I'm trying to prevent unauthorized access to the google cloud console, via desktop and also via mobile device. Via desktop, for example, when I try to access the admin workspace, even though I already have my account logged in, it asks me for the password again, I think that's good, would it be possible to do the same when accessing the google cloud console? Let's say I got careless and left the computer unlocked with the browser opened, if the attacker tries to open the GCP console, he would succeed, I'm not comfortable with that. And especially via mobile, let's say someone takes my phone and manages to unlock it, it would access the console freely. Of course I've already enabled 2-factor authentication on my account, but as I said, if someone took my cell phone and managed to unlock or even unlock my computer, the attacker would access it without any difficulty. At least configure to request the password again, is it possible to do with GCP? Thanks!
How to prevent the GCP console from being accessed by mobile? Or at least requesting the password?
Viewed 77
1 Answers
One can set a very low session length time window: https://support.google.com/a/answer/9368756?hl=en
While one is at it restrict access based on IP address: Can you restrict Google Cloud web console logins to an ip address range?
Finally one can restrict service apis to private vpc ranges: https://cloud.google.com/vpc-service-controls/docs/set-up-private-connectivity
What this all does is: A) timeout the session while your away from keyboard B) restrict web/mobile console logins to a whitelist of trusted /32's C) restrict access to GCP to a trusted VPC and VPN connection.
Related