Grant flow log access to your GCP instance
Learn how to allow Illumio Segmentation for the Cloud access to flow logs of cloud service providers.
Learn how to allow Illumio Segmentation for the Cloud access to your GCP cloud account flow logs.
To set up flow logs before you grant flow log access, see Set up flow logs in your GCP environment.
To review your destinations before granting flow log access, see Review destinations before granting flow log access.
Grant GCP flow log access in Illumio Segmentation for the Cloud
Granting access to flow logs is done using the onboarding page. For GCP you can enable VPC and Firewall flow logs.
For a digest of instructions on how to enable flow log access in Illumio Segmentation for the Cloud, see the in-application help. First review your flow log access to determine whether you see the flow logs that you expect. See Review destinations before granting flow log access.
For best results, Illumio recommends viewing videos in Chrome.
When you execute the script, Illumio Segmentation for the Cloud enables the following permissions:
Project level permissions:
pubsub.subscriptions.consume
pubsub.subscriptions.create
pubsub.subscriptions.delete
Topic level permissions:
pubsub.topics.attachSubscription
Read access to the topic paths for your topics
When granting flow log access, Illumio Segmentation for the Cloud creates two roles with the following bindings and permissions:
Role: IllumioFlowAccessRole
Binding: topic level permission: pubsub.topics.attachSubscription
Role: IllumioPubSubAccessRole
Binding: project level permission: pubsub.subscriptions.consume, pubsub.subscriptions.create, pubsub.subscriptions.delete
Use the following steps to grant GCP flow log access:
Click Flow Log Access on the Onboarding page to open the Flow Log Access page.
Find the account name you want.
Grant access by first selecting individual or grouped accounts.
Confirm that the flow log destinations you want are selected. If you wish to grant access to flow log destinations within this account or incoming from external accounts:
Click Grant Access and use the above prerequisite information in the Grant Access... dialog box, as explained in the in-application help.
Note
If you wish to grant access to external flow log destinations, use this set of steps instead.
Click the Outgoing to external destinations tile.
Browse to Onboarding > Flow Log Access and find the account that contains the destination resource.
Click Grant Access and use the above prerequisite information in the Grant Access... dialog box, as explained in the in-application help.
Limitations for granting flow log access to GCP
To get traffic flow visibility in the Illumio Segmentation for the Cloud Map and Traffic pages, you need to provide access to flow logs. Once the flow logs are configured in the cloud console, the flow details will be displayed in the flow log access page of Illumio Segmentation for the Cloud. By granting access to flow logs, you will allow Illumio Segmentation for the Cloud to read the flows and provide details about network traffic in the traffic page.
Note
To grant access to flow logs stored in a different account than the one you onboarded, you must also onboard the account containing those flow logs. See Onboarding GCP.
For example, do you have central log storage or cross-account storage? This is where flow logs generated from one account are stored in a destination belonging to another account.
Note
The following are known limitations of Cloud's flow log reading capability:
Review destinations before granting flow log access
Review your destinations before allowing Illumio Segmentation for the Cloud access to your cloud account flow logs.
Review flow log access in Illumio Cloud
Review your flow log access to determine whether you see the flow logs that you expect. Click Flow Log Access on the Onboarding page.
Review flow log access details
Find the Account name you want and click on that row.
Organize your log destinations and sources if you have several.
Select from the tiles to show only resources with the following flows. Each tile indicates the access granted status and lists the number of sources and destinations.
Within this account tile. Both the flow sources and flow destinations are in the same account.
Incoming from external account tile. The flow destinations receive flows from sources in other accounts in your environment.
Outgoing to external destinations tile. The flow sources send flows to destinations in other accounts. This can include accounts outside your environment.
Group your destinations by Region or Access Granted
Drag and drop the column heading to the 'Drag here to set row groups' text.
Click checkboxes to select and deselect destinations. For example, for one tile you may want to group all destinations that don't have access, so that you can grant access to all of them simultaneously.
Review the details for each account. Click on a Source Count entry to see which sources are sending flow logs to this destination, and to see details like the region, tags, and so on for each of the sources.
Access is not granted by default, but you will still see the Flow Log ID, VPC, S3 Bucket, Region, etc.
Once you grant access, you will see either Full access or Partial access Granted in the Access Granted column
Review your cloud account settings for any child flow logs that are listed as not granted in the access details
Refresh the Flow Log Access Details page immediately after granting access to make sure that the updated status
You can elect multiple destinations from the Within this account and the Incoming from external account tiles, but not the Outgoing to external destinations tile
Checkboxes for grouping by access are available only to users with write access.
Review Prerequisites for granting flow log access to GCP and grant flow log access.