Search code examples
amazon-web-servicesgoogle-cloud-platformgoogle-cloud-runaws-security-group

Alternative to AWS's Security groups in GCP?

Is there an alternative to AWS's security groups in the Google Cloud Platform?

Following is the situation which I have:

  1. A Basic Node.js server running in Cloud Run as a docker image.
  2. A Postgres SQL database at GCP.
  3. A Redis instance at GCP.

What I want to do is make a 'security group' sort of so that my Postgres SQL DB and Redis instance can only be accessed from my Node.js server and nowhere else. I don't want them to be publically accessible via an IP.

What we do in AWS is, that only services part of a security group can access each other.

I'm not very sure but I guess in GCP I need to make use of Firewall rules (not sure at all).

If I'm correct could someone please guide me as to how to go about this? And if I'm wrong could someone suggest the correct method?

Solution

  • Thanks @amsh for the solution to the problem. But there were a few more things that were required to be done so I guess it'll be better if I list them out here if anyone needs in the future:

    • Create a VPC network and add a subnet for a particular region (Eg: us-central1).
    • Create a VPC connector from the Serverless VPC Access section for the created VPC network in the same region.
    • In Cloud Run add the created VPC connector in the Connection section.
    • Create the PostgreSQL and Redis instance in the same region as that of the created VPC network.
    • In the Private IP section of these instances, select the created VPC network. This will create a Private IP for the respective instances in the region of the created VPC network.
    • Use this Private IP in the Node.js server to connect to the instance and it'll be good to go.

    Common Problems you might face:

    • Error while creating the VPC Connector: Ensure the IP range of the VPC connector and the VPC network do not overlap.

    • Different regions: Ensure all instances are in the same region of the VPC network, else they won't connect via the Private IP.

    • Avoid changing the firewall rules: The firewall rules must not be changed unless you need them to perform differently than they normally do.

    • Instances in different regions: If the instances are spread across different regions, use VPC network peering to establish a connection between them.