Cloud ์• ์…‹ ์ธ๋ฒคํ† ๋ฆฌ ๊ฐœ์š”

Cloud ์• ์…‹ ์ธ๋ฒคํ† ๋ฆฌ๋Š” ์ตœ๋Œ€ 35์ผ๊นŒ์ง€์˜ ์ƒ์„ฑ, ์—…๋ฐ์ดํŠธ, ์‚ญ์ œ ๊ธฐ๋ก์ด ํฌํ•จ๋œ Google Cloud ์• ์…‹ ๋ฉ”ํƒ€๋ฐ์ดํ„ฐ๋ฅผ ๋ณด๊ณ  ๊ฒ€์ƒ‰ํ•˜๊ณ  ๋‚ด๋ณด๋‚ด๊ณ  ๋ชจ๋‹ˆํ„ฐ๋งํ•˜๊ณ  ๋ถ„์„ํ•  ์ˆ˜ ์žˆ๋Š” ์ „์—ญ ๋ฉ”ํƒ€๋ฐ์ดํ„ฐ ์ธ๋ฒคํ† ๋ฆฌ ์„œ๋น„์Šค์ž…๋‹ˆ๋‹ค. ์ง€๋‚œ 35์ผ ๋™์•ˆ ๋ณ€๊ฒฝ๋˜์ง€ ์•Š์€ ์• ์…‹์€ ์ตœ์‹  ์ƒํƒœ๋ฅผ ๋ณด๊ณ ํ•ฉ๋‹ˆ๋‹ค.

์• ์…‹ ๋ฉ”ํƒ€๋ฐ์ดํ„ฐ๋Š” ๋‹ค์Œ ์œ„์น˜์—์„œ ์ œ๊ณต๋  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

  • Compute Engine VM ์ธ์Šคํ„ด์Šค, Cloud Storage ๋ฒ„ํ‚ท, App Engine ์ธ์Šคํ„ด์Šค์™€ ๊ฐ™์€ Google Cloud ๋ฆฌ์†Œ์Šค

  • IAM ์ •์ฑ…, ์กฐ์ง ์ •์ฑ…, Access Context Manager ์ •์ฑ…๊ณผ ๊ฐ™์ด Google Cloud ๋ฆฌ์†Œ์Šค์— ์„ค์ •๋œ ์ •์ฑ…

  • OS ์ธ๋ฒคํ† ๋ฆฌ ๊ด€๋ฆฌ์˜ ๋Ÿฐํƒ€์ž„ ์ •๋ณด

์• ์…‹์„ ์‚ฌ์šฉํ•˜๋Š” ๋ฐฉ๋ฒ•์€ ๋‹ค์Œ๊ณผ ๊ฐ™์Šต๋‹ˆ๋‹ค.

์• ์…‹ ์œ ํ˜•, ์• ์…‹ ์ด๋ฆ„, ์ฝ˜ํ…์ธ  ์œ ํ˜•

Cloud ์• ์…‹ ์ธ๋ฒคํ† ๋ฆฌ๋Š” ์• ์…‹๊ณผ ์ƒํ˜ธ์ž‘์šฉํ•˜๋Š” ์—ฌ๋Ÿฌ ๊ฐ€์ง€ ๋ฐฉ๋ฒ•์„ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค. ์‚ฌ์šฉํ•˜๋Š” ๋ฉ”์„œ๋“œ์™€ ์›ํ•˜๋Š” ์‘๋‹ต ์„ธ๋ถ€์ •๋ณด์— ๋”ฐ๋ผ ์š”์ฒญ์— ์• ์…‹ ์œ ํ˜•, ์• ์…‹ ์ด๋ฆ„, ์ฝ˜ํ…์ธ  ์œ ํ˜•์„ ์ง€์ •ํ•ด์•ผ ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

