Opal + Google Cloud Platform

GCP Compute

Opal leverages Google Cloud IAM capabilities to grant temporary and auditable access to virtual machines hosted using Google's Cloud Compute managed service. We automatically discover virtual machines you want to manage and allow developers to request access to them. Since this method of granting access is native to Google Cloud, it doesn't require managing private/public keys and gives you more time to ship your products.

GCP GKE

Opal lets you define fine-grained access controls to Kubernetes clusters on GKE allowing you to set specific permissions to and policies to Google Cloud users . This simplifies and unifies access controls to clusters while enabling developers to connect easily and request new access to many different clusters.

Buckets

Within a specific project, Google Cloud Storage buckets often contain sensitive data that needs to be monitored carefully. Using Opal, you're able to grant read or write-level access for specific buckets by pushing a single button in Slack.

Projects & Folders

Using Opal, you can grant temporary access to pre-defined and custom roles to all of your sensitive GCP Projects & Folders. When granting access to specific projects, Opal automatically double-checks the specific Google Cloud user has the policy attached to them once a resource owner approves their request in Slack. Access to folders works similarly, and granting access to the top-level cascades down to all projects and folders within it.‍

‍Use cases

• Implement Least Privilege - With Opal, customers are able to adopt granular and ephemeral access to critical resources
• Accelerate Access Requests - Customers can delegate approvals to resource owners/managers and accelerate approvals via one-click in Slack
• Streamline User Onboarding - Integrated with popular identity providers, customers can bind resource level access to native group structures
• Configure break glass access - Opal enables customers to automate emergency break-glass access via integrations with on-call providers and manual pre-approvals
• Automate Access Reviews - Opal offers end-to-end automation for user access reviews -  snapshotting user lists, notifying reviewers, providing a self-service review workflow, and generating automated reports

How it works

You can set up the GCP integration in minutes:

• Select Amazon Web Services from the Application catalog
• Create a service account for Opal
• Enable the IAM API in GCP
• Upload your service account credentials