GSP349

Overview

In a challenge lab you’re given a scenario and a set of tasks. Instead of following step-by-step instructions, you will use the skills learned from the labs in the course to figure out how to complete the tasks on your own! An automated scoring system (shown on this page) will provide feedback on whether you have completed your tasks correctly.

When you take a challenge lab, you will not be taught new Google Cloud concepts. You are expected to extend your learned skills, like changing default values and reading and researching error messages to fix your own mistakes.

To score 100% you must successfully complete all tasks within the time period!

This lab is recommended for students who have completed the labs in the Deploy and Manage Apigee X quest. Are you ready for the challenge?

Topics tested:

• Creating an Apigee X evaluation org
• Adding an environment and environment group to the org
• Configuring a NAT IP address for backend services
• Protecting APIs with Cloud Armor

Setup

Before you click the Start Lab button

Read these instructions. Labs are timed and you cannot pause them. The timer, which starts when you click Start Lab, shows how long Google Cloud resources will be made available to you.

This hands-on lab lets you do the lab activities yourself in a real cloud environment, not in a simulation or demo environment. It does so by giving you new, temporary credentials that you use to sign in and access Google Cloud for the duration of the lab.

To complete this lab, you need:

• Access to a standard internet browser (Chrome browser recommended).

Note: Use an Incognito or private browser window to run this lab. This prevents any conflicts between your personal account and the Student account, which may cause extra charges incurred to your personal account.

• Time to complete the lab---remember, once you start, you cannot pause a lab.

Note: If you already have your own personal Google Cloud account or project, do not use it for this lab to avoid extra charges to your account. Note: It is recommended that you use a new Incognito window to complete this lab.

Challenge scenario

You are a Cloud Engineer for Cymbal Shops, a national retailer. Cymbal Shop's API team is planning to use Apigee to integrate with its various partners and provide a merchandise catalog, and you are responsible for setting up and securing the Apigee X evaluation org.

You are expected to have the skills and knowledge for these tasks, so step-by-step guides are not provided.

Some Cymbal Shops standards you should follow:

1. Create all resources in the default region () or default zone () unless otherwise directed.
2. Naming normally uses the format team-resource; for example, an instance could be named api-portal.
3. Allocate cost-effective resource sizes. Projects are monitored, and excessive resource use will result in the containing project's termination (and possibly yours), so plan carefully. This is the guidance the monitoring team is willing to share: unless directed, use f1-micro for small Linux VMs, and use n1-standard-1 for other applications.

Your challenge

A Cymbal Shops colleague has already used the Apigee X provisioning wizard to enable the required APIs, create the VPC network (api-vpc), and create the network's required subnet (api-subnet). They also started step 3 of the wizard to create the Apigee evaluation organization in the region. The organization provisioning may not have finished yet.

You have received an email asking you to finish the configuration of the Apigee X evaluation org. Read through each task description, and then create the required resources.

Task 1. Modify the environments and environment groups

The Cymbal Shops development team wants to use two separate environments and environment groups. In addition to the eval environment and eval-group group, the development team wants an additional environment named staging that is contained in an additional environment group named staging-group.

• Add this environment and environment group to your Apigee X org.

Requirements:

• To create the staging environment and the staging-group environment group, use the Apigee UI.
• Leave the default hostname that is created for the new environment group.
• The staging environment will be attached to the instance in a later task.
• The staging environment should use the programmable proxy type and the proxy deployment type.

Click Check my progress to verify the objective. Add staging environment and environment group

Note: If a green check mark isn't displayed, click the score fly-out on the upper-right, and then click Check my progress on the relevant step. A pop-up box will give you advice.

Task 2. Use the provisioning wizard to set up access routing

The development team needs the evaluation org to be accessible from the internet.

• Use step 4 of the provisioning wizard to enable internet access.

Note: If step 3 of the provisioning wizard is still running, you will need to wait for it to complete before completing this task.

