Protect Google Cloud API Access with Teleport

You can use Teleport to manage access to CLI tools that interact with Google Cloud's APIs. This lets you control access to your infrastructure's management APIs using the same RBAC system that you use to protect your infrastructure itself.

The Teleport Application Service manages access to Google Cloud's APIs by proxying requests from CLI applications. The Application Service authenticates these requests using tokens retrieved from Google Cloud. This enables Teleport operators to control the service accounts that users can assume in order to interact with Google Cloud APIs.

The Teleport Application Service connects to the Teleport Proxy Service over a reverse tunnel, so you can run the Application Service in a private network and prevent unauthorized access to your organization's Google Cloud service accounts.

Prerequisites

• A Google Cloud account with permissions to create IAM roles and service accounts, as well as create IAM role bindings for service accounts and projects.

• The gcloud CLI tool. Follow the Google Cloud documentation page to install and authenticate to gcloud.

  While this guide focuses on gcloud, once you set up Google Cloud API access with Teleport, you can also manage access to gsutil and other Google Cloud CLI tools using the Teleport Application Service.

• Either a Google Compute Engine VM where you will run the Teleport Application Service or permissions to create VMs in your Google Cloud project. If you are using a pre-existing VM, it must be running a Linux distribution, and you must have permissions to attach service accounts to Google Compute Engine VMs.

tsh login --proxy=teleport.example.com [email protected]
tctl status
Cluster  teleport.example.com
Version  12.1.1
CA pin   sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678

tsh login --proxy=myinstance.teleport.sh [email protected]
tctl status
Cluster  myinstance.teleport.sh
Version  12.1.2
CA pin   sha256:sha-hash-here

Step 1/4. Configure Google Cloud

The Teleport Application Service needs permissions from Google Cloud to proxy requests from Teleport users to Google Cloud's APIs. In this step, you will configure these permissions before you launch the Teleport Application Service.

When setting up Google Cloud API access with Teleport, you will configure service accounts with two different functions:

• Controlling service account: The Application Service uses this service account to impersonate other service accounts and sign requests to Google Cloud APIs. In this guide, we will create a controlling service account called teleport-google-cloud-cli.
• Target service accounts: These are the service accounts you would like Teleport users in your organization to assume when accessing Google Cloud APIs. In this guide, we will create one target service account, teleport-vm-viewer, and you can follow the same steps to enable access to other target service accounts.

Create a service account for the Application Service

The Application Service uses the controlling service account to access Google Cloud APIs by generating signed tokens for target service accounts, which it uses to sign requests from Teleport users before forwarding them to Google Cloud. This way, local Google Cloud CLI tools have no access to these tokens.

In this section, we will create a controlling service account for the Application Service and assign permissions to it.

Create a service account called teleport-google-cloud-cli:

gcloud iam service-accounts create teleport-google-cloud-cli \  --description="Google Cloud CLI access" \  --display-name="teleport-google-cloud-cli"

Enable your service account to act as other service accounts by assigning it the predefined "Service Account User" role:

gcloud projects add-iam-policy-binding google-cloud-project \   --member="serviceAccount:[email protected]google-cloud-project.iam.gserviceaccount.com" \   --role="roles/iam.serviceAccountUser"

Set up a service account that Teleport users can access

When a Teleport user executes a Google Cloud CLI command against the Teleport Application Service, the Application Service will use the teleport-google-cloud-cli service account we created earlier to impersonate a target service account.

In this section, we will show you how to grant the Application Service permissions to impersonate target service accounts.