์• ์…‹ ์œ ํ˜•

์ผ๋ถ€ Cloud ์• ์…‹ ์ธ๋ฒคํ† ๋ฆฌ ๋ฉ”์„œ๋“œ๋Š” ์• ์…‹ ์œ ํ˜•์„ ๊ธฐ์ค€์œผ๋กœ ๊ฒฐ๊ณผ๋ฅผ ๋ฐ˜ํ™˜ํ•ฉ๋‹ˆ๋‹ค. ์• ์…‹ ์œ ํ˜•์—๋Š” Google Cloud ๋ฆฌ์†Œ์Šค, ์ •์ฑ…, OS ์ธ๋ฒคํ† ๋ฆฌ ๋Ÿฐํƒ€์ž„ ์ •๋ณด, ๊ด€๊ณ„๊ฐ€ ํฌํ•จ๋ฉ๋‹ˆ๋‹ค. ์‚ฌ์šฉ ๊ฐ€๋Šฅํ•œ ์• ์…‹ ์œ ํ˜•๊ณผ ์ด๋ฅผ ์ง€์›ํ•˜๋Š” Cloud ์• ์…‹ ์ธ๋ฒคํ† ๋ฆฌ ๋ฉ”์„œ๋“œ๋Š” ์• ์…‹ ์œ ํ˜•์— ์ž์„ธํžˆ ์„ค๋ช…๋˜์–ด ์žˆ์Šต๋‹ˆ๋‹ค.

์• ์…‹ ์ด๋ฆ„

์ผ๋ถ€ Cloud ์• ์…‹ ์ธ๋ฒคํ† ๋ฆฌ ๋ฉ”์„œ๋“œ๋Š” ์• ์…‹ ์ด๋ฆ„์„ ๊ธฐ์ค€์œผ๋กœ ๊ฒฐ๊ณผ๋ฅผ ๋ฐ˜ํ™˜ํ•ฉ๋‹ˆ๋‹ค. ์• ์…‹ ์ด๋ฆ„์„ ์ง€์ •ํ•  ๋•Œ๋Š” ์ „์ฒด ๋ฆฌ์†Œ์Šค ์ด๋ฆ„์„ ์‚ฌ์šฉํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. ์ „์ฒด ๋ฆฌ์†Œ์Šค ์ด๋ฆ„ ๋ชฉ๋ก์€ ์• ์…‹ ์ด๋ฆ„์„ ์ฐธ์กฐํ•˜์„ธ์š”.

์ฝ˜ํ…์ธ  ์œ ํ˜•

๋ฉ”ํƒ€๋ฐ์ดํ„ฐ ์ฝ˜ํ…์ธ  ์œ ํ˜•์„ ์ง€์ •ํ•˜์—ฌ ๋ฆฌ์†Œ์Šค์— ๋Œ€ํ•œ ์ถ”๊ฐ€ ๋ฉ”ํƒ€๋ฐ์ดํ„ฐ๋ฅผ ์š”์ฒญํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ์ฝ˜ํ…์ธ  ์œ ํ˜•์„ ์ง€์ •ํ•˜์ง€ ์•Š์œผ๋ฉด ์• ์…‹ ์ด๋ฆ„, ๋งˆ์ง€๋ง‰ ์—…๋ฐ์ดํŠธ ์‹œ๊ฐ„, ์†ํ•ด ์žˆ๋Š” ํ”„๋กœ์ ํŠธ, ํด๋”, ์กฐ์ง๊ณผ ๊ฐ™์€ ์ •๋ณด๊ฐ€ ํฌํ•จ๋œ ๊ธฐ๋ณธ ์‘๋‹ต๋งŒ ๋ฐ˜ํ™˜๋ฉ๋‹ˆ๋‹ค.

