One of our customers has about 30 VMs in Compute Engine and their team of developers require regular SSH access to 4 instances. Their developers only use the SSH-in-browser from the Google Cloud console rather than their own public keys for access.

What the customer did was assign every developer the role of roles/compute.instanceAdmin.v1 as they couldn't find a narrower role. The unfortunately effect of this is that the developers have admin rights to every instance. This presents a security risk and also opens up potential for mistakes.

My team was tasked to review and recommend a better configuration.

Create custom IAM roles

What I did was create 2 custom IAM roles:

Compute Engine SSH General Role

This role gives the general ability to connect to a VM. It will be granted to the developer at the IAM level. I also added permissions so that the SSH-in-browser can use IAP TCP forwarding.

To allow the developers to conduct connectivity tests in cases when SSH connection doesn't work, as it sometime happens, I added the necessary connectivity test permissions.

The list of assigned permissions are:

iam.serviceAccounts.actAs
iam.serviceAccounts.get
iam.serviceAccounts.list
iap.tunnelDestGroups.accessViaIAP
iap.tunnelInstances.accessViaIAP
networkmanagement.connectivitytests.create
networkmanagement.connectivitytests.delete
networkmanagement.connectivitytests.get
networkmanagement.connectivitytests.getIamPolicy
networkmanagement.connectivitytests.list
networkmanagement.connectivitytests.rerun
networkmanagement.connectivitytests.setIamPolicy
networkmanagement.connectivitytests.update
resourcemanager.projects.get

Compute Engine SSH Instance Role

This role gives the specific ability to connect to a VM and will be granted to the developer at the VM level. It has only one assigned permission:

compute.instances.setMetadata

Assign the roles

Once the 2 custom roles are created, I removed the roles/compute.instanceAdmin.v1 role from the developers and assign these 2 roles instead:

• Viewer
• Compute Engine SSH General Role

This is how the granted roles for a developer looks like:

At this point, the developers are missing the compute.instances.setMetadata permission and if they attempt an SSH connection to a VM, it will fail. To grant SSH-in-browser to any specific VM, just do the following:

• Go to VM instances in Compute Engine.
• Click on the instance and click SHOW INFO PANEL.
• On the permissions tab in the info panel, click on ADD PRINCIPAL.
• Add the developer and select the role Compute Engine SSH Instance Role.

Now the developers can view all VM instances and can connect by SSH to the required instances.