Configure Private Google Access with VPC Service Controls for Air Gap Protect storage

Use Private Google Access with VPC Service Controls to enable private connectivity between your environment and a Google Cloud Storage bucket used for Air Gap Protect. The endpoints documented in the deployment guide are sufficient for this configuration.

Requirements and considerations

Before you configure Air Gap Protect with Google Cloud Storage, verify the following:

• Private Google Access is enabled on the subnet that hosts the Air Gap Protect workloads.

• Private DNS resolves restricted.googleapis.com to 199.36.153.4/30.

• A route exists for 199.36.153.4/30 through the default internet gateway.

• If outbound firewall rules are restrictive, they allow HTTPS (TCP 443) traffic to 199.36.153.4/30.

Add the Air Gap Protect storage service account to the VPC Service Controls egress policy

To allow Air Gap Protect to access the Google Cloud Storage bucket, add the Air Gap Protect storage service account to the VPC Service Controls egress policy.

Identify the Air Gap Protect storage service account

1. From the Command Center navigation pane, go to Manage > Storage > Air Gap Protect.

2. Click the storage pool name.

3. Under Backup Location, click the cloud storage account link.

4. Under Cloud Access Paths, click the container name link under Container.

5. In the Edit Cloud Access Path window, click Equivalent API.

6. Locate the following entry:

   "credentialName": "[service-account-name]@[project-name].iam.gserviceaccount.com"
   

   1. Copy the service account name.

Update the VPC Service Controls egress policy

Update the VPC Service Controls egress policy for the service perimeter that contains the Google Cloud Storage resources.

1. Edit the egress policy for the applicable VPC Service Controls service perimeter.

2. Configure the egress policy to allow the AGP storage service account that you identified in the previous section.

3. Allow the following Google Cloud Storage API methods in the egress policy:

   • google.storage.buckets.create

   • google.storage.buckets.get

   • google.storage.buckets.list

   • google.storage.buckets.testIamPermissions

   • google.storage.objects.create

   • google.storage.objects.delete

   • google.storage.objects.get

   • google.storage.objects.list

   • google.storage.objects.update

   • google.storage.multipartUploads.create

   • google.storage.multipartUploads.uploadPart

   • google.storage.multipartUploads.finish

   • google.storage.multipartUploads.abort

   • google.storage.multipartUploads.list

   • google.storage.multipartUploads.listparts

   • google.storage.multipartUploads.uploadPartCopy

4. Save the egress policy and allow a few minutes for the changes to propagate.

After the policy changes propagate, verify that the AGP storage pool is online.