Build a Secure Google Cloud Network

GSP322 — Build a Secure Google Cloud Network: Challenge Lab

Estimated time: 1 hour 15 minutes

# 🚀 Build a Secure Google Cloud Network: Challenge Lab > ⚠️ **Disclaimer:** This guide is provided for educational and learning purposes only. It is intended to help you understand Google Cloud networking, VPC firewall rules, network tags, VM instance configuration, SSH access, and secure network validation while practicing for Google Cloud certifications and hands-on Challenge Labs. Always follow the official Google Cloud and Google Cloud Skills Boost/Qwiklabs instructions and applicable term

clear
CYAN=$(tput setaf 6)
BOLD=$(tput bold)
RESET=$(tput sgr0)
GREEN=$(tput setaf 2)
YELLOW=$(tput setaf 3)
RED=$(tput setaf 1)

echo "${CYAN}${BOLD}"
echo "   ____       _     _ _            __   ___             "
echo "  / __ \     | |   (_) |          / _| / _ \            "
echo " | |  | |_ __| |__  _| |_   ___  | |_ | | | |_ __  ___  "
echo " | |  | | '__| '_ \| | __| / _ \ |  _|| | | | '_ \/ __| "
echo " | |__| | |  | |_) | | |_ | (_) || |  | |_| | |_) \__ \ "
echo "  \____/|_|  |_.__/|_|\__| \___/ |_|   \___/| .__/|___/ "
echo "                                            | |         "
echo "                                            |_|         "
echo "${RESET}"
echo "${CYAN}====================================================${RESET}"
echo "${GREEN}${BOLD}Command 1 of 2: Infrastructure Baseline & Bastion${RESET}"
echo "${CYAN}====================================================${RESET}"
echo ""

echo "${YELLOW}Auto-detecting Zone...${RESET}"
export ZONE=$(gcloud compute instances list --filter="name=juice-shop" --format="value(zone)" --limit=1)
if [[ -z "$ZONE" ]]; then
    read -p "⚠️ Could not auto-detect zone. Enter the lab Zone (e.g., us-east1-c): " ZONE
fi
gcloud config set compute/zone $ZONE --quiet
echo "${GREEN}✔ Zone Linked: $ZONE${RESET}"
echo ""

echo "${RED}${BOLD}⚠️ PAUSE: Please check your lab instructions and copy the exact network tags. ⚠️${RESET}"
read -p "Enter the 'SSH IAP network tag' (for Bastion): " IAP_NETWORK_TAG
read -p "Enter the 'HTTP network tag' (for Juice-Shop): " HTTP_NETWORK_TAG
read -p "Enter the 'SSH internal network tag' (for Juice-Shop): " INTERNAL_NETWORK_TAG
echo ""

echo "${YELLOW}Task 1: Removing the overly permissive 'open-access' firewall rule...${RESET}"
gcloud compute firewall-rules delete open-access --quiet 2>/dev/null || true

echo "${YELLOW}Task 2: Starting the Bastion host instance...${RESET}"
gcloud compute instances start bastion --zone=$ZONE --quiet

echo "${YELLOW}Task 3: Creating SSH IAP firewall rule...${RESET}"
gcloud compute firewall-rules create ssh-ingress --allow=tcp:22 --source-ranges=35.235.240.0/20 --target-tags=$IAP_NETWORK_TAG --network=acme-vpc --quiet

echo "${YELLOW}Task 3: Tagging Bastion with IAP tag...${RESET}"
gcloud compute instances add-tags bastion --tags=$IAP_NETWORK_TAG --zone=$ZONE --quiet

echo "${GREEN}Command 1 Complete. Pausing 10 seconds for VM boot sequence...${RESET}"
sleep 10

CYAN=$(tput setaf 6)
GREEN=$(tput setaf 2)
YELLOW=$(tput setaf 3)
BOLD=$(tput bold)
RESET=$(tput sgr0)

echo "${CYAN}====================================================${RESET}"
echo "${GREEN}${BOLD}Command 2 of 2: Juice-Shop Security & Validation${RESET}"
echo "${CYAN}====================================================${RESET}"

echo "${YELLOW}Task 4: Creating HTTP firewall rule for Juice-Shop...${RESET}"
gcloud compute firewall-rules create http-ingress --allow=tcp:80 --source-ranges=0.0.0.0/0 --target-tags=$HTTP_NETWORK_TAG --network=acme-vpc --quiet

echo "${YELLOW}Task 4: Tagging Juice-Shop for HTTP access...${RESET}"
gcloud compute instances add-tags juice-shop --tags=$HTTP_NETWORK_TAG --zone=$ZONE --quiet

echo "${YELLOW}Task 5: Creating internal SSH firewall rule (Bastion -> Juice-Shop)...${RESET}"
gcloud compute firewall-rules create internal-ssh-ingress --allow=tcp:22 --source-ranges=192.168.10.0/24 --target-tags=$INTERNAL_NETWORK_TAG --network=acme-vpc --quiet

echo "${YELLOW}Task 5: Tagging Juice-Shop for internal SSH...${RESET}"
gcloud compute instances add-tags juice-shop --tags=$INTERNAL_NETWORK_TAG --zone=$ZONE --quiet

echo "${GREEN}Waiting 30 seconds for networking rules and SSH keys to propagate...${RESET}"
sleep 30

echo "${YELLOW}Task 6: Validating SSH Hop (Cloud Shell -> Bastion -> Juice-Shop)...${RESET}"
gcloud compute ssh bastion --zone=$ZONE --tunnel-through-iap --quiet --command="gcloud compute ssh juice-shop --zone=$ZONE --internal-ip --quiet --command='echo Successfully hopped from Bastion to Juice-Shop'"

echo ""
echo "${GREEN}${BOLD}🎉 AUTOMATION COMPLETED SUCCESSFULLY 🎉${RESET}"
echo "${CYAN}You can now safely click ALL 'Check my progress' buttons in your lab manual.${RESET}"