Network Security and Monitoring - GCP Professional Cloud Network Engineer¶

# DMZ Zone - Public-facing services
gcloud compute networks subnets create dmz-subnet \
  --network=prod-vpc \
  --region=us-central1 \
  --range=10.0.1.0/24 \
  --enable-flow-logs \
  --logging-metadata=include-all \
  --enable-private-ip-google-access

# Application Zone - Internal services
gcloud compute networks subnets create app-subnet \
  --network=prod-vpc \
  --region=us-central1 \
  --range=10.0.10.0/24 \
  --enable-flow-logs \
  --logging-metadata=include-all \
  --purpose=PRIVATE

# Data Zone - Database tier
gcloud compute networks subnets create data-subnet \
  --network=prod-vpc \
  --region=us-central1 \
  --range=10.0.20.0/24 \
  --enable-flow-logs \
  --logging-metadata=include-all \
  --purpose=PRIVATE

# Management Zone - Administrative access
gcloud compute networks subnets create mgmt-subnet \
  --network=prod-vpc \
  --region=us-central1 \
  --range=10.0.100.0/24 \
  --enable-flow-logs \
  --logging-metadata=include-all

# DMZ: Allow inbound from internet to web services
gcloud compute firewall-rules create dmz-allow-web \
  --network=prod-vpc \
  --direction=ingress \
  --action=allow \
  --source-ranges=0.0.0.0/0 \
  --rules=tcp:80,tcp:443 \
  --target-tags=dmz-web \
  --priority=1000

# DMZ to App: Allow specific ports only
gcloud compute firewall-rules create dmz-to-app \
  --network=prod-vpc \
  --direction=ingress \
  --action=allow \
  --source-tags=dmz-web \
  --target-tags=app-servers \
  --rules=tcp:8080,tcp:8443 \
  --priority=1000

# App to Data: Database connections only
gcloud compute firewall-rules create app-to-data \
  --network=prod-vpc \
  --direction=ingress \
  --action=allow \
  --source-tags=app-servers \
  --target-tags=database \
  --rules=tcp:3306,tcp:5432 \
  --priority=1000

# Management: Deny all by default
gcloud compute firewall-rules create mgmt-deny-all \
  --network=prod-vpc \
  --direction=ingress \
  --action=deny \
  --source-ranges=0.0.0.0/0 \
  --rules=all \
  --target-tags=mgmt \
  --priority=65534

# Enable IAP API
gcloud services enable iap.googleapis.com

# Create firewall rule for IAP
gcloud compute firewall-rules create allow-iap-ssh \
  --network=prod-vpc \
  --action=allow \
  --direction=ingress \
  --rules=tcp:22,tcp:3389 \
  --source-ranges=35.235.240.0/20 \
  --target-service-accounts=bastion-sa@project-id.iam.gserviceaccount.com

# Grant IAP tunnel user role
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member=user:admin@example.com \
  --role=roles/iap.tunnelResourceAccessor

# Connect via IAP
gcloud compute ssh instance-name \
  --zone=us-central1-a \
  --tunnel-through-iap

# Forward port via IAP
gcloud compute start-iap-tunnel instance-name 3306 \
  --local-host-port=localhost:3306 \
  --zone=us-central1-a

# Configure backend service for IAP
gcloud compute backend-services update backend-service-name \
  --global \
  --iap=enabled

# Set OAuth credentials
gcloud iap oauth-brands create --application-title="My App" \
  --support-email=support@example.com

gcloud iap oauth-clients create projects/PROJECT_ID/brands/BRAND_ID \
  --display_name="IAP Client"

# Grant access to specific users
gcloud iap web add-iam-policy-binding \
  --resource-type=backend-services \
  --resource=backend-service-name \
  --member=user:user@example.com \
  --role=roles/iap.httpsResourceAccessor

# Create bastion service account
gcloud iam service-accounts create bastion-sa \
  --display-name="Bastion Host Service Account"

# Grant minimal permissions
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member=serviceAccount:bastion-sa@PROJECT_ID.iam.gserviceaccount.com \
  --role=roles/logging.logWriter

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member=serviceAccount:bastion-sa@PROJECT_ID.iam.gserviceaccount.com \
  --role=roles/monitoring.metricWriter

