SecureCloud

Cloud Computing Mini Project · Documentation

A portfolio on Google Cloud Storage, delivered by Cloud CDN over HTTPS

The site you are reading lives in a private Cloud Storage bucket. A global external Application Load Balancer terminates TLS with a Google-managed certificate, Cloud CDN caches every file at Google's edge, and plain HTTP is redirected to HTTPS. A companion command-line tool stores files as AES-256-GCM encrypted blocks in a second private bucket.

Cloud Storageprivate origin bucket
Cloud CDNedge caching worldwide
HTTPSmanaged cert · HTTP → 301
AES-256-GCMclient-side encrypted blocks

Aim

Host a portfolio site using Google Cloud Storage and integrate a CDN, to learn how content is distributed globally and served securely over HTTPS. The site is deployed the way production static sites are: a private bucket that nobody can read directly, a CDN in front of it, a TLS certificate managed by the cloud provider, and scripts that build and tear down the whole stack.

Global distribution

Cloud CDN caches files at Google's edge locations, so repeat visitors are served from a nearby cache instead of the bucket in Mumbai.

HTTPS everywhere

A Google-managed certificate is issued and renewed automatically. Port 80 only answers with a 301 redirect to HTTPS.

Private origin

The site bucket has public access prevention on. Only the load balancer's service agent may read it.

Reproducible

One deploy script creates everything, with a dry-run mode. One teardown script removes it so nothing keeps billing.

Hosting architecture

SecureCloud on Google Cloud A visitor connects over HTTPS to a global static IP. The load balancer terminates TLS with a Google-managed certificate and redirects plain HTTP. Cloud CDN serves cached files from the edge and fetches misses from a private Cloud Storage site bucket through a backend bucket. The securecloud.py client uploads encrypted blocks to a separate private blocks bucket. Users (trusted client) Visitor's browser https://<ip>.sslip.io securecloud.py split · AES-256-GCM · scrypt Google Cloud project (asia-south1 buckets, global load balancer) Forwarding rules global static anycast IP :443 HTTPS · :80 HTTP Target proxies + URL maps TLS · Google-managed cert HTTP → 301 to HTTPS Cloud CDN edge cache (Age header) FORCE_CACHE_ALL · TTL 1 h Cloud Storage · site private · public access prevention · uniform access index.html · 404.html Cloud Storage · blocks private · PAP enforced ciphertext + manifest only TLS miss → backend bucket (LB service agent) upload --backend gcs download (your own ADC login)
The bucket is never public. Visitors only reach it through the load balancer and Cloud CDN, over HTTPS.
ResourceName created by deploy scriptPurpose
Cloud Storage bucket<project>-siteHolds site/; main page index.html, not-found page 404.html
Backend bucketportfolio-backendConnects the bucket to the load balancer; Cloud CDN enabled
URL mapsportfolio-https-map, portfolio-http-redirectHTTPS → bucket; HTTP → 301 redirect to HTTPS
Static IPportfolio-ipOne global anycast IPv4 address for both ports
SSL certificateportfolio-certGoogle-managed, for your domain or <ip-with-dashes>.sslip.io
Proxies + rulesportfolio-https-proxy, portfolio-http-proxy, portfolio-https-rule (:443), portfolio-http-rule (:80)Accept connections on the static IP
Cloud Storage bucket<project>-blocksEncrypted blocks from securecloud.py

How Cloud CDN and HTTPS work here

  1. DNS and anycast

    34-8-1-2.sslip.io-style names resolve to the reserved IP with no DNS setup. That IP is anycast: Google announces it from many locations, so a visitor's packets enter Google's network at the nearest point of presence.

  2. TLS at the edge

    The HTTPS proxy presents the Google-managed certificate and completes the TLS handshake close to the visitor. Google issues the certificate once DNS points at the IP, and renews it automatically.

  3. Cache lookup

    Cloud CDN checks the edge cache. On a hit the file is returned straight away, with an Age header saying how many seconds it has been cached. On a miss the request goes to the backend bucket.

  4. Private origin fetch

    The load balancer's service agent (service-PROJECT_NUMBER@https-lb.iam.gserviceaccount.com) reads the object from the private bucket. Cache mode FORCE_CACHE_ALL stores the response for the default TTL of 1 hour.

  5. Invalidation on deploy

    After uploading new files the script runs gcloud compute url-maps invalidate-cdn-cache for /*, so every edge fetches the new version on its next request.

The footer of the portfolio reads these headers live and shows whether the page came from the CDN cache.

Deploy it yourself

Prerequisites: a Google Cloud project with billing or the free trial enabled, the Google Cloud CLI, and your own login. No service account keys are created or stored.

1

Log in (your own account)

2

Preview the commands (dry run)

3

Deploy

4

Wait for the certificate (15–60 min)

5

Check HTTPS, redirect and cache

6

Tear down when finished (stops billing)

Supporting feature: encrypted block storage

SecureCloud also includes securecloud.py, which splits a file into fixed-size blocks (like HDFS) and encrypts each one on your machine before upload, so the blocks bucket only ever holds ciphertext. It connects this hosting work to the secure-storage part of our group project.

  1. Derive the key

    A random 16-byte salt and your password go through scrypt (N=215, r=8, p=1) to give a 256-bit key. Only the salt and parameters are stored. The key never is.

  2. Split and encrypt

    Each block (1 MB by default) gets a fresh 96-bit nonce and is sealed with AES-256-GCM. The associated data file_id | index | count ties the block to its position.

  3. Hash and record

    manifest.json stores the SHA-256 of every encrypted block and of the whole file. A key_check value authenticates the manifest itself.

  4. Merge with verification

    merge checks hashes, then the password (exit code 2 if wrong), then every GCM tag (exit code 3 if a block was tampered with), then the whole-file hash.

Usage with the Google Cloud blocks bucket

1
2
3

Alternative implementation: AWS

The same site and tool also run on AWS. infra/template.yaml (CloudFormation) creates a private S3 site bucket behind CloudFront with Origin Access Control, plus a private S3 blocks bucket, and deploy.ps1 / deploy.sh deploy it. securecloud.py uses S3 by default (--backend s3). Google Cloud became the main target because the AWS account was not verified for CloudFront.

ConceptGoogle Cloud (main)AWS (alternative)
Object storageCloud StorageAmazon S3
CDNCloud CDN on a backend bucketCloudFront distribution
Private origin accessLoad balancer service agent (IAM)Origin Access Control (SigV4)
CertificateGoogle-managed SSL certificateDefault *.cloudfront.net certificate
HTTP → HTTPSRedirect URL map on port 80Viewer protocol policy redirect-to-https
Cache invalidationgcloud compute url-maps invalidate-cdn-cacheaws cloudfront create-invalidation
Provisioninggcloud scripts (infra/gcp/)CloudFormation template

Author

Suyash Makrand Chaudhari · B.E. Computer Engineering, MET Bhujbal Knowledge City, Institute of Engineering, Nashik · portfolio · csuyash2506@gmail.com