Requirements:

• To complete the access routing step, use the Apigee X provisioning wizard.
• Use the api-subnet subnet for the access routing subnetwork.
• Use the default wildcard DNS service, nip.io. The provisioning wizard will automatically add the nip.io address as a hostname for the eval-group environment group. If the runtime's IP address is 1.2.3.4, the eval-group hostname will be set to 1.2.3.4.nip.io.
• Be sure to select the wildcard DNS and subnet settings correctly in the wizard. If you make a mistake, you will need to go Network services > Load balancing to delete the load balancer and refresh the wizard page to try the access routing step again.

When access routing has been set up successfully, the hello-world API deployed to the eval environment can be called with a request similar to this:

curl -i https://1.2.3.4.nip.io/hello-world

Click Check my progress to verify the objective. Set up access routing

Note: If a green check mark isn't displayed, click the score fly-out on the upper-right, and then click Check my progress on the relevant step. A pop-up box will give you advice.

Task 3. Create and activate a NAT address for the instance

The development team would like to allow-list the IP address of the runtime instance. Use Apigee X's NAT IP address feature to provide a static IP address.

Requirements:

• To create and activate a NAT address for the eval-instance runtime instance, use the Apigee API.
• Use apigee-nat-ip as the name of the NAT IP address.

Click Check my progress to verify the objective. Create and activate NAT address

Note: If a green check mark isn't displayed, click the score fly-out on the upper-right, and then click Check my progress on the relevant step. A pop-up box will give you advice.

Task 4. Create a Cloud Armor security policy and attach it to the global load balancer

The development team wants to protect their backend services from remote code execution.

• Use Cloud Armor to provide this protection.

Requirements:

• Name the policy protect-apigee.
• To find the rule name for remote code execution detection, use the list of Cloud Armor rules.
• Use the stable version of the rule.
• Return a 403 Forbidden status code if a remote code execution pattern is detected.
• Use a priority of 1000.
• Allow all traffic through your load balancer, except for traffic matching the remote code execution detection rule.
• You can find the eval-group nip.io hostname using the Admin > Groups menu in the Apigee UI. The hostname should look similar to 1.2.3.4.nip.io, using the IP address of the runtime instance.

An example of a request that would be detected by the remote code execution rule is:

curl -i https://1.2.3.4.nip.io/hello-world?doc=/bin/ls Note: It can take a few minutes for Cloud Armor rules to propagate. If the request is not blocked, you may retry the call until the request is blocked. You do not need to block a request for this progress check to be successful.

Click Check my progress to verify the objective. Create and attach the Cloud Armor policy

Note: If a green check mark isn't displayed, click the score fly-out on the upper-right, and then click Check my progress on the relevant step. A pop-up box will give you advice.

Task 5. Attach the staging environment to the runtime instance

The staging environment cannot take traffic until it is attached to the runtime instance.

Requirements:

• To attach the staging environment to the runtime instance, use the Apigee API.

Note: It can take several minutes before an environment attachment completes.

Click Check my progress to verify the objective. Attach the environment to the runtime instance

Note: If a green check mark isn't displayed, click the score fly-out on the upper-right, and then click Check my progress on the relevant step. A pop-up box will give you advice.

Congratulations!

Over the course of this challenge lab you have demonstrated your knowledge of Apigee X deployment and management.

Earn your next skill badge

This self-paced lab is part of the Deploy and Manage Apigee X quest. Completing this skill badge quest earns you the badge above, to recognize your achievement. Share your badge on your resume and social platforms, and announce your accomplishment using #GoogleCloudBadge.

This skill badge quest is part of Google Cloud’s API Developer learning path. Continue your learning journey by enrolling in the Develop and Secure APIs with Apigee X quest.

Google Cloud training and certification

...helps you make the most of Google Cloud technologies. Our classes include technical skills and best practices to help you get up to speed quickly and continue your learning journey. We offer fundamental to advanced level training, with on-demand, live, and virtual options to suit your busy schedule. Certifications help you validate and prove your skill and expertise in Google Cloud technologies.

Manual last updated: February 05, 2024

Lab last tested: February 05, 2024

Copyright 2024 Google LLC All rights reserved. Google and the Google logo are trademarks of Google LLC. All other company and product names may be trademarks of the respective companies with which they are associated.