Protect Service Installation

Preparation

1. Ensure that all the steps in pre-configuration are performed.

2. Log in to the Google Cloud account where Protegrity will be installed.

3. Select the project.

4. Ensure that you have access to shell command on your computer or Cloud Shell with Terraform CLI v0.14 or higher installed.

5. Ensure that the Terraform scripts provided by Protegrity are available on your local computer.

Install Protect Function via Terraform Scripts

Resources created with Terraform scripts include Protect Cloud Functions Service and other required resources depending on Terraform parameters. If you don’t specify the deployment bucket Terraform parameter, a new storage bucket will also be created. You can optionally choose to create a new service account with custom IAM role.

To install using Terraform:

1. From the command shell move to directory where you downloaded Protegrity installation bundle.

2. Unzip the bundle. Verify that the following files are available:

   • pty-protect-gcp/
   • main.tf
   • outputs.tf
   • protegrity-cloud-api-gcp-{version}.zip
   • README.md

3. Unzip the protegrity-cloud-protect-gcp-{version}.zip file. Verify that the following files are available:

   • pty-protect-gcp/
   • main.tf
   • outputs.tf
   • protegrity-cloud-protect-gcp-{version}.zip
   • README.md

4. Open the main.tf file and update Terraform backend information at the top of the file:

   
   terraform {
     backend "gcs" {
       bucket  = ""
       prefix  = "protegrity/terraform/pty-protect-gcp/state"
     }
   }
   

5. In the same main.tf file, specify the following Terraform variables: All the values were recorded in Google Cloud Project.

   Warning

   Google Cloud Function 2nd Generation currently does not support CMEK.

```
terraform init
```

7. Terraform will download necessary providers.

8. Run the following command to verify configuration and print out deployment plan.

   terraform plan
   

9. Run the following command to deploy resources to your account.

   terraform apply
   

10. Once deployment is complete Terraform will print output variables.

11. Record the following values:

    • protect_function_name: ________________________________
    • protect_function_url: __________________________
    • api_gateway_managed_service: _____________________________
    • api_gateway_protect_service_url: ____________________
    • protect_function_resource_name: _______________________

Deploy API Gateway (Optional)

Terraform module provided by Protegrity allows deploying Google API Gateway proxy for the Cloud Protect Service.

To deploy API Gateway:

1. In the main.tf file set the following Terraform variables.

   deploy_api_gateway = true
   api_gateway_jwt_issuer = "<service-account>@<google-cloud-project-id>.iam.gserviceaccount.com"
   api_gateway_jwks_uri = "https://www.googleapis.com/robot/v1/metadata/x509/<service-account>@<google-cloud-project-id>.iam.gserviceaccount.com"
   

   Below is the brief description of each Terraform variable. You can find more information in the Terraform README file.

   • deploy_api_gateway - enables GCP API Gateway proxy for Protect Cloud Function service
   • api_gateway_jwt_issuer - sets the JWT issuer. API Gateway checks the “iss” claim in the JWT for incoming requests. See x-google-issuer in https://cloud.google.com/endpoints/docs/openapi/openapi-extensions#x-google-issuer.
   • api_gateway_jwks_uri - URI of the provider’s public key set to validate the signature of the JSON Web Token. See x-google-jwks_uri in https://cloud.google.com/endpoints/docs/openapi/openapi-extensions#x-google-jwks_uri. In the example above the URI includes service account which credentials are used to issue the JWT token.

   Note

   For more information how to create service service account and send authenticated request refer to following GCP documentation: https://cloud.google.com/iam/docs/create-short-lived-credentials-direct

   Note

   The “aud” claim in the JWT must be set to Google API Gateway service name. You can find the API Gateway service name in API Gateway configuration in GCP console under Managed Service label. The service name is of the following format: <deployment-name>-<api-id>.apigateway.<google-cloud-project-id>.cloud.goog

2. Run terraform plan.

3. Run terraform apply.

4. Wait for the Terraform apply command to complete.

5. Once Terraform apply completes, it prints out deployment resources information. Record the following information from the Terraform output.

   api_gateway_managed_service: ___________________

   api_gateway_protect_service_url: ___________________

6. Follow instructions in the link below to generate JWT token which you can use to authorize request to Protegrity API Gateway endpoint. Use the same service account you configured in section above for api_gateway_jwks_uri.

   https://cloud.google.com/iam/docs/create-short-lived-credentials-direct#create-jwt

   Note

   The method above requires roles/iam.serviceAccountTokenCreator iam role.

   Record identity token returned in step above:

   gcloud_auth_token: ___________________

7. Run the following CURL command to test API Gateway deployment.

   curl -X POST "{api_gateway_protect_service_url}/api/v1/unprotect" \
           -H 'Authorization:Bearer {gcloud_auth_token}' \
           -d '{ 
             "user": "test",
             "data_element":"alpha",
             "data": ["UtfVk UHgcD!"] 
           }'
   

8. Verify the following output:

   {"encoding":"utf8","results":["hello world!"],"success":true}
   

Test the Protect Function Installation

Before continuing with next steps, you can verify whether Cloud Functions are installed correctly. This step is optional and can be skipped.

1. Below you can find example CURL command to test your function.

2. Before you can execute it, you need to obtain temporary authentication token. Run the gcloud auth login and then gcloud auth print-identity-token commands. The logged in gcloud user must have the cloudfunctions.functions.invoke permission. Record the output of print identity token command.

   gcloud_auth_token: _________________

3. Replace {protect_function_url}; with value recorded in previous step.

4. Replace {gcloud_auth_token} with value recorded in above step.

5. Run the following CURL command to test Function deployment.

   curl -X POST "{protect_function_url}/pty/v1/unprotect" \
           -H 'Authorization:Bearer {gcloud_auth_token}' \
           -d '{ 
             "user": "test",
             "data_element":"alpha",
             "data": ["UtfVk UHgcD!"] 
           }'
   

6. Verify the following output:

   {"encoding":"utf8","results":["hello world!"],"success":true}