Secure Gateway Studio
Enterprise Administrator Tool • Apache 2.0 Open Source

Secure Gateway Studio

Fast-track the evaluation, configuration, and verification of Chrome Enterprise Premium (CEP) and BeyondCorp Security Gateway (SGW) across Google Workspace tenants and Google Cloud projects.

Explore Modules Privacy Policy Source Code

Two Core Deployment Modules

The extension integrates two specialized automation engines to cover both endpoint policy configuration and cloud zero-trust networking:

CEP

1. CEP PoC Deployer

Chrome Enterprise Premium Module

Accelerates the evaluation of Chrome's advanced security policies without manual configuration in the Admin Console:

  • ✓ Optional OU scaffolding: Creates CEP Users and CEP Browsers children while keeping policy on the populated pilot OU so it applies immediately and inherits downward unless overridden. Users and enrolled browsers are not moved automatically.
  • ✓ Threat Protection: Real-time URL checks, malware deep inspection, and password protections.
  • ✓ Context-Aware Access (CAA): Device posture verification and Endpoint Verification requirements.
  • ✓ Starter DLP Rules: Tailored data protection policies with explicit LOW alert-center severity, matching tenant primary domains.
SGW

2. SGW Deployer

BeyondCorp Security Gateway Module

Automates private zero-trust application access for managed Chrome browsers in Google Cloud:

  • ✓ Extension-safe Gateway Paths: direct private HTTPS and Nginx TLS offload for a managed sample or existing HTTP backend. Regional Internal Application Load Balancer termination is available only in the separate loopback app in version 0.2.1; the extension hides and rejects it.
  • ✓ Scoped change identity: Provisions a dedicated service account and a product-scoped custom project IAM role.
  • ✓ Infrastructure Automation: VPC subnets, firewall rules, private DNS zones, and Private CA certificate issuance.
  • ✓ Audit & Verification: Pre-flight checks, live health probes, and SHA-256 evidence generation.

5-Stage Safety Workflow

Secure Gateway deployments use hash-bound plans and approvals. Easy PoC modules show and confirm their exact target and selected controls before mutation. Both expose verification and safety-first cleanup behavior:

1
Inspect
Read live schemas, targets, and current state
2
Confirm
Explicit target and change confirmation
3
Apply
Workspace writes as admin; Cloud writes as the scoped deployer
4
Verify
Live probes plus tamper-evident local evidence
5
Cleanup review
Exact SGW teardown; CEP candidates retained and reported

Detailed API Calls & Host Permissions

The extension calls Google APIs directly from the local browser runtime (https://*.googleapis.com). No intermediate proxy or external server is contacted.

Google API Host Endpoint Component Purpose & Operation Performed
admin.googleapis.com CEP & SGW Reads organizational units and tenant domain, creates or reuses opt-in test sub-OUs, lists groups, and lists users in the selected pilot OU for optional licence assignment.
cloudidentity.googleapis.com CEP Lists and creates supported DLP rules (settings/rule.dlp) using built-in detector references. Cleanup reports and retains these rules.
chromepolicy.googleapis.com CEP & SGW Applies Chrome policies (Threat Protection, Extension Settings, Endpoint Verification) to target test OUs.
chromemanagement.googleapis.com CEP Verifies managed browser enrollment and security telemetry reporting.
accesscontextmanager.googleapis.com CEP & SGW Reads existing Access Levels and optionally creates the one exact managed-Chrome condition supported by this release.
iamcredentials.googleapis.com SGW Generates short-lived credentials (generateAccessToken) for the scoped deployer service account.
iam.googleapis.com SGW Creates the deployer service account and configures custom IAM project roles.
cloudresourcemanager.googleapis.com SGW Resolves GCP project/organization IDs and binds project IAM policies, including the approved upstreamAccess delta in an explicitly selected upstream VPC project. Cross-project bootstrap is not automatic.
serviceusage.googleapis.com SGW Enables required Google Cloud service APIs (BeyondCorp, Compute, DNS, etc.) in the project.
beyondcorp.googleapis.com SGW Configures a Security Gateway, its private application matcher, and exact application IAM principals.
compute.googleapis.com SGW Provisions Path A VPC resources and reads/uses the selected VPC. A Shared VPC or other cross-project upstream requires the documented manual five-permission custom-role grant before validation.
dns.googleapis.com SGW (Path A) Manages private DNS zones and records for internal application resolution.
secretmanager.googleapis.com SGW Stores and rotates TLS certificates and private keys.
privateca.googleapis.com SGW Issues a certificate from the administrator-selected CA Service pool when the Enterprise CA strategy is selected.
cloudbilling.googleapis.com SGW Verifies that the Google Cloud project has an active billing account prior to deployment.
licensing.googleapis.com CEP Reads existing CEP SKU assignments and optionally assigns a licence to each exactly listed user in the selected pilot OU.
logging.googleapis.com SGW Fetches diagnostic and audit logs for verification and evidence export.
openidconnect.googleapis.com Core Retrieves the signed-in administrator’s verified email and immutable OpenID Connect subject. The subject binds approvals and privileged actions to the same Google account.

