Restrict access to Google Cloud VM to only Firebase server

user_1584421 0
Viewed 387

I have a Google Cloud VM instance running a REST API server.

I want to remove all public access to the microservice VM and i only want Firebase - which represents my frontend server to have access to the microservice server on the VM.

My thought was to block all access to the VM and allocate an IP in an internal virtual private network, so that it is accessable by the Firebase server.

I started researching VPC (Virtual Private Connectors) here: https://firebase.google.com/docs/storage/gcp-integration

However, the documentation is not very good and it is about Google Cloud Storage.

Is it possible to achive this functionality with Firebase and Google Cloud VM instance?

google-vpc vpc firebase google-cloud-platform
2 Answers

What you can do here is use a JSON Web Token(JWT), a signed JWT. The secret for signing will be there both on your server side and on Firebase Functions. As a best practice store your secret in Google Cloud KMS, whenever you need the secret, access it from there.

Let me briefly explain the process and why I think it's the best choice for you.

For systems running outside of a Compute Engine called "Host1" (Firebase Server) and a Compute Engine instance called ''VM1” ( Backend Server), VM1 can connect to Host1 and validate the identity of that instance with the following process:

  • VM1 establishes a secure connection to Host1 over a secure connection protocol of your choice, such as HTTPS.
  • VM1 requests its unique identity token from the metadata server and specifies the audience of the token. In this example, the audience value is the URI for Host1. The request to the metadata server includes the audience URI so that Host1 can check the value later during the token verification step.
  • Google generates a new unique instance identity token in JWT format and provides it to VM1. The payload of the token includes several details about the instance and also includes the audience URI. Read Token Contents for a complete description of the token contents.
  • VM1 sends the identity token to Host1 over the existing secure connection. Host1 decodes the identity token to obtain the token header and payload values.
  • Host1 verifies that the token is signed by Google by checking the audience value and verifying the certificate signature against the public Google certificate.
  • If the token is valid, Host1 proceeds with the transmission and closes the connection when it is finished. Host1 and any other systems should request a new token for any subsequent connections to VM1.

You can refer to the Verifying the instance identity documentation for more details.

user_158033650
  • Step 1 : Create a custom mode private VPC network in Google Cloud by following the below steps in [1]
  • Step 2 : Select your existing Google Cloud VM instance and configure it to have a private IP by following the below steps in [2]
  • Step 3 : Create a Serverless VPC Access connector in Google Cloud Console by following the steps in [3]
  • Step 4 : Edit your Cloud functions to add the connector we created in step 3 following the steps in [4]
  • Step 5 : To add the connector to Firebase functions follow the stackoverflow answer(and its comments) in [5]

[1]https://cloud.google.com/vpc/docs/using-vpc#create-custom-network [2]https://cloud.google.com/compute/docs/ip-addresses/reserve-static-internal-ip-address#how_to_reserve_a_static_internal_ip_address [3]https://cloud.google.com/functions/docs/networking/connecting-vpc#create-connector [4]https://cloud.google.com/vpc/docs/configure-serverless-vpc-access#functions [5]https://stackoverflow.com/a/55825894/15803365

user_158033650
Related