Access Context Manager in GCP - Step-by-Step Execution

Process Flow - Access Context Manager

Define Access Levels

↓

Create Access Policy

↓

Assign Access Levels to Policy

↓

Apply Policy to Resources

↓

User Requests Access

↓

Check Access Context

Yes No↓

Grant Access

Access Context Manager lets you define rules (access levels) and group them into policies. When a user tries to access a resource, the system checks these rules to allow or deny access.

Execution Sample

GCP

1. Define access level: IP range 192.168.1.0/24
2. Create access policy: "Office Access"
3. Add access level to policy
4. Apply policy to Cloud Storage bucket
5. User tries to access bucket

This example shows creating an access level for a specific IP range, grouping it into a policy, applying it to a resource, and then a user attempting access.

Process Table

Step	Action	Input/Condition	Result/Output
1	Define Access Level	IP range 192.168.1.0/24	Access level created with IP restriction
2	Create Access Policy	Name: Office Access	Access policy created
3	Add Access Level to Policy	Access level: IP range 192.168.1.0/24	Access level linked to policy
4	Apply Policy to Resource	Resource: Cloud Storage bucket	Policy applied to bucket
5	User Access Request	User IP: 192.168.1.15	Check access context
6	Evaluate Access Context	User IP in allowed range?	Yes
7	Access Decision	Access context valid	Access granted
8	User Access Request	User IP: 10.0.0.5	Check access context
9	Evaluate Access Context	User IP in allowed range?	No
10	Access Decision	Access context invalid	Access denied

💡 Execution stops after access decision is made for each user request.

Status Tracker

Variable	Start	After Step 1	After Step 3	After Step 4	After Step 6	After Step 9	Final
Access Level	None	IP range 192.168.1.0/24	Linked to policy	Linked to policy	Checked for user IP	Checked for user IP	Used for access decision
Access Policy	None	None	Created: Office Access	Applied to bucket	Applied to bucket	Applied to bucket	Used for access decision
User IP	None	None	None	None	192.168.1.15	10.0.0.5	Evaluated for access

Key Moments - 2 Insights

Why does the user with IP 10.0.0.5 get denied access?

Because the access level only allows IPs in 192.168.1.0/24 range. Step 9 shows the IP is outside this range, so access is denied at step 10.

What happens if no access policy is applied to a resource?

Without a policy, Access Context Manager does not restrict access, so users are not checked against access levels. This means access is not controlled by context.

Visual Quiz - 3 Questions

Look at the execution table, what is the result at Step 7 when user IP is 192.168.1.15?

A Access denied

B Access granted

C Access level created

D Policy applied

💡 Hint

Check Step 7 in execution_table where user IP is in allowed range.

At which step does the system check if the user IP is within the allowed range?

A Step 6

B Step 5

C Step 8

D Step 10

💡 Hint

Look for 'Evaluate Access Context' in execution_table.

If the access level allowed all IPs, how would Step 9 change for user IP 10.0.0.5?

A Access policy would be deleted

B User IP would be outside allowed range

C User IP would be inside allowed range

D User access request would be denied immediately

💡 Hint

Consider how access level IP range affects evaluation in Step 9.

Concept Snapshot

Access Context Manager controls resource access by defining access levels (rules like IP ranges).
These levels are grouped into access policies.
Policies are applied to resources.
When a user requests access, their context (e.g., IP) is checked against policies.
Access is granted only if context matches policy rules.

Full Transcript

Access Context Manager in Google Cloud lets you set rules called access levels, such as allowing only certain IP addresses. You group these levels into access policies and apply them to resources like storage buckets. When a user tries to access a resource, the system checks if their context, like their IP address, matches the rules. If it matches, access is granted; if not, access is denied. This helps keep your cloud resources safe by controlling who can reach them based on conditions you set.