Create and manage mirroring endpoint group associations

Create a mirroring endpoint group association to attach a mirroring endpoint group to a Virtual Private Cloud (VPC) network. You can create a mirroring endpoint group globally and associate it with one or more VPC networks to monitor workloads.

This page explains how to create and manage mirroring endpoint group associations by using the Google Cloud CLI.

Before you begin

Roles

To get the permissions that you need to create, view, or delete mirroring endpoint group associations, ask your administrator to grant you the necessary Identity and Access Management (IAM) roles on your project. For more information about granting roles, see Manage access to projects, folders, and organizations.

To check the progress of the operations listed on this page, make sure that your user role has the following Mirroring Endpoint Admin role (roles/networksecurity.mirroringAdmin) and Mirroring Endpoint Network Admin (roles/networksecurity.mirroringEndpointNetworkAdmin) role permissions:

  • networksecurity.mirroringEndpointGroupAssociations.create
  • networksecurity.mirroringEndpointGroupAssociations.delete
  • networksecurity.mirroringEndpointGroupAssociations.update
  • networksecurity.mirroringEndpointGroupAssociations.get
  • networksecurity.mirroringEndpointGroupAssociations.list

Quotas

To view quotas associated with mirroring endpoint group associations, see Quotas and limits.

Create mirroring endpoint group associations

You can associate one or more VPC networks to a specific mirroring endpoint group in the same zone.

In the create and manage mirroring endpoint group section you created a mirroring endpoint group where the network traffic inspection can happen for the mirrored traffic. However, you still need to specify which VPCs' traffic can be inspected. To do this, you create a project-level mirroring endpoint group association.

To perform this task, you must have been granted the following permissions or one of the following IAM roles on your project.

Permissions

  • networksecurity.mirroringEndpointGroupAssociations.create
  • networksecurity.mirroringEndpointGroupAssociations.update
  • networksecurity.mirroringEndpointGroupAssociations.delete
  • networksecurity.mirroringEndpointGroupAssociations.get
  • networksecurity.mirroringEndpointGroupAssociations.list

Roles

  • networksecurity.mirroringAdmin
  • networksecurity.mirroringEndpointNetworkAdmin
gcloud

To create a mirroring endpoint group association, use the gcloud beta network-security mirroring-endpoint-group-associations create command:

 gcloud beta network-security mirroring-endpoint-group-associations \
     create ENDPOINT_GROUP_ASSOCIATION \
     --location global \
     --project PROJECT_NAME \
     --network NETWORK \
     --mirroring-endpoint-group ENDPOINT_GROUP \
     --no-async

Replace the following:

  • ENDPOINT_GROUP_ASSOCIATION: the name of the mirroring endpoint group association.

  • PROJECT_NAME: the Google Cloud project name of the network.

  • NETWORK: the name of the network.

  • ENDPOINT_GROUP: the name of the mirroring endpoint group.

View mirroring endpoint associations

You can view the details of a specific mirroring endpoint group association in a zone.

To perform this task, you must have been granted the following permissions or one of the following IAM roles on your project.

Permissions

  • networksecurity.mirroringEndpointgroupAssociations.get

Roles

  • networksecurity.mirroringEndpointAdmin
  • networksecurity.mirroringEndpointNetworkAdmin
  • networksecurity.mirroringEndpointViewer
gcloud

To view a mirroring endpoint group association, use the gcloud beta network-security mirroring-endpoint-group-associations describe command:

 gcloud beta network-security mirroring-endpoint-group-associations \
     describe ENDPOINT_GROUP_ASSOCIATION \
     --location global \
     --project PROJECT_NAME

Replace the following:

  • ENDPOINT_GROUP_ASSOCIATION: the name of the mirroring endpoint group association.

  • PROJECT_NAME: the project name of the mirroring endpoint group association.

List mirroring endpoint group associations

You can list the mirroring endpoint group associations for a network, a project, or a mirroring endpoint group.

To perform this task, you must have been granted the following permissions or one of the following IAM roles on your project.

Permissions

  • networksecurity.mirroringEndpointgroupAssociations.list

Roles

  • networksecurity.mirroringEndpointAdmin
  • networksecurity.mirroringEndpointNetworkAdmin
  • networksecurity.mirroringEndpointViewer
gcloud

To list a mirroring endpoint group association in a project, use the gcloud beta network-security mirroring-endpoint-group-associations list command:

 gcloud beta network-security mirroring-endpoint-group-associations list \
     --project PROJECT_NAME \
     --network NETWORK

Replace the following:

  • PROJECT_NAME: the project name of the mirroring endpoint group association.

  • NETWORK: the name of the VPC network.

Delete a mirroring endpoint group association

You can delete a mirroring endpoint group association for a specific VPC network.

To perform this task, you must have been granted the following permissions or one of the following IAM roles on your project.

Permissions

  • networksecurity.mirroringEndpointgroupAssociations.delete

Roles

  • networksecurity.mirroringEndpointAdmin
  • networksecurity.mirroringEndpointNetworkAdmin
gcloud

To delete a mirroring endpoint group association, use the gcloud beta network-security mirroring-endpoint-group-associations delete command:

 gcloud beta network-security mirroring-endpoint-group-associations \
     delete ENDPOINT_GROUP_ASSOCIATION \
     --location global \
     --project PROJECT_NAME \
     --no-async

Replace the following:

  • ENDPOINT_GROUP_ASSOCIATION: the name of the mirroring endpoint group association.

  • PROJECT_NAME: the project name of the mirroring endpoint group association.

What's next