Protect Service Installation

Preparation

1. Ensure that all the steps in Pre-Configuration are performed.

2. Log in to the Google Cloud account where Protegrity will be installed.

3. Select the project.

4. Ensure that you have access to shell command on your computer or Cloud Shell with Terraform CLI v0.14 or higher installed.

5. Ensure that the Terraform scripts provided by Protegrity are available on your local computer.

Install Protect Function via Terraform Scripts

Resources created with Terraform scripts include Protect Cloud Functions Service and other required resources depending on Terraform parameters. If you don’t specify the deployment bucket Terraform parameter, a new storage bucket will also be created. You can optionally choose to create a new service account with custom IAM role.

To install using Terraform:

1. From the command shell move to directory where you downloaded Protegrity installation bundle.

2. Unzip the main bundle. Then unzip protegrity-cloud-protect-gcp-{version}.zip. Verify that the following files are available:

   • pty-protect-gcp/
   • main.tf
   • outputs.tf
   • protegrity-cloud-protect-gcp-{version}.zip
   • README.md

3. Unzip the protegrity-cloud-protect-gcp-{version}.zip file. Verify that the following files are available:

   • pty-protect-gcp/
   • main.tf
   • outputs.tf
   • protegrity-cloud-protect-gcp-{version}.zip
   • README.md

4. Open the main.tf file and update Terraform backend information at the top of the file:

   terraform {
     backend "gcs" {
       bucket  = ""
       prefix  = "protegrity/terraform/pty-protect-gcp/state"
     }
   }
   

5. In the same main.tf file, specify the following Terraform variables: All the values were recorded in Google Cloud Project.

   Warning

   Google Cloud Function 2nd Generation currently does not support CMEK.

6. Run the following command.

   terraform init
   

7. Terraform will download necessary providers.

8. Run the following command to verify configuration and print out deployment plan.

   terraform plan
   

9. Run the following command to deploy resources to your account.

   terraform apply
   

10. Once deployment is complete Terraform will print output variables.

11. Record the following values:

    • protect_function_name: ________________________________
    • protect_function_url: __________________________
    • api_gateway_managed_service: _____________________________
    • api_gateway_protect_service_url: ____________________
    • protect_function_resource_name: _______________________

Test Protect Function Installation

Before continuing with next steps, you can verify whether Cloud Functions are installed correctly. This step is optional and can be skipped.

1. Below you can find example CURL command to test your function.

2. Before you can execute it, you need to obtain temporary authentication token. Run the gcloud auth login and then gcloud auth print-identity-token commands. The logged in gcloud user must have the roles/run.invoker role. Record the output of print identity token command.

   gcloud_auth_token: _________________

3. Replace {protect_function_url}; with value recorded in previous step.

4. Replace {gcloud_auth_token} with value recorded in above step.

5. Run the following CURL command to test Function deployment.

   curl -X POST "{protect_function_url}" \
           -H 'Authorization:Bearer {gcloud_auth_token}' \
   -H 'sf-custom-X-Protegrity-HCoP-Rules: {"jsonpaths":[{"op_type":"unprotect","data_element":"alpha"}]}' \
   -H 'sf-context-current-user: test' \
   -H 'sf-external-function-current-query-id: test-id' \
   -H 'Content-Type: application/json' \
   -d '{ 
     "data": [ 
       ["0", "UtfVk UHgcD!"] 
     ] 
   } 
   ' 
   

   Note

   When you copy-paste the curl command, make sure each header is in its separate line.

6. Verify the following output:

   {"data":[[0,"hello world!"]]}