Implement Cloud Security Fundamentals on Google Cloud

GSP342 — Implement Cloud Security Fundamentals on Google Cloud: Challenge Lab

Estimated time: 1 hour 45 minutes

# 🚀 Implement Cloud Security Fundamentals on Google Cloud > ⚠️ **Disclaimer:** This guide is provided for educational and learning purposes only. It is intended to help you understand Google Cloud security concepts, IAM configuration, private GKE environments, service accounts, permissions, and secure deployment workflows while preparing for Google Cloud certifications and hands-on labs. Always follow the official Google Cloud documentation, Qwiklabs/Google Cloud Skills Boost instructions, and

clear
CYAN='\e[1;36m'
BLUE='\e[1;34m'
RESET='\e[0m'
BOLD='\e[1m'
GREEN='\e[1;32m'
YELLOW='\e[1;33m'
WHITE='\e[1;37m'

echo -e "${CYAN}${BOLD}"
cat << "EOF"
  ____       _     _ _    ___   __  ___
 / __ \     | |   (_) |  / _ \ / _|/ _ \
| |  | |_ __| |__  _| |_| | | | |_| | | |_ __  ___
| |  | | '__| '_ \| | __| | | |  _| | | | '_ \/ __|
| |__| | |  | |_) | | |_| |_| | | | |_| | |_) \__ \
 \____/|_|  |_.__/|_|\__|\___/|_|  \___/| .__/|___/
                                        | |
                                        |_|
EOF
echo -e "${RESET}"
echo -e "${BLUE}${BOLD}╔════════════════════════════════════════════════════════════╗${RESET}"
echo -e "${BLUE}${BOLD}║   🚀 BROUGHT TO YOU BY ORBIT OF OPS (PART 1)               ║${RESET}"
echo -e "${BLUE}${BOLD}╚════════════════════════════════════════════════════════════╝${RESET}\n"

export PROJECT_ID=$(gcloud config get-value project 2>/dev/null)
export ZONE=$(gcloud compute project-info describe --format="value(commonInstanceMetadata.items[google-compute-default-zone])" 2>/dev/null | tail -n 1)

echo -e "${YELLOW}${BOLD}Please enter the exact names from your Qwiklabs instructions panel:${RESET}"
read -p "$(echo -e ${WHITE}Task 1: Enter Custom Security Role Name: ${RESET})" CUSTOM_ROLE
read -p "$(echo -e ${WHITE}Task 2: Enter Service Account Name: ${RESET})" S_A
read -p "$(echo -e ${WHITE}Task 4: Enter Cluster Name: ${RESET})" CLUSTER_NAME

export CUSTOM_ROLE
export S_A
export CLUSTER_NAME
export SA_EMAIL="$S_A@$PROJECT_ID.iam.gserviceaccount.com"

echo -e "\n${CYAN}${BOLD}[Task 1] Creating Custom Security Role...\033[0m"
cat > role-definition.yaml <<EOF_END
title: "$CUSTOM_ROLE"
description: "Permissions for Orca Storage"
stage: "ALPHA"
includedPermissions:
- storage.buckets.get
- storage.objects.get
- storage.objects.list
- storage.objects.update
- storage.objects.create
EOF_END
gcloud iam roles create $CUSTOM_ROLE --project $PROJECT_ID --file role-definition.yaml --quiet

echo -e "\n${CYAN}${BOLD}[Task 2] Creating Service Account...\033[0m"
gcloud iam service-accounts create $S_A --display-name "Orca Private Cluster Service Account"

echo -e "\n${CYAN}${BOLD}[Task 3] Binding Roles (Waiting 5s for IAM to sync)...\033[0m"
sleep 5
gcloud projects add-iam-policy-binding $PROJECT_ID --member="serviceAccount:$SA_EMAIL" --role="roles/monitoring.viewer" --quiet
gcloud projects add-iam-policy-binding $PROJECT_ID --member="serviceAccount:$SA_EMAIL" --role="roles/monitoring.metricWriter" --quiet
gcloud projects add-iam-policy-binding $PROJECT_ID --member="serviceAccount:$SA_EMAIL" --role="roles/logging.logWriter" --quiet
gcloud projects add-iam-policy-binding $PROJECT_ID --member="serviceAccount:$SA_EMAIL" --role="projects/$PROJECT_ID/roles/$CUSTOM_ROLE" --quiet

echo -e "\n${GREEN}${BOLD}✅ Tasks 1, 2, and 3 are complete! Click 'Check my progress' for them.${RESET}"

clear
CYAN='\e[1;36m'
BLUE='\e[1;34m'
RESET='\e[0m'
BOLD='\e[1m'
GREEN='\e[1;32m'
YELLOW='\e[1;33m'

