Cloud Storage の新機能 Bucket IP filtering で VPC と CIDR のアクセス制限を試してみた

# サービスアカウントの作成
gcloud iam service-accounts create sa-access-gcs

# roles/storage.admin の権限を付与
gcloud projects add-iam-policy-binding <PROJECT_ID> \
     --member="serviceAccount:sa-access-gcs@<PROJECT_ID>.iam.gserviceaccount.com" \
     --role="roles/storage.admin" \
     --condition None

# カスタムモードの VPC を作成
gcloud compute networks create vpc-bucket-ip-filtering \
    --subnet-mode=custom

# ssh を許可する VPC ファイアウォールルールを作成
gcloud compute firewall-rules create bucket-ip-filtering-allow-ssh \
    --network vpc-bucket-ip-filtering \
    --action allow \
    --rules tcp:22

# 10.0.0.0/28 のサブネットを作成
gcloud compute networks subnets create subnet-bucket-ip-filtering-1 \
    --region=us-central1 \
    --network=vpc-bucket-ip-filtering \
    --range=10.0.0.0/28 \
    --enable-private-ip-google-access

# 10.100.100.0/28 のサブネットを作成
gcloud compute networks subnets create subnet-bucket-ip-filtering-2 \
    --region=us-central1 \
    --network=vpc-bucket-ip-filtering \
    --range=10.100.100.0/28 \
    --enable-private-ip-google-access

# 10.0.0.0/28 のサブネットに Compute Engine インスタンスを作成
gcloud compute instances create gce-bucket-ip-filtering-1 \
  --network="projects/<PROJECT_ID>/global/networks/vpc-bucket-ip-filtering" \
  --subnet="projects/<PROJECT_ID>/regions/us-central1/subnetworks/subnet-bucket-ip-filtering-1" \
  --zone="us-central1-a" \
  --scopes="storage-full" \
  --no-address \
  --service-account="sa-access-gcs@<PROJECT_ID>.iam.gserviceaccount.com"

# 10.100.100.0/28 のサブネットに Compute Engine インスタンスを作成
gcloud compute instances create gce-bucket-ip-filtering-2 \
  --network="projects/<PROJECT_ID>/global/networks/vpc-bucket-ip-filtering" \
  --subnet="projects/<PROJECT_ID>/regions/us-central1/subnetworks/subnet-bucket-ip-filtering-2" \
  --zone="us-central1-a" \
  --scopes="storage-full" \
  --no-address \
  --service-account="sa-access-gcs@<PROJECT_ID>.iam.gserviceaccount.com"

# bucket IP filtering のルールを適用するバケットを作成
gcloud storage buckets create gs://bucket-ip-filtering-test \
  --location us-central1 \
  --soft-delete-duration 0 \
  --uniform-bucket-level-access

# テスト用のオブジェクトをアップロード
echo "Hello World" > sample.text
gcloud storage mv ./sample.text gs://bucket-ip-filtering-test

{
    "mode": "Enabled",
    "vpcNetworkSources":
        [
            {
                "network": "projects/<PROJECT_ID>/global/networks/vpc-bucket-ip-filtering",
                "allowedIpCidrRanges":
                    [
                        "10.0.0.0/28"
                    ]
            }
        ]
}

gcloud alpha storage buckets update gs://bucket-ip-filtering-test --ip-filter-file=bucket-ip-filtering-rules.json

gcloud storage ls gs://bucket-ip-filtering-test/

ERROR: (gcloud.storage.ls) [<ユーザーアカウント>] does not have permission to access b instance [bucket-ip-filtering-test] (or it may not exist): There is an IP filtering condition that is preventing access to the resource. This command is authenticated as <ユーザーアカウント> which is the active account specified by the [core/account] property.

@gce-bucket-ip-filtering-2:~$ gcloud storage ls gs://bucket-ip-filtering-test/

ERROR: (gcloud.storage.ls) [sa-access-gcs@<PROJECT_ID>.iam.gserviceaccount.com] does not have permission to access b instance [bucket-ip-filtering-test] (or it may not exist): There is an IP filtering condition that is preventing access to the resource. This command is authenticated as sa-access-gcs@<PROJECT_ID>.iam.gserviceaccount.com which is the active account specified by the [core/account] property.

@gce-bucket-ip-filtering-1:~$ gcloud storage ls gs://bucket-ip-filtering-test/
gs://bucket-ip-filtering-test/sample.text

@gce-bucket-ip-filtering-1:~$ gcloud storage cat gs://bucket-ip-filtering-test/sample.text
Hello World

@gce-bucket-ip-filtering-1:~$ bq query --nouse_legacy_sql \
'EXPORT DATA
  OPTIONS (
    uri="gs://bucket-ip-filtering-test/*.json",
    format="JSON",
    overwrite=true
  ) AS
SELECT "Hello World"'

Waiting on bqjob_r5cc7887cb069f712_0000019380e6dfec_1 ... (0s) Current status: DONE   

BigQuery error in query operation: Error processing job '<PROJECT_ID>:bqjob_r5cc7887cb069f712_0000019380e6dfec_1': Access Denied: BigQuery BigQuery: Permission denied while writing
data. There is an IP filtering condition that is preventing access to the resource. Please make sure gs://bucket-ip-filtering-test/000000000000.json is accessible via appropriate
IAM roles, e.g. Storage Object Viewer or Storage Object Creator.