Create a service account and enable it to view resources

Create a target service account:

gcloud iam service-accounts create teleport-vm-viewer \  --description="Sample service account to demonstrate Teleport" \  --display-name="teleport-vm-viewer"

Bind this service account to the predefined "Compute Viewer" role, which allows users with the role to list Google Compute Engine resources:

gcloud projects add-iam-policy-binding google-cloud-project \   --member="serviceAccount:[email protected]google-cloud-project.iam.gserviceaccount.com" \   --role="roles/compute.viewer"

Enable teleport-google-cloud-cli to impersonate target service accounts

Enable the teleport-google-cloud-cli service account to impersonate teleport-vm-viewer in order to authenticate user requests. To do so, bind the teleport-google-cloud-cli account to the predefined "Service Account Token Creator Role" for the teleport-vm-viewer service account:

gcloud iam service-accounts add-iam-policy-binding \ [email protected]google-cloud-project.iam.gserviceaccount.com \ --member=serviceAccount:[email protected]google-cloud-project.iam.gserviceaccount.com \  --role="roles/iam.serviceAccountTokenCreator"

Step 2/4. Deploy the Teleport Application Service

At this point, you have created a controlling service account and enabled this service account to impersonate the service accounts you would like Teleport users to access.

In this step, you will attach the controlling service account to a Google Compute Engine VM, then run the Teleport Application Service.

Enable the Application Service to access Google Cloud

Now that you have created a controlling service account and attached a role to it, associate your service account with a virtual machine running the Teleport Application Service. The instructions depend on whether you are using a pre-existing virtual machine for the Teleport Application Service or launching a new one:

gcloud compute instances create teleport-app-service \   --service-account=[email protected]google-cloud-project.iam.gserviceaccount.com \   --scopes=cloud-platform \   --zone=google-cloud-zone \   --image=https://www.googleapis.com/compute/v1/projects/ubuntu-os-cloud/global/images/ubuntu-2210-kinetic-arm64-v20230113

gcloud compute instances stop vm-name --zone=google-cloud-zone

gcloud compute instances set-service-account vm-name \   --service-account [email protected]google-cloud-project.iam.gserviceaccount.com \   --zone google-cloud-zone \   --scopes=cloud-platform

gcloud compute instances start vm-name --zone google-cloud-zone

Get a join token

Establish trust between your Teleport cluster and your new Application Service instance by creating a join token:

tctl nodes add --roles=app
The invite token: abcd123-insecure-do-not-use-this
This token will expire in 30 minutes.
Run this on the new node to join the cluster:
> teleport start \
   --roles=app \
   --token=abcd123-insecure-do-not-use-this \
   --ca-pin=sha256:abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678abdc1245efgh5678 \
   --auth-server=192.0.2.255:3025
Please note:
  - This invitation token will expire in 30 minutes
  - 192.0.2.255:3025 must be reachable from the new node

On the host where you will install the Teleport Application Service, create a file called /tmp/token that consists only of your token:

echo join-token | sudo tee /tmp/token

Install the Teleport Application Service

Follow the instructions below on the host where you will install the Teleport Application Service.

Use the appropriate commands for your environment to install your package.

Download Teleport's PGP public key
sudo curl https://apt.releases.teleport.dev/gpg \-o /usr/share/keyrings/teleport-archive-keyring.asc
Source variables about OS version
source /etc/os-release
Add the Teleport APT repository for v12. You'll need to update this
file for each major release of Teleport.
Note: if using a fork of Debian or Ubuntu you may need to use '$ID_LIKE'
and the codename your distro was forked from instead of '$ID' and '$VERSION_CODENAME'.
Supported versions are listed here: https://github.com/gravitational/teleport/blob/master/build.assets/tooling/cmd/build-os-package-repos/runners.go#L42-L67
echo "deb [signed-by=/usr/share/keyrings/teleport-archive-keyring.asc] \https://apt.releases.teleport.dev/${ID?} ${VERSION_CODENAME?} stable/v12" \| sudo tee /etc/apt/sources.list.d/teleport.list > /dev/null
sudo apt-get update
sudo apt-get install teleport

