Overview

Gemini for Google Cloud is an always-on AI collaborator that provides help to users of all skill levels where they need it. In this lab, you will learn how to identify and remediate security misconfigurations in your Google Cloud environment using Security Command Center's Gemini features.

Objectives

In this lab, you will learn how to perform the following tasks:

• Enable Gemini in a Google Cloud project
• Deploy example workloads into an environment in Google Cloud
• Identify security misconfigurations with Gemini
• Remediate security misconfigurations with Gemini

Scenario

As you monitor your infrastructure for ways to improve your security posture, Gemini can help identify infrastructure or configuration changes that will prevent issues in the future.

In this example, consider that you are a security engineer at an ecommerce company where managed Kubernetes clusters are regularly deployed. You need a way to see if there are any misconfigurations, and you want quick instructions to help fix those issues in your cloud environment.

Setup and requirements

For each lab, you get a new Google Cloud project and set of resources for a fixed time at no cost.

1. Click the Start Lab button. If you need to pay for the lab, a pop-up opens for you to select your payment method. On the left is the Lab Details panel with the following:

   • The Open Google Cloud console button
   • Time remaining
   • The temporary credentials that you must use for this lab
   • Other information, if needed, to step through this lab

2. Click Open Google Cloud console (or right-click and select Open Link in Incognito Window if you are running the Chrome browser).

   The lab spins up resources, and then opens another tab that shows the Sign in page.

   Tip: Arrange the tabs in separate windows, side-by-side.

   Note: If you see the Choose an account dialog, click Use Another Account.

3. If necessary, copy the Username below and paste it into the Sign in dialog.

   {{{user_0.username | "Username"}}}

   You can also find the Username in the Lab Details panel.

4. Click Next.

5. Copy the Password below and paste it into the Welcome dialog.

   {{{user_0.password | "Password"}}}

   You can also find the Password in the Lab Details panel.

6. Click Next.

   Important: You must use the credentials the lab provides you. Do not use your Google Cloud account credentials. Note: Using your own Google Cloud account for this lab may incur extra charges.

7. Click through the subsequent pages:

   • Accept the terms and conditions.
   • Do not add recovery options or two-factor authentication (because this is a temporary account).
   • Do not sign up for free trials.

After a few moments, the Google Cloud console opens in this tab.

Note: To view a menu with a list of Google Cloud products and services, click the Navigation menu at the top-left, or type the service or product name in the Search field.

Task 1. Enable Gemini

You will first enable Gemini in your Google Cloud project and configure the necessary permissions for your Google Cloud Qwiklabs user account.

1. Click on the Cloud Shell icon () in the top-right corner of the Google Cloud console toolbar.

2. To set your project ID and region environment variables, run the following commands:

3. To store the signed-in Google user account in an environment variable, run the following command:

4. Click Authorize if prompted.

5. Enable the Cloud AI Companion API for Gemini:

6. To use Gemini, grant the necessary IAM roles to your Google Cloud Qwiklabs user account:

Adding these roles lets the user use Gemini assistance.

Click Check my progress to verify your performed task. Enable Gemini

Task 2. Create a GKE cluster and deploy a web app

You will now be creating a Google Kubernetes Engine (GKE) cluster running a handful of microservices.

1. Run the following command to create a GKE cluster named test:

This should take a few minutes. Upon completion, you should see a result similar to the following:

2. Now, clone a repository that contains code for a web app:

3. Use kubectl to deploy a set of microservices to the GKE cluster:

4. After a couple minutes, run the following command to get the public IP address to access your web app in a browser:

5. Copy the IP address from the output of the above command and paste it into a new browser tab.

You should see a web app similar to the following:

Click Check my progress to verify your performed task. Create a GKE cluster and deploy a web app

Task 3. Identify security misconfigurations with Gemini

Now that you have an existing GKE cluster running an ecommerce app, you will identify areas where you can improve your security posture with Gemini.

1. Return to your tab with the Google Cloud console.

2. Refresh the Google Cloud console page.

3. Minimize the Cloud Shell pane.

4. Click on the Gemini icon () in the top-right corner of the Google Cloud console toolbar.

5. Click Start Chatting.

6. Enter the following prompt:

Gemini should respond with something similar to the following:

In this scenario, you decide that Security Command Center sounds like the right place to start.

7. Open the Navigation menu and select Security > Risk Overview.

With multiple visualizations discussing vulnerabilities, you want to ask Gemini to help you quickly understand what is classified as a vulnerability in Security Command Center.

8. Enter the following prompt:

Gemini's response should be similar to the following:

9. Click on the documentation link to better disambiguate between finding classes.

10. After reading about them, close the tab and return to the Google Cloud console.

11. Click Findings from the sidebar of the Google Cloud console.

12. To see the findings for your GKE cluster, find the "Quick Filters" section and select Google container cluster under Resource Type.

You should see a number of Medium severity findings.

13. Click on the Cluster secrets encryption disabled finding.

At the top of this finding panel, you should see a section titled "Description" with a summary similar to the following:

14. Exit out of this information panel.

15. Next, click on the Over privileged account finding and view the summary in the description which is similar to the following:

16. Exit out of this information panel.

17. Finally, click on the Master authorized networks disabled finding. You should see a description similar to the following:

18. Exit out of this information panel.

Now that you have an understanding of some of your environment's security misconfigurations, you will leverage Gemini's recommendations to remediate them.

Task 4. Remediate a security misconfiguration

Now that you have had the opportunity to review multiple areas to begin improving the security of your GKE cluster, you will remediate the "Master authorized networks disabled" finding using the instructions provided by Gemini's summary in Security Command Center.

1. Open the Navigation menu and select Kubernetes Engine > Clusters.

2. Click the name of the cluster you created earlier ("test").

3. Scroll down to the Control Plane Networking section.

4. Click on the pencil icon to edit Control plane networking.

5. Check the box next to Enable authorized networks.

6. Check the box underneath Add Google Cloud external IP addresses to authorized networks.

7. Click Save changes.

8. Click Clusters in the sidebar.

You will see cluster being updated, shown by a spinning wheel or half green circle icon in the Status section.

9. While the network policy updates for the control plane take place, open Gemini from the Google Cloud console toolbar.

10. Enter the following prompt:

Gemini's response should be similar to the following:

Applying the updated control plane policy may take a few minutes to take effect.

11. Once you see a green checkmark in the Status column next to your cluster, you have successfully updated your cluster configuration.

Click Check my progress to verify your performed task. Remediate a security misconfiguration

End your lab

When you have completed your lab, click End Lab. Qwiklabs removes the resources you’ve used and cleans the account for you.

You will be given an opportunity to rate the lab experience. Select the applicable number of stars, type a comment, and then click Submit.

The number of stars indicates the following:

• 1 star = Very dissatisfied
• 2 stars = Dissatisfied
• 3 stars = Neutral
• 4 stars = Satisfied
• 5 stars = Very satisfied

You can close the dialog box if you don't want to provide feedback.

For feedback, suggestions, or corrections, please use the Support tab.

Copyright 2024 Google LLC All rights reserved. Google and the Google logo are trademarks of Google LLC. All other company and product names may be trademarks of the respective companies with which they are associated.