echo -e "${CYAN}${BOLD}"
cat << "EOF"
  ____       _     _ _    ___   __  ___
 / __ \     | |   (_) |  / _ \ / _|/ _ \
| |  | |_ __| |__  _| |_| | | | |_| | | |_ __  ___
| |  | | '__| '_ \| | __| | | |  _| | | | '_ \/ __|
| |__| | |  | |_) | | |_| |_| | | | |_| | |_) \__ \
 \____/|_|  |_.__/|_|\__|\___/|_|  \___/| .__/|___/
                                        | |
                                        |_|
EOF
echo -e "${RESET}"
echo -e "${BLUE}${BOLD}╔════════════════════════════════════════════════════════════╗${RESET}"
echo -e "${BLUE}${BOLD}║   🚀 BROUGHT TO YOU BY ORBIT OF OPS (PART 2)               ║${RESET}"
echo -e "${BLUE}${BOLD}╚════════════════════════════════════════════════════════════╝${RESET}\n"

echo -e "${CYAN}${BOLD}[Task 4] Creating Private GKE Cluster...\033[0m"
export JUMPHOST_IP=$(gcloud compute instances describe orca-jumphost --zone=$ZONE --format='get(networkInterfaces[0].networkIP)')
echo -e "${YELLOW}Detected Jumphost IP for Master Authorized Network: $JUMPHOST_IP${RESET}"

gcloud container clusters create $CLUSTER_NAME \
    --zone=$ZONE \
    --num-nodes=1 \
    --master-ipv4-cidr=172.16.0.64/28 \
    --network=orca-build-vpc \
    --subnetwork=orca-build-subnet \
    --enable-master-authorized-networks \
    --master-authorized-networks=$JUMPHOST_IP/32 \
    --enable-ip-alias \
    --enable-private-nodes \
    --enable-private-endpoint \
    --service-account=$SA_EMAIL \
    --quiet

echo -e "\n${GREEN}${BOLD}✅ Task 4 is complete! Click 'Check my progress'.${RESET}"

clear
CYAN='\e[1;36m'
BLUE='\e[1;34m'
RESET='\e[0m'
BOLD='\e[1m'
GREEN='\e[1;32m'
MAGENTA='\e[1;35m'

echo -e "${CYAN}${BOLD}"
cat << "EOF"
  ____       _     _ _    ___   __  ___
 / __ \     | |   (_) |  / _ \ / _|/ _ \
| |  | |_ __| |__  _| |_| | | | |_| | | |_ __  ___
| |  | | '__| '_ \| | __| | | |  _| | | | '_ \/ __|
| |__| | |  | |_) | | |_| |_| | | | |_| | |_) \__ \
 \____/|_|  |_.__/|_|\__|\___/|_|  \___/| .__/|___/
                                        | |
                                        |_|
EOF
echo -e "${RESET}"
echo -e "${BLUE}${BOLD}╔════════════════════════════════════════════════════════════╗${RESET}"
echo -e "${BLUE}${BOLD}║   🚀 BROUGHT TO YOU BY ORBIT OF OPS (PART 3)               ║${RESET}"
echo -e "${BLUE}${BOLD}╚════════════════════════════════════════════════════════════╝${RESET}\n"

echo -e "${CYAN}${BOLD}[Task 5] Connecting to Jumphost & Deploying Application...${RESET}"

gcloud compute ssh --zone="$ZONE" "orca-jumphost" --project="$PROJECT_ID" --quiet --command="
    sudo apt-get update
    sudo apt-get install google-cloud-sdk-gke-gcloud-auth-plugin -y
    export USE_GKE_GCLOUD_AUTH_PLUGIN=True
    gcloud container clusters get-credentials $CLUSTER_NAME --internal-ip --zone=$ZONE --project=$PROJECT_ID
    kubectl create deployment hello-server --image=gcr.io/google-samples/hello-app:1.0
    kubectl expose deployment hello-server --name orca-hello-service --type LoadBalancer --port 80 --target-port 8080
"

echo -e "\n${GREEN}${BOLD}✅ Task 5 is complete! Click 'Check my progress' to claim your 100%.${RESET}\n"

echo -e "${MAGENTA}${BOLD}╔════════════════════════════════════════════════════════════╗${RESET}"
echo -e "${MAGENTA}${BOLD}║             🎉 AUTOMATION COMPLETED SUCCESSFULLY 🎉          ║${RESET}"
echo -e "${MAGENTA}${BOLD}╚════════════════════════════════════════════════════════════╝${RESET}"