CloudGuard Controller for Google Cloud (GCP) - Authentication Options

Shay_Levin — Tue, 05 Oct 2021 10:30:08 GMT

The CloudGuard Controller dynamically learns about objects and attributes in data centers, such as changes in subnets, security groups, virtual machines, IP addresses, and tags. After using the vendor’s API to establish a trust relationship with a datacenter, CloudGuard Controller regularly polls the connected environments for changes in objects and object attributes used in the Security Policy. Changes are automatically pushed to the security gateway.

There are two Authentication options avilable on the CloudGuard Controller for GCP

Service Account Key Authentication
1. Create a key for the service account
  https://cloud.google.com/iam/docs/creating-managing-service-accounts
2. Export KEY as JSON
3. Assign IAM permissions
  The service account must have read permissions for all the relevant resources (example: viewer role).
  - Networks
  - Instances
  - Subnetworks
4. Import the Service Account JSON file to Check Point CloudGuard Controller Object.

2. Service Account VM Instance Authentication

Create a new service account or use the default “Compute Engine default service account" https://cloud.google.com/iam/docs/creating-managing-service-accounts
Assign IAM permissions to the service account
The service account must have read permissions for all the relevant resources (example: viewer role).
- Networks
- Instances
- Subnetworks
stop the VM
edit VM settings
select the service account :

For both options you will need to Activate 3 APIs.

You will find the APIs on the

APIs & Services on the GCP console

Enable the ones who are marked in Red

topic CloudGuard Controller for Google Cloud (GCP) - Authentication Options in Cloud Firewall

CloudGuard Controller for Google Cloud (GCP) - Authentication Options