.

Create a service perimeter named secure_perimeter that includes the project projects/123456789.

Configure the service perimeter to use the office_access access level for ingress policies.

💡 Why This Matters

🌍 Real World

Companies use Access Context Manager to enforce security policies that restrict access to cloud resources based on user location, device security, and other conditions.

💼 Career

Understanding how to configure access levels and service perimeters is essential for cloud security engineers and administrators managing secure environments in Google Cloud.

1

Create the Access Level Definition

Create a variable called access_level that holds a dictionary with the key name set to "accessPolicies/1000/accessLevels/office_access" and a key basic containing a conditions list with one condition. This condition should have ipSubnetworks set to a list containing "192.168.0.0/16".

GCP

# Define the access_level dictionary with the specified name and IP subnet condition
# Your code here

Hint

Use a dictionary with keys name and basic. Inside basic, add conditions as a list with one dictionary containing ipSubnetworks.

2

Create the Service Perimeter Configuration

Create a variable called service_perimeter that holds a dictionary with the key name set to "accessPolicies/1000/servicePerimeters/secure_perimeter", a key resources set to a list containing "projects/123456789", and a key status with a nested key ingressPolicies set to an empty list.

GCP

access_level = {
    "name": "accessPolicies/1000/accessLevels/office_access",
    "basic": {
        "conditions": [
            {
                "ipSubnetworks": ["192.168.0.0/16"]
            }
        ]
    }
}

# Define the service_perimeter dictionary with the specified name, resources, and empty ingressPolicies list
# Your code here

Hint

Use a dictionary with keys name, resources, and status. Inside status, add ingressPolicies as an empty list.

3

Add Ingress Policy Using the Access Level

Add a dictionary to the ingressPolicies list inside service_perimeter["status"]. This dictionary should have a key accessLevels set to a list containing the string "accessPolicies/1000/accessLevels/office_access".

GCP

access_level = {
    "name": "accessPolicies/1000/accessLevels/office_access",
    "basic": {
        "conditions": [
            {
                "ipSubnetworks": ["192.168.0.0/16"]
            }
        ]
    }
}

service_perimeter = {
    "name": "accessPolicies/1000/servicePerimeters/secure_perimeter",
    "resources": ["projects/123456789"],
    "status": {
        "ingressPolicies": []
    }
}

# Add an ingress policy dictionary with accessLevels list containing the office_access access level
# Your code here

Hint

Append a dictionary with key accessLevels to the ingressPolicies list inside service_perimeter["status"].

4

Finalize the Access Context Manager Configuration

Add a key title with the value "Secure Perimeter" to the service_perimeter dictionary and a key description with the value "Perimeter restricting access to office IP range".

GCP

access_level = {
    "name": "accessPolicies/1000/accessLevels/office_access",
    "basic": {
        "conditions": [
            {
                "ipSubnetworks": ["192.168.0.0/16"]
            }
        ]
    }
}

service_perimeter = {
    "name": "accessPolicies/1000/servicePerimeters/secure_perimeter",
    "resources": ["projects/123456789"],
    "status": {
        "ingressPolicies": [
            {
                "accessLevels": ["accessPolicies/1000/accessLevels/office_access"]
            }
        ]
    }
}

# Add title and description keys to service_perimeter
# Your code here

Hint

Add "title" and "description" keys directly to the service_perimeter dictionary.

Practice

1. What is the main purpose of Access Context Manager in Google Cloud?

easy

A. To manage billing accounts and payments

B. To monitor network traffic in real-time

C. To deploy virtual machines automatically

D. To control access to resources based on user context like location and device security

Solution

1. Step 1: Understand Access Context Manager's role

   It controls access by considering user context such as location and device security, not just identity.

2. Step 2: Compare with other options

   Billing, VM deployment, and network monitoring are unrelated to Access Context Manager's function.

3. Final Answer:

   To control access to resources based on user context like location and device security -> Option D

4. Quick Check:

   Access Context Manager controls access context = B [OK]

Hint: Access Context Manager controls access by context, not billing or VMs [OK]

Common Mistakes:

• Confusing Access Context Manager with billing or VM services
• Thinking it manages network traffic monitoring
• Assuming it only uses usernames and passwords

2. Which of the following is the correct way to define an Access Level in Access Context Manager using YAML?

easy

A. accessLevels:
- name: 'accessPolicies/123/accessLevels/level1'
title: 'Office Access'
basic:
conditions:
- ipSubnetworks: ['192.168.1.0/24']
devicePolicy:
osConstraints:
- osType: 'DESKTOP_MAC'
minimumVersion: '10.15'

B. accessLevels:
- id: 'level1'
description: 'Office Access'
conditions:
ipRanges: ['192.168.1.0/24']
device: 'MAC'

C. accessLevel:
- name: 'level1'
title: 'Office Access'
conditions:
ipSubnet: ['192.168.1.0/24']
devicePolicy:
osType: 'MAC'

D. accessLevels:
- name: 'accessPolicies/123/accessLevels/level1'
title: 'Office Access'
conditions:
ipSubnetworks: ['192.168.1.0/24']
devicePolicy:
osConstraints:
- osType: 'DESKTOP_MAC'
minimumVersion: '10.15'

Solution

1. Step 1: Review correct YAML structure for Access Level

   The correct syntax uses 'accessLevels' list with 'name', 'title', and 'basic' containing 'conditions' with 'ipSubnetworks' and 'devicePolicy' including 'osConstraints'.