์ฝ˜ํ…์ธ  ์œ ํ˜• ์ด๋ฆ„์€ Cloud ์• ์…‹ ์ธ๋ฒคํ† ๋ฆฌ์™€ ์ƒํ˜ธ์ž‘์šฉํ•˜๋Š” ๋ฐฉ์‹์— ๋”ฐ๋ผ ๋‹ค๋ฆ…๋‹ˆ๋‹ค. RPC ์ด๋ฆ„๊ณผ REST API ์ด๋ฆ„์€ ๊ฐ™์Šต๋‹ˆ๋‹ค. ๊ทธ๋Ÿฌ๋‚˜ gcloud CLI ์ฝ˜ํ…์ธ  ์œ ํ˜• ์ด๋ฆ„์€ ๋‹ค๋ฅธ ํŒจํ„ด์„ ๋”ฐ๋ฆ…๋‹ˆ๋‹ค. ์ผ๊ด€์„ฑ๊ณผ ์„ค๋ช… ์šฉ์ด์„ฑ์„ ์œ„ํ•ด ์ด ๋ฌธ์„œ์˜ ๋‚˜๋จธ์ง€ ๋ถ€๋ถ„์—์„œ๋Š” ์ฝ˜ํ…์ธ  ์œ ํ˜•์„ RPC ์ด๋ฆ„๊ณผ REST ์ด๋ฆ„์œผ๋กœ ์ฐธ์กฐํ•ฉ๋‹ˆ๋‹ค.

๋‹ค์Œ ํ‘œ์—์„œ๋Š” ์ฝ˜ํ…์ธ  ์œ ํ˜•๊ณผ ์„ค๋ช…์„ ์ž์„ธํžˆ ์„ค๋ช…ํ•ฉ๋‹ˆ๋‹ค.

์ฝ˜ํ…์ธ  ์œ ํ˜• ์„ค๋ช…
RPC ๋ฐ REST ์ด๋ฆ„ gcloud CLI ์ด๋ฆ„  
ACCESS_POLICY access-policy ์• ์…‹์— ์„ค์ •๋œ Access Context Manager ์ •์ฑ…์ž…๋‹ˆ๋‹ค.
IAM_POLICY iam-policy ๋ฆฌ์†Œ์Šค์— ๋ฐ”์ธ๋”ฉ๋˜๋Š” IAM ์ •์ฑ… ๋ฉ”ํƒ€๋ฐ์ดํ„ฐ์ž…๋‹ˆ๋‹ค.
ORG_POLICY org-policy ์• ์…‹์— ์„ค์ •๋œ ์กฐ์ง ์ •์ฑ… ๋ฉ”ํƒ€๋ฐ์ดํ„ฐ์ž…๋‹ˆ๋‹ค. ์ด ์ฝ˜ํ…์ธ  ์œ ํ˜•์€ ๊ธฐ์กด ์กฐ์ง ์ •์ฑ… v1์„ ์ถœ๋ ฅํ•ฉ๋‹ˆ๋‹ค. ์กฐ์ง ์ •์ฑ… v2์˜ ๊ฒฝ์šฐ resource ์ฝ˜ํ…์ธ  ์œ ํ˜•๊ณผ orgpolicy.googleapis.com/Policy ๋ฆฌ์†Œ์Šค ์œ ํ˜•์„ ์‚ฌ์šฉํ•ด ๋ณด์„ธ์š”.
OS_INVENTORY os-inventory ๋Ÿฐํƒ€์ž„ OS ์ธ๋ฒคํ† ๋ฆฌ ์ •๋ณด์ž…๋‹ˆ๋‹ค. OS ์ธ๋ฒคํ† ๋ฆฌ๋ฅผ ์‚ฌ์šฉ ์„ค์ •ํ•˜๋ ค๋ฉด VM Manager ์„ค์ •์˜ ๊ด€๋ จ ๋‹จ๊ณ„๋ฅผ ์™„๋ฃŒํ•ฉ๋‹ˆ๋‹ค.
RELATIONSHIP relationship

Security Command Center ํ”„๋ฆฌ๋ฏธ์—„ ๋ฐ ์—”ํ„ฐํ”„๋ผ์ด์ฆˆ ๋“ฑ๊ธ‰ ๊ตฌ๋…์ž๋งŒ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

