GoogleCloudPlatform / pubsec-declarative-toolkit

The GCP PubSec Declarative Toolkit is a collection of declarative solutions to help you on your Journey to Google Cloud. Solutions are designed using Config Connector and deployed using Config Controller.
Apache License 2.0
31 stars 28 forks source link

New Org onboarding domain validation: alternate email validation procedure - avoid domain deny list #421

Open fmichaelobrien opened 1 year ago

fmichaelobrien commented 1 year ago

domain validation has changed in the last 6 months. There is an additional offline email validation procedure. Add this procedure here and in the V1 docs https://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding/blob/main/docs/google-cloud-onboarding.md#onboarding-category-3b1-3rd-party-email-account---3rd-party-aws-route53-domain-validation---reuse-existing-billing-account

obriensystems commented 1 year ago

]''''See also creating a GCP account using only a google account (gmail) - no domain no org https://github.com/GoogleCloudPlatform/pbmm-on-gcp-onboarding/blob/main/docs/google-cloud-onboarding.md#onboarding-category-9-gmail-email-or-google-account-on-3rd-party-email-or-proxy---no-domain---no-organization

https://cloud.google.com/identity/docs/set-up-cloud-identity-admin

Screenshot 2023-07-11 at 09 39 11

eventfield.net email forwarding m developer at - to m ol.cl

Screenshot 2023-07-11 at 09 54 46 Screenshot 2023-07-11 at 09 55 26 Screenshot 2023-07-11 at 09 55 49 Screenshot 2023-07-11 at 09 56 05 Screenshot 2023-07-11 at 09 56 32

New account OK - could get 2FA request here though

Screenshot 2023-07-11 at 09 57 09

admin console first

Screenshot 2023-07-11 at 09 59 17

domain protect

Screenshot 2023-07-11 at 09 59 37 Screenshot 2023-07-11 at 10 00 06

domain sign in added as of 6 months ago

Screenshot 2023-07-11 at 10 00 56

You must validate the domain or run the risk of domain deny listing - which we can fix later via allow listing

Screenshot 2023-07-11 at 10 02 06

Moving on with non-automated TXT domain record validation

Screenshot 2023-07-11 at 10 07 54 Screenshot 2023-07-11 at 10 08 40

Verify your domain https://support.google.com/a/answer/6248925?hl=en

Screenshot 2023-07-11 at 10 12 11

http://domains.google.com on the account owning the domain

Screenshot 2023-07-11 at 10 14 31 Screenshot 2023-07-11 at 10 17 07

dig the domain change

michaelobrien@mbp7 terraform-example-foundation % dig eventfield.net txt

; <<>> DiG 9.10.6 <<>> eventfield.net txt
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51325
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;eventfield.net.            IN  TXT

;; ANSWER SECTION:
eventfield.net.     3600    IN  TXT "google-site-verification=ykFhALCZd1tImw5YDG1_Sq8UHf81bObgwPE9uBg-Y7s"

;; Query time: 284 msec
;; SERVER: 192.168.100.1#53(192.168.100.1)
;; WHEN: Tue Jul 11 10:16:33 EDT 2023
;; MSG SIZE  rcvd: 124

3 min

Screenshot 2023-07-11 at 10 18 25 Screenshot 2023-07-11 at 10 22 28 Screenshot 2023-07-11 at 10 25 27 Screenshot 2023-07-11 at 10 25 55 Screenshot 2023-07-11 at 10 26 12 Screenshot 2023-07-11 at 10 26 52