This page provides an overview of security considerations for NFS or SMB access of Cloud Volumes Service.
For more information, see Security overview - NetApp Cloud Volumes Service in Google Cloud. This technical report from NetApp covers the security architecture of Cloud Volumes Service and the security basics of network file system (NFS) and server message block (SMB) operations.
Firewall rules
Google Cloud has strict inbound firewall rules that are categorized as default and implied. Every VPC network has two implied firewall rules. Understanding the implied rules help you manage access to the cloud volumes.
- The implied allow egress rule: The rule's action is to
allow, the destination IP range is0.0.0.0/0, and the priority is the lowest possible (65535). It lets any instance send traffic to any destination. You can restrict outbound access with a firewall rule that has a higher priority. Internet access is permitted if no other firewall rules deny the outbound traffic and if the instance has an external IP address or uses a NAT instance. See Internet access requirements for more details. - The implied deny ingress rule: The rule's action is to
deny, the source is0.0.0.0/0, and the priority is the lowest possible (65535). It protects all instances by blocking incoming traffic to them. You can permit incoming access with a firewall rule that has a higher priority. Note that the default network includes some additional rules that override this rule to permit certain types of incoming traffic.
NFS access
NFS uses various ports to communicate between the initiator and a target. To ensure proper communication and successful volume mount, you must enable these ports on the VPC firewalls. If you have a local firewall enabled, you must also enable these ports on the compute instance. The required ports are as follows:
111 TCP/UDP portmapper2049 TCP/UDP nfsd635 TCP/UDP mountd4045 TCP/UDP nlockmgr4046 TCP/UDP status
Volumes of the CVS service type don't support NFS traffic over UDP.
SMB access
SMB uses various ports to communicate between the initiator and a target. To ensure proper communication and successful volume mapping, you must enable these ports on the VPC firewalls. If you have a local firewall enabled, you must also enable these ports on the compute instance. The required ports are as follows:
135 TCP msrpc445 TCP SMB2/340001 TCP SMB witness
Port 135/TCP and 40001/TCP are only used for Witness protocol communication for SMB 3.x continuously available (CA) shares. These ports are not required for non-CA shares.
Port 139/TCP is exposed by the service, but not used.
Communication between Cloud Volumes Service and Active Directory
Google Cloud has strict inbound firewall rules that are categorized as default and implied. Every VPC network has two implied firewall rules. Understanding the implied rules help you manage access to the cloud volumes.
- The implied allow egress rule: The rule's action is to
allow, the destination IP range is0.0.0.0/0, and the priority is the lowest possible (65535). It lets any instance send traffic to any destination. You can restrict outbound access with a firewall rule that has a higher priority. Internet access is permitted if no other firewall rules deny the outbound traffic and if the instance has an external IP address or uses a NAT instance. See Internet access requirements for more details. - The implied deny ingress rule: The rule's action is to
deny, the source is0.0.0.0/0, and the priority is the lowest possible (65535). It protects all instances by blocking incoming traffic to them. You can permit incoming access with a firewall rule that has a higher priority. Note that the default network includes some additional rules that override this rule to permit certain types of incoming traffic.
You must create a set of inbound rules to enable Cloud Volumes Service to initiate communication with the AD domain controllers. You must add these rules to the security groups that are attached to each AD instance to enable inbound communication from the storage subnet CIDR or the specific IP address. You must open these required ports with firewall rules to enable the CIDR range to access Cloud Volumes Service.
The required ports are as follows:
ICMPV4DNS 53 TCPDNS 53 UDPLDAP 389 TCPLDAP 389 UDPLDAP (GC) 3268 TCPSAM/LSA 445 TCPSAM/LSA 445 UDPSecure LDAP 636 TCPSecure LDAP 3269 TCPW32Time 123 UDPAD Web Svc 9389 TCPKerberos 464 TCPKerberos 464 UDPKerberos 88 TCPKerberos 88 UDP
NetApp Cloud Volumes Service for Google Cloud supports Netlogon RPC Sealing, see Microsoft Security Vulnerability CVE-2022-38023.
Permissions for Cloud Volumes Service
Cloud Volumes Service uses Identity and Access Management (IAM) to control access to resources.