๋งŽ์€ Google Cloud ์• ์…‹์€ ๊ด€๊ณ„๋ฅผ ํ†ตํ•ด ์„œ๋กœ ์—ฐ๊ฒฐ๋ฉ๋‹ˆ๋‹ค. ์˜ˆ๋ฅผ ๋“ค์–ด Compute ์ธ์Šคํ„ด์Šค ๊ทธ๋ฃน์€ ์ปดํ“จํŒ… ์ธ์Šคํ„ด์Šค๋ฅผ ํฌํ•จํ•˜๊ฑฐ๋‚˜ GKE ํด๋Ÿฌ์Šคํ„ฐ๋Š” ๋…ธ๋“œ๋ฅผ ํฌํ•จํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

๊ด€๊ณ„ ๋ฐ์ดํ„ฐ๋Š” 2022๋…„ 5์›” 30์ผ๋ถ€ํ„ฐ ์ œ๊ณต๋ฉ๋‹ˆ๋‹ค. ๊ด€๊ณ„๋Š” ์†Œ์Šค ์• ์…‹ ์—…๋ฐ์ดํŠธ์™€ ๋‹ค๋ฅธ ์‹œ๊ฐ„์— ์ถ”๋ก ๋  ์ˆ˜ ์žˆ์œผ๋ฏ€๋กœ ์ž์ฒด ์—…๋ฐ์ดํŠธ ํƒ€์ž„์Šคํƒฌํ”„๋ฅผ ๊ฐ€์งˆ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

์ง€์›๋˜๋Š” ๊ด€๊ณ„ ๋ชฉ๋ก์€ ๊ด€๊ณ„ ์œ ํ˜•์„ ์ฐธ์กฐํ•˜์„ธ์š”.

RESOURCE resource ๋ฆฌ์†Œ์Šค ๋ฉ”ํƒ€๋ฐ์ดํ„ฐ์ž…๋‹ˆ๋‹ค.

์ฝ˜ํ…์ธ  ์œ ํ˜•์— ๋”ฐ๋ผ ์‘๋‹ต์ด ๋ณ€๊ฒฝ๋˜๋Š” ๋ฐฉ์‹

๋‹ค์Œ ์˜ˆ์‹œ์—์„œ๋Š” Cloud ์• ์…‹ ์ธ๋ฒคํ† ๋ฆฌ๋ฅผ ํ†ตํ•ด ํ”„๋กœ์ ํŠธ์— ๋‹ค์–‘ํ•œ ์ฝ˜ํ…์ธ  ์œ ํ˜•์œผ๋กœ VM ์ธ์Šคํ„ด์Šค๋ฅผ ๋‚˜์—ดํ•  ๋•Œ ์‘๋‹ต์ด ์–ด๋–ป๊ฒŒ ๋ณ€๊ฒฝ๋˜๋Š”์ง€ ๋ณด์—ฌ์ค๋‹ˆ๋‹ค.

์ฝ˜ํ…์ธ  ์œ ํ˜• ์—†์Œ

VM ์ธ์Šคํ„ด์Šค๋ฅผ ๋‚˜์—ดํ•  ๋•Œ ์ฝ˜ํ…์ธ  ์œ ํ˜•์„ ์ง€์ •ํ•˜์ง€ ์•Š์œผ๋ฉด ์ธ์Šคํ„ด์Šค ์ด๋ฆ„, ๋งˆ์ง€๋ง‰ ์—…๋ฐ์ดํŠธ ์‹œ๊ฐ„, ์ธ์Šคํ„ด์Šค๊ฐ€ ์†ํ•œ ํ”„๋กœ์ ํŠธ, ํด๋”, ์กฐ์ง๋งŒ ์ˆ˜์‹ ๋ฉ๋‹ˆ๋‹ค.

