Build a Secure Google Cloud Network

GSP322 — Build a Secure Google Cloud Network: Challenge Lab

Estimated time: 1 hour 15 minutes

# 🚀 Build a Secure Google Cloud Network: Challenge Lab > ⚠️ **Disclaimer:** This guide is provided for educational and learning purposes only. It is intended to help you understand Google Cloud networking, VPC firewall rules, network tags, VM instance configuration, SSH access, and secure network validation while practicing for Google Cloud certifications and hands-on Challenge Labs. Always follow the official Google Cloud and Google Cloud Skills Boost/Qwiklabs instructions and applicable term

#!/bin/bash

clear

# ==============================================================================
# Color Variables & Orbit of Ops Branding
# ==============================================================================
RED='\e[1;31m'
GREEN='\e[1;32m'
YELLOW='\e[1;33m'
BLUE='\e[1;34m'
MAGENTA='\e[1;35m'
CYAN='\e[1;36m'
WHITE='\e[1;37m'
BOLD='\e[1m'
RESET='\e[0m'

echo -e "${CYAN}${BOLD}"
cat << "EOF"
  ____       _     _ _            __    ___            
 / __ \     | |   (_) |          / _|  / _ \           
| |  | |_ __| |__  _| |_   ___  | |_  | | | |_ __  ___ 
| |  | | '__| '_ \| | __| / _ \ |  _| | | | | '_ \/ __|
| |__| | |  | |_) | | |_ | (_) || |   | |_| | |_) \__ \
 \____/|_|  |_.__/|_|\__| \___/ |_|    \___/| .__/|___/
                                            | |        
                                            |_|        
EOF
echo -e "${RESET}"
echo -e "${MAGENTA}${BOLD} 🚀 Starting Orbit of Ops Master Execution (GSP322)... ${RESET}"
echo -e "${BLUE}--------------------------------------------------------------------------------${RESET}\n"

# ==============================================================================
# PRE-FLIGHT CHECKS & VARIABLES (DYNAMIC AUTO-FETCH)
# ==============================================================================
echo -e "${BOLD}${YELLOW}[Orbit of Ops] Auto-fetching Project and Zone...${RESET}"

export PROJECT_ID=$(gcloud config get-value project 2>/dev/null)
if [[ -z "$PROJECT_ID" ]]; then
    export PROJECT_ID=$DEVSHELL_PROJECT_ID
fi

export ZONE=$(gcloud compute instances list --filter="name=juice-shop" --format="value(zone)" --limit=1 2>/dev/null)

if [[ -z "$ZONE" ]]; then
    echo -e "${BOLD}${RED}⚠️ Could not auto-detect the default zone via gcloud metadata.${RESET}"
    echo -ne "${BOLD}${CYAN}Please enter the lab Zone (e.g., us-east1-c): ${RESET}"
    read ZONE
    export ZONE
fi

gcloud config set compute/zone $ZONE 2>/dev/null

echo -e "✅ Project ID: ${GREEN}$PROJECT_ID${RESET}"
echo -e "✅ Zone:       ${GREEN}$ZONE${RESET}\n"
echo -e "${BLUE}--------------------------------------------------------------------------------${RESET}\n"

# ==============================================================================
# USER INPUT
# ==============================================================================
echo -e "${BOLD}${YELLOW}⚠️ ATTENTION: Check your lab instructions for the following network tags: ${RESET}"

echo -ne "${BOLD}${CYAN}Enter the SSH IAP network tag (for the bastion): ${RESET}"
read IAP_NETWORK_TAG

echo -ne "${BOLD}${CYAN}Enter the HTTP network tag (for juice-shop): ${RESET}"
read HTTP_NETWORK_TAG

echo -ne "${BOLD}${CYAN}Enter the SSH internal network tag (for juice-shop): ${RESET}"
read INTERNAL_NETWORK_TAG

echo -e "\n${BLUE}--------------------------------------------------------------------------------${RESET}\n"

# ==============================================================================
# MAIN SCRIPT EXECUTION
# ==============================================================================

echo -e "${BOLD}${CYAN}[Orbit of Ops] Task 1: Removing the overly permissive default rule...${RESET}"
gcloud compute firewall-rules delete open-access --quiet

echo -e "\n${BOLD}${CYAN}[Orbit of Ops] Task 2: Starting the bastion host instance...${RESET}"
gcloud compute instances start bastion --zone=$ZONE --quiet

echo -e "\n${BOLD}${CYAN}[Orbit of Ops] Task 3: Creating SSH IAP firewall rule and tagging Bastion...${RESET}"
gcloud compute firewall-rules create ssh-ingress \
  --allow=tcp:22 \
  --source-ranges 35.235.240.0/20 \
  --target-tags $IAP_NETWORK_TAG \
  --network acme-vpc \
  --quiet

gcloud compute instances add-tags bastion \
  --tags=$IAP_NETWORK_TAG \
  --zone=$ZONE \
  --quiet

echo -e "\n${BOLD}${CYAN}[Orbit of Ops] Task 4: Creating HTTP firewall rule and tagging Juice-Shop...${RESET}"
gcloud compute firewall-rules create http-ingress \
  --allow=tcp:80 \
  --source-ranges 0.0.0.0/0 \
  --target-tags $HTTP_NETWORK_TAG \
  --network acme-vpc \
  --quiet

gcloud compute instances add-tags juice-shop \
  --tags=$HTTP_NETWORK_TAG \
  --zone=$ZONE \
  --quiet

echo -e "\n${BOLD}${CYAN}[Orbit of Ops] Task 5: Creating internal SSH firewall rule and tagging Juice-Shop...${RESET}"
gcloud compute firewall-rules create internal-ssh-ingress \
  --allow=tcp:22 \
  --source-ranges 192.168.10.0/24 \
  --target-tags $INTERNAL_NETWORK_TAG \
  --network acme-vpc \
  --quiet

gcloud compute instances add-tags juice-shop \
  --tags=$INTERNAL_NETWORK_TAG \
  --zone=$ZONE \
  --quiet

echo -e "\n${BOLD}${YELLOW}⏳ Waiting 45 seconds for Bastion to fully boot and propagate SSH keys...${RESET}"
sleep 45

echo -e "\n${BOLD}${CYAN}[Orbit of Ops] Task 6: Validating SSH Hop (Bastion -> Juice-Shop)...${RESET}"
gcloud compute ssh bastion \
  --zone=$ZONE \
  --tunnel-through-iap \
  --quiet \
  --command="gcloud compute ssh juice-shop --zone=$ZONE --internal-ip --quiet --command='echo Successfully hopped from Bastion to Juice-Shop'"

# ==============================================================================
# COMPLETION
# ==============================================================================
echo -e "\n${MAGENTA}${BOLD}╔════════════════════════════════════════════════════════════╗${RESET}"
echo -e "${MAGENTA}${BOLD}║            🎉 AUTOMATION COMPLETED SUCCESSFULLY 🎉           ║${RESET}"
echo -e "${MAGENTA}${BOLD}╚════════════════════════════════════════════════════════════╝${RESET}"
echo -e "${GREEN}${BOLD}You can now safely click ALL 'Check my progress' buttons in your lab manual.${RESET}"
echo -e "${CYAN}${BOLD}Subscribe to Orbit of Ops: https://www.youtube.com/@orbitofops/videos${RESET}\n"