Google Cloud Firewalls API

介紹

通過VPC防火牆規則，您可以根據自己指定的配置允許或拒絕連接傳入或傳出虛擬機實例。無論實例的配置和作業系統如何，無論它們是否啟動，系統都始終會實施VPC防火牆規則來保護您的實例。

文檔激活Compute Engine API創建一個具有防火牆所有操作權限的IAM角色

創建項目後，啟用Resource Manager API

在https://console.cloud.google.com/iam-admin/roles選擇對應項目然後創建角色

添加權限：

不篩選，排位在1090-1094

compute.firewalls.create

compute.firewalls.delete

compute.firewalls.get

compute.firewalls.list

compute.firewalls.update

篩選Compute Network Admin，排位在136

創建服務帳號秘鑰安裝gcloud下載解壓語言依賴包示例(php)

https://cloud.google.com/compute/docs/reference/rest/v1/firewalls

<?phprequire_once __DIR__ . '/db_config.php';require_once __DIR__ . '/google-api-php-client-v2.8.0-PHP7.0/vendor/autoload.php';
function getFirewall($firewallName = 'black'){        $client = new Google_Client();    $client->setAuthConfig(__DIR__ . '/google-api-php-client-v2.8.0-PHP7.0/compute.firewalls.all.json');     $client->setApplicationName('Google-ComputeSample/0.1');    $client->useApplicationDefaultCredentials();    $client->addScope('https://www.googleapis.com/auth/cloud-platform');    $service = new Google_Service_Compute($client);
    $project = '283007';         $response = $service->firewalls->get($project, $firewallName);         return $response;}
function updateFirewall($firewallName = 'black'){        $client = new Google_Client();    $client->setAuthConfig(__DIR__ . '/google-api-php-client-v2.8.0-PHP7.0/compute.firewalls.all.json');     $client->setApplicationName('Google-ComputeSample/0.1');    $client->useApplicationDefaultCredentials();    $client->addScope('https://www.googleapis.com/auth/cloud-platform');    $service = new Google_Service_Compute($client);
    $project = '283007';     
    $requestBody = $service->firewalls->get($project, $firewallName); 
        $logConfig = new Google_Service_Compute_FirewallLogConfig();    $logConfig->setEnable(true);    $logConfig->setMetadata('INCLUDE_ALL_METADATA');    $requestBody->setLogConfig($logConfig);
        $blackIpList = [];    $result = RunSelect("SELECT ip FROM `blackList`");     while ($row = $result->fetch_assoc()){        array_push($blackIpList, $row['ip']);     }    $requestBody->setSourceRanges($blackIpList); 
    $response = $service->firewalls->update($project, $firewallName, $requestBody);     
        $logIsTrue = getFirewall()->getLogConfig()->getEnable();    if(!$logIsTrue){        sleep(10);         $response = $service->firewalls->update($project, $firewallName, $requestBody);            }    echo 'success';}
function getBlackIpListFromGCP(){    $response = getFirewall();    echo '<pre>', var_export($response->getSourceRanges(), true), '</pre>', "<hr/>";}
if(isset($_GET['action'])){        if($_GET['action'] == 'getBlackIpListFromGCP'){        getBlackIpListFromGCP();    }
        if($_GET['action'] == 'refresh'){        updateFirewall();    }}?>