Using Google Cloud IAP to create agentless connections

This guide describes how to create an agentless connection to a Linux VM on Google Cloud through Identity-Aware Proxy (IAP). Cyberwatch connects to it over SSH through an IAP tunnel, without the VM needing a public IP address.

Prerequisites

This documentation assumes:

  • A Linux VM on Google Compute Engine
  • A Google Cloud service account
  • Sufficient rights to modify the IAM roles, the firewall rules and the metadata of the project

Google Cloud configuration

Enable OS Login on the VM

Cyberwatch authenticates on the VM with OS Login. Add the enable-oslogin metadata with the value TRUE, on the VM or on the whole project.

If the VM is attached to a service account, add the roles/iam.serviceAccountUser role on the service account of the VM to allow the service account used by Cyberwatch to log in to the machine.

Configure the permissions of the service account

Assign the service account used by Cyberwatch a role with the following two permissions:

compute.instances.osAdminLogin
iap.tunnelInstances.accessViaIAP

Actions in Cyberwatch

Store the credentials

Store the JSON key of the service account from the Stored credentials menu of the sidebar, by clicking on Add and selecting the Google Cloud Platform type.

Add the agentless connection

  1. Click on Assets management > Agentless connections > Add
  2. Select the Google Cloud IAP access protocol
  3. Fill in the Project, the Zone and the VM name
  4. Select the Google Cloud Platform credential set
  5. Click on Save

This type of agentless connection must be authorized in the Administration > Connectors management menu by checking the Google Cloud IAP box.

Details:

  • Only Linux assets are supported
  • The HTTP proxy of the credentials is used for Google API calls, but not for the IAP tunnel: the scanner must be able to reach tunnel.cloudproxy.app directly on TCP 443
  • The SSH connection always goes through port 22 of the first network interface (nic0) of the VM