Permissions are granted by the role selected for the user. By granting a role,
you grant the user the permissions contained in the role. The two predefined
roles are netappcloudvolumes.admin and netappcloudvolumes.viewer. You can
assign these roles to specific users or service accounts.
Cloud Volumes Service supports a granular set of permissions.
netappcloudvolumes.admin: This role contains all permissions.netappcloudvolumes.viewer: This role contains read-only permissions.
Permissions can be added to Google Cloud Identity and Access Management custom roles.
Cloud Volumes Service supports a granular set of permissions. These granular permissions are combined into two predefined roles, and these permissions can be added to Google Cloud IAM custom roles.
To learn more, refer to permissions and roles in the IAM overview.
All granular permissions are listed below:
cloudvolumesgcp-api.netapp.com/activeDirectories.createcloudvolumesgcp-api.netapp.com/activeDirectories.deletecloudvolumesgcp-api.netapp.com/activeDirectories.getcloudvolumesgcp-api.netapp.com/activeDirectories.listcloudvolumesgcp-api.netapp.com/activeDirectories.updatecloudvolumesgcp-api.netapp.com/ipRanges.listcloudvolumesgcp-api.netapp.com/jobs.getcloudvolumesgcp-api.netapp.com/jobs.listcloudvolumesgcp-api.netapp.com/regions.listcloudvolumesgcp-api.netapp.com/serviceLevels.listcloudvolumesgcp-api.netapp.com/snapshots.createcloudvolumesgcp-api.netapp.com/snapshots.deletecloudvolumesgcp-api.netapp.com/snapshots.getcloudvolumesgcp-api.netapp.com/snapshots.listcloudvolumesgcp-api.netapp.com/snapshots.updatecloudvolumesgcp-api.netapp.com/volumereplication.authorizecloudvolumesgcp-api.netapp.com/volumereplication.breakcloudvolumesgcp-api.netapp.com/volumereplication.createcloudvolumesgcp-api.netapp.com/volumereplication.deletecloudvolumesgcp-api.netapp.com/volumereplication.getcloudvolumesgcp-api.netapp.com/volumereplication.listcloudvolumesgcp-api.netapp.com/volumereplication.releasecloudvolumesgcp-api.netapp.com/volumereplication.resynccloudvolumesgcp-api.netapp.com/volumereplication.updatecloudvolumesgcp-api.netapp.com/volumes.createcloudvolumesgcp-api.netapp.com/volumes.deletecloudvolumesgcp-api.netapp.com/volumes.getcloudvolumesgcp-api.netapp.com/volumes.listcloudvolumesgcp-api.netapp.com/volumes.updateresourcemanager.projects.getresourcemanager.projects.list
Add Cloud Volumes Service roles to a user
To grant a user the netappcloudvolumes.admin role, use the following command,
substituting the appropriate user name and project ID for myuser@myorg.com and
my-project.
gcloud projects add-iam-policy-binding my-project \
--member='user:myuser@myorg.com' \
--role='roles/netappcloudvolumes.admin'
To grant a user the netappcloudvolumes.viewer role, use the following command,
substituting the appropriate user name and project ID for myuser@myorg.com and
my-project.
gcloud projects add-iam-policy-binding my-project \
--member='user:myuser@myorg.com' \
--role='roles/netappcloudvolumes.viewer'
Add Cloud Volumes Service permissions to a Google Cloud IAM custom role
To grant specific permissions to a user, you need to configure a Google Cloud IAM custom role, assign specific CVS permissions to the role, and then add the custom role to one or more users.
If a custom IAM role is already configured, you can skip this step.
Configure a Google Cloud IAM custom role using the Cloud console or the Cloud Shell commands.
Assign specific CVS permissions to the custom role:
- While viewing the role details, select Edit role from the top menu.
- On the Edit role page, click Add permissions.
- In the filter, enter
netappto see the list of permissions specific to Cloud Volumes Service. - Select the checkbox for permissions that you want to add to the role.
- Click Add.
Add the IAM custom role to a user:
- Select IAM from the left navigation menu and select the user you want to update.
- Click the Edit member button.
- On the Edit permissions page, add the custom role created in the previous step.
- Click Save.