์‘๋‹ต ์˜ˆ์‹œ ํŽผ์น˜๊ธฐ

---
ancestors:
- projects/PROJECT_NUMBER
- folders/FOLDER_NUMBER
- organizations/ORGANIZATION_ID
assetType: compute.googleapis.com/Instance
name: //compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_NAME
updateTime: '2023-11-15T12:28:30.087825Z'

IAM_POLICY ์ฝ˜ํ…์ธ  ์œ ํ˜•

IAM_POLICY ์ฝ˜ํ…์ธ  ์œ ํ˜•์„ ์ง€์ •ํ•˜๋ฉด VM์— ์žˆ๋Š” IAM ๋ฐ”์ธ๋”ฉ๋„ ์ˆ˜์‹ ๋ฉ๋‹ˆ๋‹ค(์žˆ๋Š” ๊ฒฝ์šฐ).

์‘๋‹ต ์˜ˆ์‹œ ํŽผ์น˜๊ธฐ

---
ancestors:
- projects/PROJECT_NUMBER
- folders/FOLDER_NUMBER
- organizations/ORGANIZATION_ID
assetType: compute.googleapis.com/Instance
iamPolicy:
  bindings:
  - members:
    - user:USER_EMAIL_ADDRESS
    role: roles/compute.securityAdmin
  etag: ETAG
name: //compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_NAME
updateTime: '2023-12-19T23:35:42.673842Z'

RESOURCE ์ฝ˜ํ…์ธ  ์œ ํ˜•

RESOURCE ์ฝ˜ํ…์ธ  ์œ ํ˜•์„ ์ง€์ •ํ•˜๋ฉด VM๊ณผ ์—ฐ๊ฒฐ๋œ ๋ชจ๋“  ๋ฉ”ํƒ€๋ฐ์ดํ„ฐ๋„ ์ˆ˜์‹ ๋ฉ๋‹ˆ๋‹ค.

์‘๋‹ต ์˜ˆ์‹œ ํŽผ์น˜๊ธฐ

---
ancestors:
- projects/PROJECT_NUMBER
- folders/FOLDER_NUMBER
- organizations/ORGANIZATION_ID
assetType: compute.googleapis.com/Instance
name: //compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_NAME
resource:
  data:
    allocationAffinity:
      consumeAllocationType: ANY_ALLOCATION
    canIpForward: false
    confidentialInstanceConfig:
      enableConfidentialCompute: true
    cpuPlatform: AMD Rome
    creationTimestamp: '2023-11-14T14:35:37.059-08:00'
    deletionProtection: false
    description: ''
    disks:
    - architecture: X86_64
      autoDelete: true
      boot: true
      deviceName: INSTANCE_NAME
      diskSizeGb: '10'
      guestOsFeatures:
      - type: VIRTIO_SCSI_MULTIQUEUE
      - type: SEV_CAPABLE
      - type: SEV_SNP_CAPABLE
      - type: SEV_LIVE_MIGRATABLE
      - type: UEFI_COMPATIBLE
      - type: GVNIC
      index: 0
      interface: NVME
      licenses:
      - https://www.googleapis.com/compute/v1/projects/ubuntu-os-cloud/global/licenses/ubuntu-2004-lts
      mode: READ_WRITE
      shieldedInstanceInitialState:
        dbx:
        - content: DATA
          fileType: BIN
        dbxs:
        - content: DATA
          fileType: BIN
      source: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/disks/INSTANCE_NAME
      type: PERSISTENT
    displayDevice:
      enableDisplay: false
    fingerprint: FINGERPRINT
    id: 'ID'
    keyRevocationActionType: NONE_ON_KEY_REVOCATION
    labelFingerprint: LABEL_FINGERPRINT
    lastStartTimestamp: '2023-11-15T04:28:30.005-08:00'
    machineType: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/machineTypes/n2d-standard-2
    name: INSTANCE_NAME
    networkInterfaces:
    - accessConfigs:
      - name: External NAT
        natIP: 34.27.105.222
        networkTier: PREMIUM
        type: ONE_TO_ONE_NAT
      fingerprint: jKU51FdTluk=
      name: nic0
      network: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/global/networks/default
      networkIP: 10.128.15.212
      nicType: GVNIC
      stackType: IPV4_ONLY
      subnetwork: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/subnetworks/default
    reservationAffinity:
      consumeReservationType: ANY_ALLOCATION
    resourceStatus: {}
    scheduling:
      automaticRestart: true
      onHostMaintenance: TERMINATE
      preemptible: false
      provisioningModel: STANDARD
    selfLink: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_NAME
    serviceAccounts:
    - email: PROJECT_NUMBER-compute@developer.gserviceaccount.com
      scopes:
      - https://www.googleapis.com/auth/devstorage.read_only
      - https://www.googleapis.com/auth/logging.write
      - https://www.googleapis.com/auth/monitoring.write
      - https://www.googleapis.com/auth/servicecontrol
      - https://www.googleapis.com/auth/service.management.readonly
      - https://www.googleapis.com/auth/trace.append
    shieldedInstanceConfig:
      enableIntegrityMonitoring: true
      enableSecureBoot: false
      enableVtpm: true
    shieldedInstanceIntegrityPolicy:
      updateAutoLearnPolicy: true
    startRestricted: false
    status: RUNNING
    tags:
      fingerprint: FINGERPRINT
    zone: https://www.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE
  discoveryDocumentUri: https://www.googleapis.com/discovery/v1/apis/compute/v1/rest
  discoveryName: Instance
  location: ZONE
  parent: //cloudresourcemanager.googleapis.com/projects/PROJECT_NUMBER
  version: v1
updateTime: '2023-11-15T12:28:30.087825Z'