Source variables about OS version
source /etc/os-release
Add the Teleport YUM repository for v12. You'll need to update this
file for each major release of Teleport.
Note: if using a fork of RHEL/CentOS or Amazon Linux you may need to use '$ID_LIKE'
and the codename your distro was forked from instead of '$ID'
Supported versions are listed here: https://github.com/gravitational/teleport/blob/master/build.assets/tooling/cmd/build-os-package-repos/runners.go#L133-L153
sudo yum-config-manager --add-repo $(rpm --eval "https://yum.releases.teleport.dev/$ID/$VERSION_ID/Teleport/%{_arch}/stable/v12/teleport.repo")
sudo yum install teleport
Tip: Add /usr/local/bin to path used by sudo (so 'sudo tctl users add' will work as per the docs)
echo "Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin" > /etc/sudoers.d/secure_path
Optional:  Use DNF on newer distributions
$ sudo dnf config-manager --add-repo https://rpm.releases.teleport.dev/teleport.repo
$ sudo dnf install teleport

curl https://get.gravitational.com/teleport-v12.1.1-linux-$SYSTEM-ARCH-bin.tar.gz.sha256
<checksum> <filename>
curl -O https://cdn.teleport.dev/teleport-v12.1.1-linux-$SYSTEM-ARCH-bin.tar.gz
shasum -a 256 teleport-v12.1.1-linux-$SYSTEM-ARCH-bin.tar.gz
Verify that the checksums match
tar -xvf teleport-v12.1.1-linux-$SYSTEM-ARCH-bin.tar.gz
cd teleport
sudo ./install

dpkg -i ~/Downloads/teleport-ent_12.1.1_$SYSTEM-ARCH.deb
Selecting previously unselected package teleport-ent.
(Reading database ... 30810 files and directories currently installed.)
Preparing to unpack teleport-ent_12.1.1_$SYSTEM_ARCH.deb ...
Unpacking teleport-ent 12.1.1 ...
Setting up teleport-ent 12.1.1 ...

rpm -i ~/Downloads/teleport-ent-12.1.1.$SYSTEM-ARCH.rpm
warning: teleport-ent-12.1.1.$SYSTEM-ARCH.rpm: Header V4 RSA/SHA512 Signature, key ID 6282c411: NOKEY

curl https://get.gravitational.com/teleport-ent-v12.1.1-linux-$SYSTEM-ARCH-bin.tar.gz.sha256
<checksum> <filename>
curl -O https://cdn.teleport.dev/teleport-ent-v12.1.1-linux-$SYSTEM-ARCH-bin.tar.gz
shasum -a 256 teleport-ent-v12.1.1-linux-$SYSTEM-ARCH-bin.tar.gz
Verify that the checksums match
tar -xvf teleport-ent-v12.1.1-linux-$SYSTEM-ARCH-bin.tar.gz
cd teleport-ent
sudo ./install

curl https://get.gravitational.com/teleport-ent-v12.1.1-linux-$SYSTEM-ARCH-fips-bin.tar.gz.sha256
<checksum> <filename>
curl -O https://cdn.teleport.dev/teleport-ent-v12.1.1-linux-$SYSTEM-ARCH-fips-bin.tar.gz
shasum -a 256 teleport-ent-v12.1.1-linux-$SYSTEM-ARCH-fips-bin.tar.gz
Verify that the checksums match
tar -xvf teleport-ent-v12.1.1-linux-$SYSTEM-ARCH-fips-bin.tar.gz
cd teleport-ent
sudo ./install

Configure the Teleport Application Service

On the host where you will run the Teleport Application Service, create a file at /etc/teleport.yaml with the following content:

version: v3
teleport:
  join_params:
    token_name: "/tmp/token"
    method: token
  proxy_server: "teleport.example.com:443"
auth_service:
  enabled: off
proxy_service:
  enabled: off
ssh_service:
  enabled: off
app_service:
  enabled: true
  apps:
  - name: google-cloud-cli
    cloud: GCP

Edit /etc/teleport.yaml to replace teleport.example.com:443 with the host and port of your Teleport Proxy Service or Teleport Cloud tenant, e.g., mytenant.teleport.sh:443.

The app_service field configures the Teleport Application Service. Each item within app_service.apps is an application configuration.

In the example above, we have enabled Google Cloud CLI access by registering an application called google-cloud-cli with the cloud field set to GCP. The Teleport Application Service will forward requests to this application to Google Cloud.