# Create bastion instance with minimal access
gcloud compute instances create bastion-host \
  --zone=us-central1-a \
  --machine-type=e2-micro \
  --subnet=mgmt-subnet \
  --no-address \
  --service-account=bastion-sa@PROJECT_ID.iam.gserviceaccount.com \
  --scopes=cloud-platform \
  --image-family=debian-11 \
  --image-project=debian-cloud \
  --boot-disk-size=10GB \
  --boot-disk-type=pd-standard \
  --metadata=enable-oslogin=TRUE \
  --shielded-secure-boot \
  --shielded-vtpm \
  --shielded-integrity-monitoring

# Firewall rule: Only allow IAP access
gcloud compute firewall-rules create bastion-allow-iap \
  --network=prod-vpc \
  --action=allow \
  --direction=ingress \
  --rules=tcp:22 \
  --source-ranges=35.235.240.0/20 \
  --target-service-accounts=bastion-sa@PROJECT_ID.iam.gserviceaccount.com \
  --priority=1000

# Allow bastion to connect to internal resources
gcloud compute firewall-rules create allow-bastion-to-internal \
  --network=prod-vpc \
  --action=allow \
  --direction=ingress \
  --rules=tcp:22,tcp:3389 \
  --source-service-accounts=bastion-sa@PROJECT_ID.iam.gserviceaccount.com \
  --priority=1000

#!/bin/bash
# Update system
apt-get update && apt-get upgrade -y

# Install essential tools
apt-get install -y tcpdump netcat-openbsd dnsutils

# Configure SSH hardening
cat >> /etc/ssh/sshd_config <<EOF
PermitRootLogin no
PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM yes
X11Forwarding no
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
Protocol 2
EOF

# Restart SSH
systemctl restart sshd

# Configure auditd for logging
apt-get install -y auditd
auditctl -w /etc/passwd -p wa -k passwd_changes
auditctl -w /etc/group -p wa -k group_changes
auditctl -w /var/log/auth.log -p wa -k auth_log

# Enable automatic security updates
apt-get install -y unattended-upgrades
dpkg-reconfigure -plow unattended-upgrades

# Configure iptables logging
iptables -A INPUT -j LOG --log-prefix "INPUT: " --log-level 4
iptables -A OUTPUT -j LOG --log-prefix "OUTPUT: " --log-level 4

# Send logs to Cloud Logging
systemctl enable google-fluentd
systemctl start google-fluentd

# Create access policy (one per organization)
gcloud access-context-manager policies create \
  --organization=ORGANIZATION_ID \
  --title="Corporate Access Policy"

# Get policy number
POLICY_ID=$(gcloud access-context-manager policies list \
  --organization=ORGANIZATION_ID \
  --format="value(name)")

# Create perimeter configuration file
cat > perimeter-config.yaml <<EOF
name: accessPolicies/${POLICY_ID}/servicePerimeters/prod_perimeter
title: Production Perimeter
description: Protects production projects and services
perimeterType: PERIMETER_TYPE_REGULAR
status:
  resources:
    - projects/123456789  # prod-project-1
    - projects/987654321  # prod-project-2
  restrictedServices:
    - storage.googleapis.com
    - bigquery.googleapis.com
    - compute.googleapis.com
    - sqladmin.googleapis.com
    - container.googleapis.com
  accessLevels:
    - accessPolicies/${POLICY_ID}/accessLevels/corp_network
    - accessPolicies/${POLICY_ID}/accessLevels/trusted_users
  vpcAccessibleServices:
    enableRestriction: true
    allowedServices:
      - storage.googleapis.com
      - bigquery.googleapis.com
EOF

# Create perimeter
gcloud access-context-manager perimeters create prod_perimeter \
  --policy=${POLICY_ID} \
  --title="Production Perimeter" \
  --resources=projects/123456789,projects/987654321 \
  --restricted-services=storage.googleapis.com,bigquery.googleapis.com \
  --perimeter-type=regular

# Create access level for corporate devices
cat > corp-devices-access-level.yaml <<EOF
name: accessPolicies/${POLICY_ID}/accessLevels/corp_devices
title: Corporate Managed Devices
description: Access from managed devices only
basic:
  conditions:
    - devicePolicy:
        requireScreenlock: true
        requireAdminApproval: true
        requireCorpOwned: true
        osConstraints:
          - osType: DESKTOP_CHROME_OS
            minimumVersion: "100.0.0"
          - osType: DESKTOP_WINDOWS
            minimumVersion: "10.0.0"
          - osType: DESKTOP_MAC
            minimumVersion: "10.15.0"
EOF

gcloud access-context-manager levels create corp_devices \
  --policy=${POLICY_ID} \
  --title="Corporate Managed Devices" \
  --basic-level-spec=corp-devices-access-level.yaml

