Skip to content
pier pier

GCP permissions

Setup needs a project owner or editor once, to enable the compute and IAP APIs and create two firewall rules. Daily use needs only:

  • roles/compute.instanceAdmin.v1 (instances, disks, images, metadata, labels)
  • roles/iap.tunnelResourceAccessor (the ssh tunnel)

Sessions run with no service account, so no roles/iam.serviceAccountUser grant is needed. The CPU headroom display reads the region quotas, which instanceAdmin already covers.

The exact setup commands ship in pier setup --print-admin, the command that prints the one-time admin steps for locked-down accounts.

The firewall posture

Section titled “The firewall posture”

pier locks its VMs down harder than a fresh project does. GCE default networks ship a rule that opens :22 to the whole internet, and pier VMs hold an external IP for egress. Setup therefore creates a deny-all ingress rule for pier VMs and one allow rule above it for exactly Google’s IAP range (35.235.240.0/20). Both rules target only instances tagged pier-session. The rest of your network is untouched.

What sessions can do

Section titled “What sessions can do”

The VM side is deliberately minimal. Sessions run with no service account and no scopes. The VM never holds cloud credentials. Parking is the VM shutting itself down, and anything needing account credentials happens from the laptop.