Run the Teleport Application Service

On the host where you will run the Teleport Application Service, execute the following command, depending on whether you installed Teleport using a package manager or via a TAR archive:

sudo systemctl start teleport

sudo teleport install systemd --output=/etc/systemd/system/teleport.service;
sudo systemctl enable teleport;
sudo systemctl start teleport;

Step 3/4. Enable your user to access Google Cloud CLIs

The next step is to authorize your Teleport user to access a target service account and execute Google Cloud CLI commands via Teleport. You will protect access to the service account using Teleport's RBAC system, where a user's roles determine which Google Cloud service accounts (if any) they can access.

There are two approaches you can take to authorize users to access Google Cloud service accounts:

kind: role
version: v6
metadata:
  name: google-cloud-cli-access
spec:
  allow:
    app_labels:
      '*': '*'
    gcp_service_accounts:
      - '{{internal.gcp_service_accounts}}'

tctl users update teleport-user \--set-gcp-service-accounts [email protected]google-cloud-project.iam.gserviceaccount.com

tctl create -f google-cloud-cli-access.yaml

/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/RESOURCE_GROUP_NAME/providers/Microsoft.ManagedIdentity/userAssignedIdentities/IDENTITY_NAME

[email protected]

kind: role
version: v6
metadata:
  name: google-cloud-cli-access
spec:
  allow:
    app_labels:
      '*': '*'
    gcp_service_accounts:
      - '{{external.gcp_service_accounts}}'

tctl create -f google-cloud-cli-access

kind: role
version: v6
metadata:
  name: google-cloud-cli-access
spec:
  allow:
    app_labels:
      '*': '*'
    gcp_service_accounts:
      - [email protected]

tctl create -f google-cloud-cli-access.yaml

kind: role
version: v6
metadata:
  name: "no-google-cloud"
spec:
  allow:
    app_labels:
      '*': '*'
  deny:
    gcp_service_accounts:
      - '*'

Assign the google-cloud-cli-access role to your Teleport user by running the following commands, depending on whether you authenticate as a local Teleport user or via the github, saml, or oidc authentication connectors:

tctl get users/$(tsh status -f json | jq -r '.active.username') > out.yaml

  roles:
   - access
   - auditor
   - editor
+  - google-cloud-cli-access

tctl create -f out.yaml

tctl get github/github --with-secrets > github.yaml

  teams_to_roles:
    - organization: octocats
      team: admins
      roles:
        - access
+       - google-cloud-cli-access

tctl create -f github.yaml

tctl get --with-secrets saml/mysaml > saml.yaml

  attributes_to_roles:
    - name: "groups"
      value: "my-group"
      roles:
        - access
+       - google-cloud-cli-access

tctl create -f saml.yaml

tctl get oidc/myoidc --with-secrets > oidc.yaml

  claims_to_roles:
    - name: "groups"
      value: "my-group"
      roles:
        - access
+       - google-cloud-cli-access

tctl create -f saml.yaml

Log out of your Teleport cluster and log in again to assume the new role.

Step 4/4. Use Google Cloud CLIs with Teleport

Now that you have started the Teleport Application Service and authorized your Teleport user to access Google Cloud CLIs, you can run Google Cloud CLI commands through Teleport.

List your Google Cloud CLI application

Verify that your Teleport user can see the google-cloud-cli application you registered earlier:

tsh apps ls
Application      Description Type Public Address                        Labels
---------------- ----------- ---- ------------------------------------- -------------------
google-cloud-cli             HTTP google-cloud-cli.teleport.example.com teleport.dev/origin

Log in to use a Google Cloud CLI

Log in to the application, specifying that you would like to assume the teleport-vm-viewer service account:

tsh apps login google-cloud-cli --gcp-service-account teleport-vm-viewer

This command validates the value of the --gcp-service-account flag against the ones the user is authorized to assume. The value of the flag can either be the full URI of the service account or the name of the identity, e.g., teleport-vm-viewer.

