Restrict the Creation of Cloud Resources to Specific Locations

​

More Info:

Ensure that “Google Cloud Platform - Resource Location Restriction” constraint policy is enforced for your GCP organizations.

​

Risk Level

Medium

​

Address

Operational Maturity, Reliability, Security

​

Compliance Standards

CBP

​

Remediation

​

Using Console

To restrict the creation of cloud resources to specific locations in GCP, you can follow these steps:

1. Open the GCP console and navigate to the IAM & admin page.
2. Select the project for which you want to restrict the creation of cloud resources.
3. Click on the “Edit” button next to the “Service Accounts” section.
4. Locate the service account that you want to restrict and click on the “Edit” button next to it.
5. Scroll down to the “Service Account Permissions” section and click on the “Add Another” button.
6. In the “Add Permission” dialog box, select “Cloud Resource Manager API” from the “Select a service” dropdown menu.
7. In the “Select a role” dropdown menu, select “Cloud Resource Manager Editor” or “Cloud Resource Manager Viewer” depending on the level of access you want to grant.
8. In the “Select a resource” dropdown menu, select “All resources in the selected project”.
9. In the “Condition” section, click on the “Add Condition” button.
10. In the “Add Condition” dialog box, select “Location” from the “Attribute” dropdown menu.
11. In the “Operator” dropdown menu, select “is not one of”.
12. In the “Value” field, enter the list of allowed locations separated by commas (e.g. us-central1, us-west1, europe-west1).
13. Click on the “Save” button to save the changes.

By following these steps, you have restricted the creation of cloud resources to specific locations in GCP. Any attempt to create resources outside of the allowed locations will be denied.

​

Using CLI

To restrict the creation of cloud resources to specific locations in GCP, you can follow these steps using the GCP CLI:

1. Open the GCP Cloud Shell by clicking on the icon in the top right-hand corner of the GCP console.

2. In the Cloud Shell, enter the following command to list the current organization policy constraints:

   gcloud resource-manager org-policies list
   

3. Identify the policy constraint that needs to be updated to restrict the creation of cloud resources to specific locations.

4. Enter the following command to get the details of the policy constraint:

   gcloud resource-manager org-policies describe [CONSTRAINT]
   

   Replace [CONSTRAINT] with the name of the policy constraint.

5. Determine the locations to which you want to restrict the creation of cloud resources.

6. Enter the following command to update the policy constraint to restrict the creation of cloud resources to the specified locations:

   gcloud resource-manager org-policies update [CONSTRAINT] \
   --enforced-list=locations/[LOCATION1],locations/[LOCATION2],...
   

   Replace [CONSTRAINT] with the name of the policy constraint and [LOCATION1], [LOCATION2], etc. with the locations to which you want to restrict the creation of cloud resources.

7. Verify that the policy constraint has been updated by entering the following command:

   gcloud resource-manager org-policies describe [CONSTRAINT]
   

   Replace [CONSTRAINT] with the name of the policy constraint.

Once these steps are completed, the creation of cloud resources will be restricted to the specified locations in GCP.

​

Using Python

To restrict the creation of cloud resources to specific locations in GCP using Python, you can follow these steps:

1. First, you need to set up a GCP project and install the necessary Python libraries. You can use the google-cloud-resource-manager library to manage GCP resources.

2. Next, you need to create a configuration file that specifies the allowed locations where resources can be created. For example, you can create a config.yaml file that looks like this:

allowed_locations:
  - us-central1
  - us-east1
  - europe-west1

3. In your Python script, you can read the configuration file and use it to validate the location of the resources being created. Here’s an example code snippet:

import yaml
from google.cloud import resource_manager

# Read the configuration file
with open('config.yaml', 'r') as f:
    config = yaml.safe_load(f)

# Initialize the resource manager client
client = resource_manager.Client()

# Define a function to validate the location of a resource
def validate_location(resource_type, location):
    if location not in config['allowed_locations']:
        raise ValueError(f"Cannot create {resource_type} in location {location}. Allowed locations are: {', '.join(config['allowed_locations'])}")

# Example usage: create a new GCE instance
instance = client.compute.instances().insert(
    project='my-project',
    zone='us-central1-a',
    body={
        'name': 'my-instance',
        'machineType': 'n1-standard-1',
        'disks': [{
            'boot': True,
            'autoDelete': True,
            'initializeParams': {
                'sourceImage': 'projects/debian-cloud/global/images/family/debian-10',
            }
        }],
        'networkInterfaces': [{
            'network': 'global/networks/default',
            'accessConfigs': [{
                'type': 'ONE_TO_ONE_NAT',
                'name': 'External NAT'
            }]
        }],
    }
).execute()

# Validate the location of the new instance
validate_location('GCE instance', instance['zone'].split('/')[-1])

4. You can repeat this validation for other types of resources as well, such as GCS buckets or Cloud Functions.

By following these steps, you can ensure that your GCP resources are only created in allowed locations, which can help prevent misconfigurations and improve the security of your cloud environment.