3. Identity and Access#

In this milestone you’ll put into practice what you’ve learned about SSH keys and service accounts by accomplishing the following tasks:

  1. Use SSH keys to login to VMs from your home or school computer

  2. Grant programs on your VM access to cloud resources using a Service Account

No More Passwords#

The time of passwords is over. Passwords are easy to guess and steal. People often use the same or similar passwords across devices and accounts and forget to rotate them after a breach. For servers, like your project VM, typing your password into a file somewhere is especially risky because your password can leak through logs, source code, screenshots, or accidental commits.

Cryptographic identities, like SSH keys and access tokens, are more secure because they provide authentication without having to transmit a secret. In class I demonstrate how this works with SSH.In practice, key-based and token-based auth improves security by reducing password theft risk, enabling stronger automation, and making credential rotation and auditing easier.

Service Accounts#

A service account is a special identity used by applications, virtual machines, and automation tools instead of a human user. In Google Cloud, a service account is granted IAM roles so software can access only the resources it needs.

Service accounts are used to:

  • Avoid sharing personal user credentials in scripts or servers

  • Enforce least-privilege access for workloads

  • Make access easier to audit and rotate over time

Google has a good video introduction to service accounts that’s in our reading for this lesson.

Labs#

In class I do a walk-through of these publicly available labs and tutorials. If you learn nothing else from the class you should learn how to use publicly available resources to gain new skills. The cloud is ever changing, knowing how to use the manuals will keep you current.

After all of the labs are completed you should be able to SSH into your VM and run the following command:

$ gcloud compute instances list 
NAME           ZONE        MACHINE_TYPE  PREEMPTIBLE  INTERNAL_IP  EXTERNAL_IP                    STATUS
mikes-project  us-west1-a  e2-micro                   10.1.0.4     34.11.253.59                   RUNNING
                                                                   2600:1900:4040:ddf:0:1:0:0/96

You should see the name of your VM in the output (and not an error).

Project Documentation#

Some of the labs in this class are generic and may not contain the exact steps you need to make progress on your project. To meet the project requirements for this week you have to accomplish the following tasks:

  1. Generate SSH keys (if you don’t already have them)

  2. Add your SSH public key to your gcloud project metadata

  3. Verify you can SSH into your VM

  4. Create a service account and grant it access to Compute Engine

  5. Update your VM to use the new service account

  6. Verify you can use the gcloud compute instances list command on your VM

You should fully document your steps and post your documentation to the class discussion forum. After you’ve posted you will be able to see other’s documentation and make changes to your own. Your documentation must include the following items:

  1. A summary of each step you took to complete the required tasks

  2. The external IP address of your VM

  3. Your public SSH key

  4. A screenshot of you SSHed into your devbox

  5. A screenshot of the output of the gcloud command