OAuth Scopes Justification

In compliance with the Google API Services User Data Policy, only scopes strictly necessary for operation are requested:

OAuth Scope Primary Engine Justification & Principle of Least Privilege
openid Core Supplies the immutable OpenID Connect subject used with the verified email to prevent a different signed-in Google account from inheriting approvals or deployment authority.
.../auth/admin.directory.orgunit CEP Deployer Required to read OUs and, when explicitly selected, create or reuse isolated CEP Users and CEP Browsers sub-OUs. Cleanup retains them for manual review.
.../auth/admin.directory.customer.readonly CEP Deployer Required to read the tenant’s primary domain name, which is necessary to formulate domain-specific data boundary policies.
.../auth/cloud-identity.policies CEP Deployer Required to list and create supported Chrome DLP rules. Cleanup retains rules because a display name is not durable delete ownership.
.../auth/admin.directory.group.readonly CEP / SGW Enables the administrator to select specific pilot user groups in the configuration wizard.
.../auth/admin.directory.user.readonly CEP Lists users only in the selected pilot OU before optional per-user licence assignment; failed, unresolved, or empty listings abort.
.../auth/chrome.management.policy CEP / SGW Applies Chrome policies to target organizational units.
.../auth/chrome.management.profiles.readonly CEP Verifies profile-level Chrome policy application.
.../auth/apps.licensing CEP Reads current CEP SKU assignments and performs an explicitly requested per-user assignment.
.../auth/cloud-platform SGW Deployer Used for read-only preflight, the explicitly confirmed one-time creation and pinning of the deployer service account/custom role/IAM bindings, and multi-service SGW orchestration. Every post-bootstrap Cloud mutation runs through that impersonated deployer; it never falls back to administrator authority.
.../auth/userinfo.email Core Displays the signed-in administrator email in the local audit log and evidence bundle.

Architecture & Data Handling

No Developer Backend
Runs in the local extension and contacts only Google APIs for your tenant/project. No developer telemetry, analytics, advertising, or proxy server.
In-Memory Tokens
OAuth access tokens remain strictly in volatile memory. Never written to disk or storage.
Local Audit Store
All evidence and SHA-256 logs stay in your browser IndexedDB and are exportable as JSON anytime.

For full privacy commitments, see the Privacy Policy.

User data and Limited Use

The extension handles the signed-in administrator email, short-lived Google authentication information, selected Workspace directory identifiers, tenant and Chrome policy configuration, Google Cloud resource metadata, and sanitized administrator/gateway diagnostic activity. Requests are sent over HTTPS only to the Google APIs needed for the administrator-selected feature; configuration, approvals, checkpoints, and evidence are stored in the local Chrome profile. The developer receives no tenant data.

Use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is used only for the disclosed deployment, verification, evidence, and cleanup features and is never sold, used for advertising or profiling, used for creditworthiness or lending, or exposed to human review by the developer. The extension displays this disclosure and requires an affirmative action before requesting Google authorization or tenant access.

Independent Open Source Notice

Secure Gateway Studio is an independent open-source project published under the Apache 2.0 License at github.com/dymzd/Google. Chrome and Google Cloud are trademarks of Google LLC; this project is not affiliated with or endorsed by Google.

It is not built, endorsed, or supported by Google LLC, and is not an official Google product. “Google”, “Google Workspace”, “Google Cloud”, “Chrome”, and “Chrome Enterprise Premium” are trademarks of Google LLC.

Support & Issue Reporting