Configure granular access within VMs

Prepare the environment

Before you can grant access to the auth.log file, you need to create some VMs.

Create three VMs using the gcloud compute instances bulk create command:

gcloud compute instances bulk create \
    --name-pattern=tutorial-# \
    --zone=us-west1-a \
    --count=3 \
    --labels=vm=tutorial \
    --metadata=enable-oslogin=TRUE

You see a message similar to the following:

`Bulk create request finished with status message: [VM instances created: 3, failed: 0.]`

Set group permissions for the auth.log file

To grant a user read access to the auth.log file without granting them the roles/compute.osAdminLogin IAM role, change the group which owns the file to a Linux group that the user is a member of.

Create an OS Login Linux group

You can create an OS Login Linux group to add a supplementary Linux group that appears on each VM that has OS Login enabled. By creating an OS Login Linux group instead of a local supplementary Linux group, you can control the Linux group on all VMs in a unified way.

To create an OS Login Linux group use the gcloud beta identity groups create command:

gcloud beta identity groups create logaccess@ORGANIZATION_DOMAIN \
    --organization=ORGANIZATION_DOMAIN \
    --posix-group=gid=12345,name=logaccess

Replace ORGANIZATION_DOMAIN with the domain (example.com) associated with your organization.

Create an OS policy assignment

You can use OS policies to automate and centralize the configuration of your VMs. You apply OS policies to VMs using OS policy assignments. By creating an OS policy assignment with an OS policy that changes the default group of the auth.log file, you can change the default group of the auth.log file in multiple VMs at once, instead of applying the change to one VM at a time.

To create an OS policy assignment, do the following:

1. Open a terminal on your workstation.

2. Create an OS policy assignment .yaml file by running the following command:

   touch tutorial-os-policy-assignment.yaml
   

3. Open the tutorial-os-policy-assignment.yaml file in a text editor and add the following specifications:

   # OS policy assignment that sets the /var/log/auth.log group to logaccess.
   osPolicies:
    - id: log-access-policy
      mode: ENFORCEMENT
      resourceGroups:
          resources:
            - id: grant-log-access
              exec:
                validate:
                  # Checks if the group is logaccess. If yes, exits  with code 100. If no,
                  # exits with code 101 and proceeds to the `enforce` step.
                  script:
                    if stat -c '%G' /var/log/auth.log | grep -q 'logaccess'; then exit 100; else exit 101; fi
                  interpreter: SHELL
                enforce:
                  # Changes the group to logaccess and exits with code 100.
                  script:
                    chgrp logaccess /var/log/auth.log && exit 100
   instanceFilter:
    inclusionLabels:
      - labels:
          vm: tutorial
   rollout:
    disruptionBudget:
      fixed: 10
    minWaitDuration: 30s
   

Apply the OS policy assignment to VMs

To apply the OS policy assignment to your VMs, do the following:

1. Apply the OS policy using the gcloud compute os-config os-policy-assignments create command:

   gcloud compute os-config os-policy-assignments create log-access-assignment \
      --location=us-west1-a \
      --file=log-access-os-policy-assignment.yaml \
      --async
   

   The OS policy assignment rolls out to the VMs as per the rollout specifications mentioned in the tutorial-os-policy-assignment.yaml file.

2. Confirm that the OS policy assignment successfully rolled out to the VMs and that the OS policy assignment successfully updated the default group using the gcloud compute os-config os-policy-assignment-reports list command:

   gcloud compute os-config os-policy-assignment-reports list --location=us-west1-a
   

Add users to the OS Login Linux group

When you add a user to an OS Login Linux group, the user inherits the permissions of the group in all VMs that have OS Login enabled. For this tutorial, any user that you add to the logaccess group can view the auth.log file without the roles/compute.osAdminLogin IAM role.

View the Cloud Identity Help documentation to learn how to add a user to the logaccess group.