# Access from corporate network
cat > corp-network-access-level.yaml <<EOF
name: accessPolicies/${POLICY_ID}/accessLevels/corp_network
title: Corporate Network
description: Access from corporate IP ranges
basic:
  conditions:
    - ipSubnetworks:
        - "203.0.113.0/24"    # HQ
        - "198.51.100.0/24"   # Branch office
        - "192.0.2.0/24"      # Data center
  combiningFunction: OR
EOF

gcloud access-context-manager levels create corp_network \
  --policy=${POLICY_ID} \
  --title="Corporate Network" \
  --basic-level-spec=corp-network-access-level.yaml

# Access for specific users/groups
cat > trusted-users-access-level.yaml <<EOF
name: accessPolicies/${POLICY_ID}/accessLevels/trusted_users
title: Trusted Users
description: Verified users with proper roles
basic:
  conditions:
    - members:
        - "user:admin@example.com"
        - "group:security-team@example.com"
        - "serviceAccount:trusted-sa@project.iam.gserviceaccount.com"
EOF

gcloud access-context-manager levels create trusted_users \
  --policy=${POLICY_ID} \
  --title="Trusted Users" \
  --basic-level-spec=trusted-users-access-level.yaml

# Allow ingress from specific sources
cat > ingress-policy.yaml <<EOF
ingressPolicies:
  - ingressFrom:
      sources:
        - accessLevel: accessPolicies/${POLICY_ID}/accessLevels/corp_network
      identities:
        - serviceAccount:external-service@project.iam.gserviceaccount.com
        - user:external-user@example.com
      identityType: ANY_IDENTITY
    ingressTo:
      resources:
        - projects/123456789
      operations:
        - serviceName: storage.googleapis.com
          methodSelectors:
            - method: "google.storage.objects.get"
            - method: "google.storage.objects.list"
        - serviceName: bigquery.googleapis.com
          methodSelectors:
            - method: "google.cloud.bigquery.v2.JobService.InsertJob"
EOF

# Update perimeter with ingress policy
gcloud access-context-manager perimeters update prod_perimeter \
  --policy=${POLICY_ID} \
  --add-ingress-policies=ingress-policy.yaml

# Allow egress to specific destinations
cat > egress-policy.yaml <<EOF
egressPolicies:
  - egressFrom:
      identities:
        - serviceAccount:data-pipeline@project.iam.gserviceaccount.com
      identityType: ANY_SERVICE_ACCOUNT
    egressTo:
      resources:
        - projects/external-project-id
      operations:
        - serviceName: storage.googleapis.com
          methodSelectors:
            - method: "google.storage.objects.create"
            - method: "google.storage.buckets.get"
      externalResources:
        - "https://external-api.example.com/*"
EOF

# Update perimeter with egress policy
gcloud access-context-manager perimeters update prod_perimeter \
  --policy=${POLICY_ID} \
  --add-egress-policies=egress-policy.yaml

# Create bridge between production and development
gcloud access-context-manager perimeters create prod_dev_bridge \
  --policy=${POLICY_ID} \
  --title="Production to Development Bridge" \
  --perimeter-type=bridge \
  --resources=projects/123456789,projects/987654321 \
  --perimeter-bridges=prod_perimeter,dev_perimeter

# Create spec with dry-run configuration
cat > dry-run-spec.yaml <<EOF
name: accessPolicies/${POLICY_ID}/servicePerimeters/prod_perimeter
status:
  resources:
    - projects/123456789
  restrictedServices:
    - storage.googleapis.com
  accessLevels:
    - accessPolicies/${POLICY_ID}/accessLevels/corp_network
spec:  # Dry-run configuration
  resources:
    - projects/123456789
    - projects/555555555  # New project to test
  restrictedServices:
    - storage.googleapis.com
    - bigquery.googleapis.com  # New service to test
  accessLevels:
    - accessPolicies/${POLICY_ID}/accessLevels/corp_network
EOF

# Update perimeter with dry-run spec
gcloud access-context-manager perimeters update prod_perimeter \
  --policy=${POLICY_ID} \
  --spec-file=dry-run-spec.yaml

# Export dry-run logs
gcloud logging read \
  "protoPayload.metadata.dryRun=true AND protoPayload.metadata.securityPolicyInfo.servicePerimeterName:prod_perimeter" \
  --format=json \
  --limit=1000 > dry-run-violations.json

