Manage just-in-time privileged access to projects

Deploy Just-in-Time Access

This section describes how you can deploy the Just-In-Time Access application to App Engine or Cloud Run.

Deploying the Just-In-Time Access application to Cloud Run requires a more complex configuration than deploying the application to App Engine. We therefore recommend that you use App Engine unless you're deploying in a region that doesn't support App Engine, or if you can't use App Engine for other reasons.

The code for Just-In-Time Access is in a GitHub repository.

This section assumes that you are an administrator.

Configure your Google Cloud project

1. In the Google Cloud console, switch to your project and enable required APIs:

   App Engine

   Enable the Cloud Asset Inventory, Resource Manager, Identity-Aware Proxy, Container Registry, Cloud Build, Identity and Access Management, and Directory APIs.

   Enable the APIs

   Cloud Run

   Enable the Cloud Asset Inventory, Resource Manager, Identity-Aware Proxy, Container Registry, Cloud Run, Compute Engine, Identity and Access Management, and Directory APIs.

   Enable the APIs

2. Open Cloud Shell.

   Open Cloud Shell

3. Set an environment variable to contain your project ID:

   gcloud config set project PROJECT_ID
   

   Replace PROJECT_ID with the ID of your project.

4. Create a service account for the Just-in-Time Access application:

   SERVICE_ACCOUNT=$(gcloud iam service-accounts create jitaccess --display-name "Just-In-Time Access" --format "value(email)")
   

5. Allow the application to create tokens using its service account by granting it the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator):

   gcloud iam service-accounts add-iam-policy-binding $SERVICE_ACCOUNT \
     --member "serviceAccount:$SERVICE_ACCOUNT" \
     --role "roles/iam.serviceAccountTokenCreator"
   

   The application uses the permission to create tokens to access the Directory API and, optionally, to handle multi-party approval workflows.

Grant the Just-in-Time Access application permission to manage IAM bindings

You now grant the Project IAM Admin role to the application's service account. This role lets the Just-In-Time Access application create temporary IAM bindings when it must grant just-in-time access.

Because the Project IAM Admin role is highly privileged, you must limit access to the application's service account and to the project that contains it.

Use the following guidelines:

• Limit the number of users that can access the project, and avoid granting any user the Owner or Editor role.
• Limit the number of users that can impersonate the service account. The users who should be able to do this impersonation include those who have the Service Account User role or the Service Account Token Creator role.

To grant the Project IAM Admin role to the service account, do the following:

1. Grant the Project IAM Admin role (roles/resourcemanager.projectIamAdmin) and Cloud Asset Viewer role (roles/cloudasset.viewer) to the part of your resource hierarchy that you want to manage just-in-time privileged access for:

   Project

   SCOPE_ID=RESOURCE_PROJECT_ID
   SCOPE_TYPE=projects
   
   gcloud projects add-iam-policy-binding $SCOPE_ID \
       --member "serviceAccount:$SERVICE_ACCOUNT" \
       --role "roles/resourcemanager.projectIamAdmin" \
       --condition None
   
   gcloud projects add-iam-policy-binding $SCOPE_ID \
       --member "serviceAccount:$SERVICE_ACCOUNT" \
       --role "roles/cloudasset.viewer" \
       --condition None
   

   Replace RESOURCE_PROJECT_ID with the ID of the Google Cloud project that you want to manage access for. This project is a different one than the one you're deploying Just-In-Time Access to.

   Folder

   SCOPE_ID=RESOURCE_FOLDER_ID
   SCOPE_TYPE=folders
   
   gcloud resource-manager folders add-iam-policy-binding $SCOPE_ID \
       --member "serviceAccount:$SERVICE_ACCOUNT" \
       --role "roles/resourcemanager.projectIamAdmin" \
       --condition None
   gcloud resource-manager folders add-iam-policy-binding $SCOPE_ID \
       --member "serviceAccount:$SERVICE_ACCOUNT" \
       --role "roles/cloudasset.viewer" \
       --condition None
   

   Replace RESOURCE_FOLDER_ID with the ID of the folder that contains the projects that you want to manage access for.

   Organization

   SCOPE_ID=ORGANIZATION_ID
   SCOPE_TYPE=organizations
   
   gcloud organizations add-iam-policy-binding $SCOPE_ID \
       --member "serviceAccount:$SERVICE_ACCOUNT" \
       --role "roles/resourcemanager.projectIamAdmin" \
       --condition None
   gcloud organizations add-iam-policy-binding $SCOPE_ID \
       --member "serviceAccount:$SERVICE_ACCOUNT" \
       --role "roles/cloudasset.viewer" \
       --condition None
   

   Replace ORGANIZATION_ID with the ID of your organization.

Grant access to allow the application to resolve group memberships

The Just-In-Time Access application lets you grant eligible access to a specific user or to an entire group. To evaluate group memberships, the application must be allowed to read group membership information from your Cloud Identity or Google Workspace account.

To grant the application's service account access permission to read group memberships, do the following:

1. Open the Google Admin console and sign in as a super-admin user.

2. Go to Account > Admin Roles:

   Go to Admin Roles

3. Click Groups Reader > Admins.

4. Click Assign service accounts.

5. Enter the following email address:

   jitaccess@PROJECT_ID.iam.gserviceaccount.com
   

   Replace PROJECT_ID with the ID of your Google Cloud project.

6. Click Add.

7. Click Assign role.

Look up your Cloud Identity or Google Workspace account's customer ID

To evaluate group memberships using the Directory API, the Just-In-Time Access application needs your Cloud Identity or Google Workspace account's customer ID. To look up this ID, do the following:

1. In the Google Admin console, go to Account > Account settings:

   Go to Account settings

2. Copy your account's customer ID. The customer ID starts with C.

   You need the customer ID in a later step.

