Access Context ManagerのAccess levelの設定してみる

#はじめに
Access Context Managerは、他のGCPのサービスと組み合わせて細かなアクセス制御を行う事ができるサービスです。組み合わせるサービスによってサポートされていなアクセスレベルもあるため整理してみます。

Access Context Managerと組み合わせることができるサービスは、HTTPS用のIdentity-Aware Proxy(≒Context-aware access)、VPC Service ControlでAccess levelが定義できます。
定義できるAccess levelの種類は以下になります。

- IP Subnetworks
- Regions
- Device Policy
- Access Level Dependency
- Member

https://cloud.google.com/access-context-manager/docs/access-level-attributes

Identity-Aware Proxy(IAP)のAccess levelの定義方法は、IAM Conditionsの設定時に以下の様な形式で設定します。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/78184/d1a728b2-0d38-c669-e621-2b7cf896f7ed.png)

https://cloud.google.com/iam/docs/conditions-overview

図にすると以下の様なイメージです。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/78184/04a15229-aefc-f440-cb05-6bd94df525cc.png)


VPC Service Controlは、Ingress Policyとして設定します。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/78184/fbd5cb8d-2907-fb0d-d71b-0bf6310cdb89.png)

#結論
一部だけしか実機確認できてませんが、✔がついているものは確認しました。残りはまた今度。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/78184/48e58132-c926-6d51-7c2c-cf0bbb0928f2.png)

#実機確認
##③IAP HTTPS * Device policy

```
"accessPolicies/663588214084/accessLevels/device" in
request.auth.access_levels
```

Macからのアクセス許可
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/78184/af868d7e-c998-c04c-7270-c0a061001015.png)

成功
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/78184/1d70d556-b8d2-1450-78ef-926f0bdd7f4a.png)

Windowsからのアクセス許可
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/78184/fb9e6748-6d3a-8070-2467-c53fe409d67a.png)

失敗
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/78184/a7caed7e-bcd9-f0ec-f2d2-aa1b6f811deb.png)


##⑥VPC Service Control * IP Subnetworks
X.X.X.156からアクセス
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/78184/b20ed4cc-69b1-3caa-a507-052dcb0afad3.png)

True
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/78184/71a61239-ac87-a052-cbed-03b2cde87b87.png)

成功

```
$ gsutil ls
gs://test-dafakslefgajlke/
```

False
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/78184/66741452-b66e-5c96-de47-d50fdaea1ac4.png)

失敗

```
$ gsutil ls
AccessDeniedException: 403 Request is prohibited by organization's policy. vpcServiceControlsUniqueIdentifier: 37a1883ec1a3d73c
```

##⑩VPC Service Control * Member
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/78184/1704d811-d0d3-34f4-6a79-885f3deecdaf.png)

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/78184/2a9f0a30-82f8-ae6d-5a0c-dfe4dabb6a7f.png)

成功

```
#-> member
$ gsutil ls
gs://test-dafakslefgajlke/
```

失敗

```
#-> not member
$ gsutil ls
AccessDeniedException: 403 Request is prohibited by organization's policy. vpcServiceControlsUniqueIdentifier: 15c946a79f0fc64e
```
##⑦VPC Service Control * Region
Japan
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/78184/3ec779cb-9f00-913f-5706-1bc6712d3ce5.png)

成功

```
$ gsutil ls
gs://test-dafakslefgajlke/
```

US
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/78184/d0467215-11ce-f66e-d69f-47f7671cebb5.png)

失敗

```
$ gsutil ls
AccessDeniedException: 403 Request is prohibited by organization's policy. vpcServiceControlsUniqueIdentifier: 37a1883ec1a3d73c
```