# After analysis, promote spec to status (apply changes)
gcloud access-context-manager perimeters update prod_perimeter \
  --policy=${POLICY_ID} \
  --promote-spec-to-status

# Or rollback dry-run changes
gcloud access-context-manager perimeters update prod_perimeter \
  --policy=${POLICY_ID} \
  --clear-spec

# Enable Cloud IDS API
gcloud services enable ids.googleapis.com

# Create IDS endpoint
gcloud ids endpoints create ids-endpoint-prod \
  --network=projects/PROJECT_ID/global/networks/prod-vpc \
  --zone=us-central1-a \
  --severity=INFORMATIONAL \
  --enable-traffic-logs

# Describe endpoint
gcloud ids endpoints describe ids-endpoint-prod \
  --zone=us-central1-a

# Get endpoint forwarding rule for packet mirroring
IDS_FORWARDING_RULE=$(gcloud ids endpoints describe ids-endpoint-prod \
  --zone=us-central1-a \
  --format="value(endpointForwardingRule)")

# Create packet mirroring policy pointing to IDS
gcloud compute packet-mirrorings create mirror-to-ids \
  --region=us-central1 \
  --network=prod-vpc \
  --collector-ilb=${IDS_FORWARDING_RULE} \
  --mirrored-subnets=app-subnet,web-subnet \
  --filter-protocols=tcp,udp,icmp

# Verify mirroring policy
gcloud compute packet-mirrorings describe mirror-to-ids \
  --region=us-central1

# Update to only alert on high severity
gcloud ids endpoints update ids-endpoint-prod \
  --zone=us-central1-a \
  --severity=HIGH \
  --async

# Disable traffic logs to reduce cost
gcloud ids endpoints update ids-endpoint-prod \
  --zone=us-central1-a \
  --no-enable-traffic-logs

# Enable Security Command Center
gcloud services enable securitycenter.googleapis.com

# IDS findings automatically sent to SCC
# View findings
gcloud scc findings list ORGANIZATION_ID \
  --filter="category='IDS_THREAT'" \
  --format=json

# Create notification config for IDS findings
gcloud scc notifications create ids-critical-alerts \
  --organization=ORGANIZATION_ID \
  --description="Critical IDS alerts" \
  --pubsub-topic=projects/PROJECT_ID/topics/ids-alerts \
  --filter="severity='CRITICAL' AND category='IDS_THREAT'"

# 1. Create collector internal load balancer
gcloud compute health-checks create tcp collector-health-check \
  --port=12345 \
  --region=us-central1

gcloud compute backend-services create collector-backend \
  --load-balancing-scheme=INTERNAL \
  --protocol=TCP \
  --health-checks=collector-health-check \
  --region=us-central1

# 2. Add collector instances to backend
gcloud compute backend-services add-backend collector-backend \
  --instance-group=collector-ig \
  --instance-group-zone=us-central1-a \
  --region=us-central1

# 3. Create forwarding rule
gcloud compute forwarding-rules create collector-ilb \
  --load-balancing-scheme=INTERNAL \
  --network=prod-vpc \
  --subnet=mgmt-subnet \
  --ip-protocol=TCP \
  --ports=all \
  --backend-service=collector-backend \
  --region=us-central1 \
  --is-mirroring-collector

# 4. Create packet mirroring policy
gcloud compute packet-mirrorings create production-mirror \
  --region=us-central1 \
  --network=prod-vpc \
  --collector-ilb=projects/PROJECT_ID/regions/us-central1/forwardingRules/collector-ilb \
  --mirrored-subnets=web-subnet,app-subnet \
  --mirrored-tags=mirror-enabled \
  --filter-protocols=tcp,udp \
  --filter-cidr-ranges=10.0.0.0/8

# Mirror by instance
gcloud compute packet-mirrorings create instance-mirror \
  --region=us-central1 \
  --network=prod-vpc \
  --collector-ilb=projects/PROJECT_ID/regions/us-central1/forwardingRules/collector-ilb \
  --mirrored-instances=web-1,web-2,web-3

# Mirror by network tag
gcloud compute packet-mirrorings create tag-mirror \
  --region=us-central1 \
  --network=prod-vpc \
  --collector-ilb=projects/PROJECT_ID/regions/us-central1/forwardingRules/collector-ilb \
  --mirrored-tags=production,database