3. Close the Admin console.

Deploy the application

You're now ready to deploy the Just-In-Time Access application to App Engine or Cloud Run.

Configure a load balancer

You now configure a load balancer for the Just-In-Time Access application.

Configure Identity-Aware Proxy

You now configure IAP for the Just-In-Time Access application.

1. In Cloud Shell, configure an OAuth consent screen:

   gcloud iap oauth-brands create \
       --application_title "Just-In-Time Access" \
       --support_email=$(gcloud config get core/account)
   

2. In the Google Cloud console, go to Security > Identity-Aware Proxy.

   Go to IAP

3. Set IAP to enabled.

You now must define which users are allowed to access the Just-In-Time Access application. You can grant access to individual users, to groups, or to an entire domain.

1. In the Google Cloud console, go to IAM & Admin > IAM.

   Go to IAM

2. Click Grant access and then set the following values:

   1. In the principals list, select a user, group, or domain.
   2. In the role list, select IAP-secured web app user.

   The IAP-secured web app user role lets users open the Just-In-Time Access application, but the role doesn't provide them access to any additional resources yet.

3. Click Save.

It can take a few minutes for the role binding to take effect.

PROJECT_NUMBER=$(gcloud projects list \
  --filter $(gcloud config get-value project) \
  --format "value(PROJECT_NUMBER)")

gcloud projects add-iam-policy-binding $(gcloud config get-value core/project) \
  --member "serviceAccount:[email protected]" \
  --role "roles/run.invoker"

Test Just-in-Time Access

You can now test the process of granting eligible access and the process of using the Just-In-Time Access application to activate eligible access.

Grant eligible access

To start, you grant eligible access to a second Cloud Identity or Google Workspace user.

1. In the Google Cloud console, use the project list to select a project that's part of the resource hierarchy that's managed by the Just-In-Time Access application.
2. On the IAM page, click Grant access.
3. Enter the email address of your second Cloud Identity or Google Workspace user and select a role such as Project > Browser.
4. Click Add condition.
5. Enter a title such as Eligible for JIT access.

6. Select Condition editor and then enter the following CEL expression:

   has({}.jitAccessConstraint)
   

7. Save your changes.

Activate access

Now you can switch users and request temporary access to a resource.

1. Open an incognito browser window and navigate to the URL of the Just-In-Time Access application that you noted earlier.
2. Sign in as the user that you've granted eligible access to.
3. In the Just-In-Time Access application, select a role and resource that you want to activate access for.

4. Enter a justification such as testing and then click Request access.

   On the next page, notice that your access has temporarily been activated.

Analyze logs

You can now switch back to your administrative user and review the log.

1. In the Google Cloud console, go to Logging > Logs Explorer.

   Go to Logs Explorer

2. Set Show query to enabled.

3. Enter the following query:

   labels.event="api.activateRole"
   

4. Click Run query.

   The output is similar to the following:

   {
   "textPayload": "User EMAIL activated role 'ROLE' on '//cloudresourcemanager.googleapis.com/projects/PROJECT_ID' for themselves",
   "severity": "INFO",
   "labels": {
       "resource": "//cloudresourcemanager.googleapis.com/projects/PROJECT_ID",
       "event": "api.activateRole",
       "role": "ROLE",
       "clone_id": "00c6...",
       "user": "EMAIL",
       "justification": "testing",
       ...
     },
   ...
   }
   

   Notice that a log record has been created for each role you activated. The log record includes a set of labels that you can use to create custom filters.

Upgrade Just-in-Time Access

This section describes how you can upgrade an existing Just-In-Time Access deployment to use a newer version of the application, or to use a different configuration.

This section assumes that you are an administrator.

1. In the Google Cloud console, switch to your project and then open Cloud Shell.

   Open Cloud Shell

2. Set an environment variable to contain your project ID:

   gcloud config set project PROJECT_ID
   

   Replace PROJECT_ID with the ID of your project.

3. Clone the GitHub repository and switch to the latest branch:

   git clone https://github.com/GoogleCloudPlatform/jit-groups.git
   cd jit-access/sources
   git checkout latest
   

4. Download the configuration file that you used previously to deploy the application and save it to a file app.yaml:

   App Engine

   APPENGINE_VERSION=$(gcloud app versions list --service default --hide-no-traffic --format "value(version.id)")
   APPENGINE_APPYAML_URL=$(gcloud app versions describe $APPENGINE_VERSION --service default --format "value(deployment.files.'app.yaml'.sourceUrl)")
   
   curl -H "Authorization: Bearer $(gcloud auth print-access-token)" $APPENGINE_APPYAML_URL -o app.yaml
   cat app.yaml
   

   If downloading the file app.yaml fails, you can download your current configuration in the Google Cloud console.

   Cloud Run

   gcloud config set run/region REGION
   gcloud run services describe jitaccess --format yaml > app.yaml
   

   Replace REGION with the region that contains your existing Cloud Run deployment.

5. If you want to make changes to your configuration, edit the app.yaml file. For a list of settings, see the Configuration options page in the associated GitHub repository.

6. Deploy the application:

   App Engine

   sed -i 's/java11/java17/g' app.yaml
   gcloud app deploy --appyaml app.yaml
   

   Cloud Run

   PROJECT_ID=$(gcloud config get-value core/project)
   
   docker build -t gcr.io/$PROJECT_ID/jitaccess:latest .
   docker push gcr.io/$PROJECT_ID/jitaccess:latest
   
   IMAGE=$(docker inspect --format='{{index .RepoDigests 0}}'  gcr.io/$PROJECT_ID/jitaccess)
   sed -i "s|image:.*|image: $IMAGE|g" app.yaml
   
   gcloud run services replace app.yaml