RELATIONSHIP ์ฝ˜ํ…์ธ  ์œ ํ˜•

Security Command Center ํ”„๋ฆฌ๋ฏธ์—„ ๋ฐ ์—”ํ„ฐํ”„๋ผ์ด์ฆˆ ๋“ฑ๊ธ‰ ๊ตฌ๋…์ž๋งŒ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

RELATIONSHIP ์ฝ˜ํ…์ธ  ์œ ํ˜•์„ ์ง€์ •ํ•˜๋ฉด VM ์ธ์Šคํ„ด์Šค ๊ด€๋ จ ์• ์…‹๊ณผ ์—ฐ๊ฒฐ๋œ ๋ฉ”ํƒ€๋ฐ์ดํ„ฐ๋„ ์ˆ˜์‹ ๋ฉ๋‹ˆ๋‹ค.

์‘๋‹ต ์˜ˆ์‹œ ํŽผ์น˜๊ธฐ

---
ancestors:
- projects/PROJECT_NUMBER
- folders/FOLDER_NUMBER
- organizations/ORGANIZATION_ID
assetType: compute.googleapis.com/Instance
name: //compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/instances/INSTANCE_NAME
relatedAsset:
  ancestors:
  - projects/PROJECT_NUMBER
  - folders/FOLDER_NUMBER
  - organizations/ORGANIZATION_ID
  asset: //compute.googleapis.com/projects/PROJECT_ID/zones/ZONE/disks/INSTANCE_NAME
  assetType: compute.googleapis.com/Disk
  relationshipType: COMPUTE_INSTANCE_USE_DISK
updateTime: '2023-12-19T23:35:42.673842Z'

RELATIONSHIP ์ฝ˜ํ…์ธ  ์œ ํ˜•์„ ์‚ฌ์šฉํ•  ๋•Œ๋Š” ๋ชจ๋“  ๊ด€๊ณ„๋ฅผ ์š”์ฒญํ•˜๋Š” ๋Œ€์‹  ํŠน์ • ๊ด€๊ณ„ ์œ ํ˜•์„ ์š”์ฒญํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

๋‹ค์Œ ๋‹จ๊ณ„