# Collector VM startup script
#!/bin/bash

# Install packet analysis tools
apt-get update
apt-get install -y tcpdump wireshark tshark

# Create capture directory
mkdir -p /var/captures
chmod 755 /var/captures

# Start continuous packet capture
cat > /usr/local/bin/packet-capture.sh <<'EOF'
#!/bin/bash
CAPTURE_DIR="/var/captures"
CAPTURE_TIME=3600  # 1 hour rotation
INTERFACE="eth0"

while true; do
    TIMESTAMP=$(date +%Y%m%d-%H%M%S)
    FILENAME="${CAPTURE_DIR}/capture-${TIMESTAMP}.pcap"

    timeout ${CAPTURE_TIME} tcpdump -i ${INTERFACE} \
        -w ${FILENAME} \
        -G ${CAPTURE_TIME} \
        -W 24 \
        -Z root \
        'not port 22'  # Exclude SSH

    # Compress old captures
    find ${CAPTURE_DIR} -name "*.pcap" -mtime +1 -exec gzip {} \;

    # Delete captures older than 7 days
    find ${CAPTURE_DIR} -name "*.pcap.gz" -mtime +7 -delete
done
EOF

chmod +x /usr/local/bin/packet-capture.sh

# Create systemd service
cat > /etc/systemd/system/packet-capture.service <<EOF
[Unit]
Description=Packet Capture Service
After=network.target

[Service]
Type=simple
User=root
ExecStart=/usr/local/bin/packet-capture.sh
Restart=always

[Install]
WantedBy=multi-user.target
EOF

# Enable and start service
systemctl daemon-reload
systemctl enable packet-capture
systemctl start packet-capture

# Configure log rotation
cat > /etc/logrotate.d/packet-capture <<EOF
/var/log/packet-capture.log {
    daily
    rotate 7
    compress
    missingok
    notifempty
}
EOF

# Monitor HTTP traffic
tcpdump -i eth0 -A 'tcp port 80 or tcp port 443'

# Capture specific protocol
tcpdump -i eth0 -w http-traffic.pcap 'tcp port 80'

# Monitor top talkers
tcpdump -i eth0 -nn -q | \
  awk '{print $3}' | \
  cut -d. -f1-4 | \
  sort | uniq -c | sort -rn | head -20

# Detect SYN flood
tcpdump -i eth0 'tcp[tcpflags] & (tcp-syn) != 0' -c 1000 | \
  awk '{print $3}' | sort | uniq -c | sort -rn

# Filter suspicious traffic
tcpdump -i eth0 -nn 'tcp[tcpflags] & (tcp-rst) != 0'

# Install Suricata on collector instance
apt-get install -y software-properties-common
add-apt-repository -y ppa:oisf/suricata-stable
apt-get update
apt-get install -y suricata

# Configure Suricata
cat > /etc/suricata/suricata.yaml <<EOF
vars:
  address-groups:
    HOME_NET: "[10.0.0.0/8]"
    EXTERNAL_NET: "!$HOME_NET"

default-log-dir: /var/log/suricata/

outputs:
  - eve-log:
      enabled: yes
      filetype: regular
      filename: eve.json
      types:
        - alert
        - http
        - dns
        - tls
        - files
        - ssh

af-packet:
  - interface: eth0
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes

detect-engine:
  - profile: high
  - custom-values:
      toclient-groups: 3
      toserver-groups: 25

rule-files:
  - suricata.rules
  - /etc/suricata/rules/*.rules
EOF

# Download and update rules
suricata-update

# Start Suricata
systemctl enable suricata
systemctl start suricata

# Monitor alerts
tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="alert")'

# Limit mirroring scope to reduce overhead
gcloud compute packet-mirrorings update production-mirror \
  --region=us-central1 \
  --filter-protocols=tcp \
  --filter-cidr-ranges=10.0.10.0/24  # Only app subnet

# Mirror during specific times (use Cloud Scheduler + scripts)
# Enable mirroring
gcloud compute packet-mirrorings update production-mirror \
  --region=us-central1 \
  --enable

# Disable mirroring
gcloud compute packet-mirrorings update production-mirror \
  --region=us-central1 \
  --disable

# Create firewall policy
gcloud compute firewall-policies create corporate-policy \
  --organization=ORG_ID

# Add rule to deny egress to specific IPs
gcloud compute firewall-policies rules create 1000 \
  --firewall-policy=corporate-policy \
  --action=deny \
  --direction=egress \
  --dest-ranges=198.51.100.0/24 \
  --layer4-configs=all

# Associate with folder
gcloud compute firewall-policies associations create \
  --firewall-policy=corporate-policy \
  --folder=FOLDER_ID