A user can omit the --gcp-service-account flag if they are only authorized to access a single Google Cloud service account, but otherwise an empty --gcp-service-account flag will result in an error.

If the command succeeds, you will see information about the user's chosen Google Cloud service account similar to the following:

Logged into GCP app "google-cloud-cli".
Your service account: [email protected]
Example command: tsh gcloud compute instances list

Execute Google Cloud CLI commands

At this point, you can run gcloud commands using the Teleport Application Service by prefixing them with tsh. Since your user authenticated to your Google Cloud CLI application with a service account that can list VMs, for example, run this command to do so:

tsh gcloud compute instances list

You should see a list of virtual machines in your Google Cloud project.

However, your Teleport user cannot create a VM, since its service account does not have this authorization:

tsh gcloud compute instances create another-instance --zone=google-cloud-zone
ERROR: (gcloud.compute.instances.create) Could not fetch resource:
 - Required 'compute.instances.create' permission for 'projects/my-project/zones/my-zone/instances/another-instance'
ERROR: exit status 1

tsh gsutil ls

Use Google Cloud CLI applications without tsh

In addition to running gcloud and gsutil commands via tsh, you can grant secure access to any CLI application that executes commands against Google Cloud's APIs.

To do this, use tsh to start a local proxy that forwards traffic from your CLI application to the Teleport Application Service. The Application Service uses the teleport-google-cloud-cli service account we created earlier to fetch an authentication token from Google Cloud. Your CLI application uses this token to authenticate requests to Google Cloud's APIs.

To start the local proxy, run the following tsh command:

tsh proxy gcloud

The command will print the address of the local proxy server along with export commands for assigning environment variables. Google Cloud CLI applications read these variables in order to request an authentication token for Google Cloud's APIs:

Started GCP proxy on http://127.0.0.1:50614.
To avoid port randomization, you can choose the listening port using the --port flag.

Use the following credentials and HTTPS proxy setting to connect to the proxy:

  export BOTO_CONFIG=/Users/myuser/.tsh/gcp/teleport.example.com/google-cloud-cli/00000000_boto.cfg
  export CLOUDSDK_AUTH_ACCESS_TOKEN=00000000000000000000000000000000
  export CLOUDSDK_CONFIG=/Users/myuser/.tsh/gcp/teleport.example.com/google-cloud-cli/gcloud
  export CLOUDSDK_CORE_CUSTOM_CA_CERTS_FILE=/Users/myuser/.tsh/keys/teleport.example.com/myuser-google-cloud-cli/teleport.example.com/google-cloud-cli-localca.pem
  export CLOUDSDK_CORE_PROJECT=my-project
  export HTTPS_PROXY=http://127.0.0.1:50614

Copy the export commands and paste them into a second terminal. In that terminal, you can now run your Google Cloud CLI application of choice. For example, you can run the following command to list Google Compute Engine VMs:

gcloud compute instances list

Recall that you could run gcloud iam service-accounts create in a shell earlier in this guide. After you enter the export commands printed by tsh proxy gcloud, this command runs as a restricted user, resulting in authorization issues:

gcloud iam service-accounts create demo-service-account
ERROR: (gcloud.iam.service-accounts.create) User [myuser] does not have permission to access projects instance [myproject] (or it may not exist): Permission 'iam.serviceAccounts.create' denied on resource (or it may not exist).
- '@type': type.googleapis.com/google.rpc.ErrorInfo
  domain: iam.googleapis.com
  metadata:
    permission: iam.serviceAccounts.create
  reason: IAM_PERMISSION_DENIED

Next steps

• Now that you know how to protect access to Google Cloud CLIs using Teleport, ensure that your Teleport users can only manage Google Cloud resources temporarily, with no longstanding admin roles for attackers to hijack. View our documentation on Role Access Requests and Access Request plugins.
• You can proxy any gcloud or gsutil command via Teleport. For a full reference of commands, view the Google Cloud documentation for gcloud and gsutil.