2. Step 2: Identify errors in other options

   accessLevels: - id: 'level1' description: 'Office Access' conditions: ipRanges: ['192.168.1.0/24'] device: 'MAC' uses wrong keys like 'ipRanges' and 'device'. accessLevel: - name: 'level1' title: 'Office Access' conditions: ipSubnet: ['192.168.1.0/24'] devicePolicy: osType: 'MAC' uses 'accessLevel' singular and wrong keys. accessLevels: - name: 'accessPolicies/123/accessLevels/level1' title: 'Office Access' conditions: ipSubnetworks: ['192.168.1.0/24'] devicePolicy: osConstraints: - osType: 'DESKTOP_MAC' minimumVersion: '10.15' misses 'basic' wrapper around 'conditions'.

3. Final Answer:

   accessLevels: - name: 'accessPolicies/123/accessLevels/level1' title: 'Office Access' basic: conditions: - ipSubnetworks: ['192.168.1.0/24'] devicePolicy: osConstraints: - osType: 'DESKTOP_MAC' minimumVersion: '10.15' -> Option A

4. Quick Check:

   Correct YAML keys and structure = A [OK]

Hint: Look for 'basic' and 'conditions' keys in YAML for Access Level [OK]

Common Mistakes:

• Using singular 'accessLevel' instead of 'accessLevels'
• Missing 'basic' wrapper for conditions
• Incorrect keys like 'ipRanges' or 'device' instead of 'ipSubnetworks' and 'devicePolicy'

3. Given this Access Context Manager policy snippet, what will happen if a user tries to access a resource from IP 203.0.113.5?

accessLevels:
- name: 'accessPolicies/456/accessLevels/levelA'
  basic:
    conditions:
    - ipSubnetworks: ['192.168.0.0/16']
      devicePolicy:
        osConstraints:
        - osType: 'DESKTOP_WINDOWS'
          minimumVersion: '10'

medium

A. Access will be denied because the IP is outside the allowed subnet

B. Access will be allowed because device OS matches

C. Access will be allowed because IP is public

D. Access will be denied because OS version is too low

Solution

1. Step 1: Check IP subnet condition

   The allowed IP subnet is '192.168.0.0/16', which covers private IPs only. The user's IP '203.0.113.5' is public and outside this range.

2. Step 2: Evaluate access decision

   Since IP does not match allowed subnet, access is denied regardless of device OS.

3. Final Answer:

   Access will be denied because the IP is outside the allowed subnet -> Option A

4. Quick Check:

   IP outside allowed subnet = Access denied [OK]

Hint: Check IP subnet first; outside means deny access [OK]

Common Mistakes:

• Ignoring IP subnet and trusting device OS alone
• Assuming public IPs are always allowed
• Confusing IP ranges with device policies

4. You created an Access Level but users report they cannot access resources even when meeting conditions. Which is the most likely error in your Access Context Manager configuration?

medium

A. The device OS version is set too low

B. The Access Level is not attached to any Access Policy

C. The IP subnet range is too broad

D. The Access Level name is missing

Solution

1. Step 1: Understand Access Level usage

   Access Levels must be part of an Access Policy to enforce rules on resources.

2. Step 2: Analyze impact of missing Access Policy attachment

   If Access Level is not attached to any Access Policy, it has no effect, so users cannot access resources despite meeting conditions.

3. Final Answer:

   The Access Level is not attached to any Access Policy -> Option B

4. Quick Check:

   Access Level without policy attachment = no access enforced [OK]

Hint: Access Levels must be linked to Access Policies to work [OK]

Common Mistakes:

• Assuming broad IP ranges cause denial
• Thinking device OS version too low blocks access
• Ignoring the need to attach Access Levels to Policies

5. You want to create a service perimeter that restricts access to a Google Cloud Storage bucket only to users accessing from your corporate network and using compliant devices. Which combination of Access Context Manager components should you configure?

hard

A. Use only IAM roles to restrict access based on user identity and device type

B. Create a firewall rule blocking all external IPs and enable device compliance in IAM roles

C. Create an Access Policy with an Access Level defining IP subnet and device compliance, then apply it in a Service Perimeter around the bucket

D. Configure VPC Service Controls without Access Context Manager components

Solution

1. Step 1: Understand components needed

   Access Context Manager uses Access Policies and Access Levels to define conditions like IP subnet and device compliance.

2. Step 2: Apply conditions with Service Perimeter

   Service Perimeters enforce these Access Levels around resources like Cloud Storage buckets to restrict access accordingly.

3. Final Answer:

   Create an Access Policy with an Access Level defining IP subnet and device compliance, then apply it in a Service Perimeter around the bucket -> Option C

4. Quick Check:

   Access Policy + Access Level + Service Perimeter = A [OK]

Hint: Combine Access Policy, Access Level, and Service Perimeter for resource protection [OK]

Common Mistakes:

• Relying only on firewall or IAM roles without Access Context Manager
• Using VPC Service Controls alone without Access Levels
• Not defining device compliance in Access Levels