# Deny all ingress baseline
gcloud compute firewall-rules create deny-all-ingress \
  --network=vpc \
  --action=deny \
  --direction=ingress \
  --rules=all \
  --priority=65534

# Allow SSH from IAP
gcloud compute firewall-rules create allow-iap-ssh \
  --network=vpc \
  --allow=tcp:22 \
  --source-ranges=35.235.240.0/20 \
  --target-service-accounts=bastion-sa@project.iam.gserviceaccount.com

# Allow internal communication
gcloud compute firewall-rules create allow-internal \
  --network=vpc \
  --allow=tcp:0-65535,udp:0-65535,icmp \
  --source-ranges=10.0.0.0/8

# Using service account targeting
gcloud compute firewall-rules create allow-web \
  --network=vpc \
  --allow=tcp:80,tcp:443 \
  --target-service-accounts=web-sa@project.iam.gserviceaccount.com \
  --source-ranges=0.0.0.0/0

gcloud compute security-policies create rate-limit-policy

# Rate limit rule
gcloud compute security-policies rules create 100 \
  --security-policy=rate-limit-policy \
  --expression="true" \
  --action=rate-based-ban \
  --rate-limit-threshold-count=1000 \
  --rate-limit-threshold-interval-sec=60 \
  --ban-duration-sec=600 \
  --conform-action=allow \
  --exceed-action=deny-403

gcloud compute security-policies rules create 200 \
  --security-policy=geo-policy \
  --expression="origin.region_code == 'CN' || origin.region_code == 'RU'" \
  --action=deny-403

# SQL injection protection
gcloud compute security-policies rules create 300 \
  --security-policy=waf-policy \
  --expression="evaluatePreconfiguredExpr('sqli-v33-stable')" \
  --action=deny-403

# XSS protection
gcloud compute security-policies rules create 400 \
  --security-policy=waf-policy \
  --expression="evaluatePreconfiguredExpr('xss-v33-stable')" \
  --action=deny-403

# Block specific user agents
gcloud compute security-policies rules create 500 \
  --security-policy=custom-policy \
  --expression="request.headers['user-agent'].contains('badbot')" \
  --action=deny-403

# Whitelist specific IPs
gcloud compute security-policies rules create 50 \
  --security-policy=custom-policy \
  --expression="inIpRange(origin.ip, '203.0.113.0/24')" \
  --action=allow

# Enable with all metadata
gcloud compute networks subnets update production-subnet \
  --region=us-central1 \
  --enable-flow-logs \
  --logging-aggregation-interval=interval-5-sec \
  --logging-flow-sampling=1.0 \
  --logging-metadata=include-all \
  --logging-filter-expr='true'

# Enable with custom filter (only capture external traffic)
gcloud compute networks subnets update dmz-subnet \
  --region=us-central1 \
  --enable-flow-logs \
  --logging-aggregation-interval=interval-10-sec \
  --logging-flow-sampling=0.5 \
  --logging-metadata=include-all \
  --logging-filter-expr='inIpRange(connection.src_ip, "0.0.0.0/0") || inIpRange(connection.dest_ip, "0.0.0.0/0")'

# Enable with metadata fields optimization
gcloud compute networks subnets update app-subnet \
  --region=us-central1 \
  --enable-flow-logs \
  --logging-aggregation-interval=interval-15-sec \
  --logging-flow-sampling=0.1 \
  --logging-metadata=include-all \
  --logging-metadata-fields=src_instance,dest_instance,src_vpc,dest_vpc,src_location,dest_location

# Create BigQuery dataset
bq mk --dataset \
  --location=US \
  --description="VPC Flow Logs" \
  PROJECT_ID:vpc_flow_logs

# Create log sink
gcloud logging sinks create vpc-flow-logs-sink \
  bigquery.googleapis.com/projects/PROJECT_ID/datasets/vpc_flow_logs \
  --log-filter='resource.type="gce_subnetwork" AND
    logName:"compute.googleapis.com/vpc_flows"'

# Grant sink service account BigQuery permissions
SERVICE_ACCOUNT=$(gcloud logging sinks describe vpc-flow-logs-sink \
  --format='value(writerIdentity)')

bq show --format=prettyjson PROJECT_ID:vpc_flow_logs > /dev/null

gcloud projects add-iam-policy-binding PROJECT_ID \
  --member=$SERVICE_ACCOUNT \
  --role=roles/bigquery.dataEditor