Deploy Appliances on Google Cloud Platform

This topic explains how to deploy Imprivata appliances in a Google Cloud project by using the Imprivata deployment package.

  • The package uses OpenTofu and Terragrunt to create and manage the required Google Cloud resources as Infrastructure as Code (IaC).

  • Each appliance is deployed on a Compute Engine virtual machine.

  • The deployment configuration identifies the Google Cloud project, region, network, subnet, firewall settings, appliance VM settings, and other environment-specific values.

  • The resources are deployed in and managed through your Google Cloud environment.

Download a PDF of this guide.

This documentation assumes the following:

  • You are familiar with Google Cloud Platform terminology and basic administration tasks. For more information, see Google Cloud documentation.

The Imprivata appliance runs as a GCP Compute Engine VM instance with the following components:

  • Compute Instance: GCP Compute Engine VM running the Imprivata appliance image

  • Boot Disk: Minimum 300 GB SSD persistent disk (pd-ssd type)

  • Networking: Attached to an existing VPC or a new dedicated VPC with Cloud NAT

  • Access: Serial console, IAP tunnel, or direct IP (depending on network configuration)

Supported Instance Types

  • N2 series - For production environments.

    • n2-standard-2 - 2 vCPU, 8 GB RAM

    • n2-standard-4 - 4 vCPU, 16 GB RAM

    • n2-standard-8 - 8 vCPU, 32 GB RAM

  • E2 series - For test environments.

    • e2-standard-2 - 2 vCPU, 8 GB RAM

    • e2-standard-4 - 4 vCPU, 16 GB RAM

    • e2-standard-8 - 8 vCPU, 32 GB RAM

Supported Regions and Zones

Appliance deployment is supported in the following US regions:

  • us-central1 (Iowa)

  • us-east1 (South Carolina)

  • us-east4 (Northern Virginia)

  • us-east5 (Columbus)

  • us-south1 (Dallas)

  • us-west1 (Oregon)

  • us-west2 (Los Angeles)

  • us-west3 (Salt Lake City)

  • us-west4 (Las Vegas)

A zone is a specific isolated deployment location (e.g., us-central1-a) within a larger geographic region (e.g., us-central1).

Each region contains multiple zones (typically 3) for redundancy and high availability. You must specify a zone when deploying the appliances.

Imprivata supports the deployment of database and service appliances on GCP.

IMPORTANT:

Database appliances must have the same or greater processing power and capacity than service appliances in an enterprise.

You must deploy appliances with enough RAM and disk resources to handle the load expected for them as database or service appliances.

  • For an enterprise of only two database appliances, the n2-standard-2 may be sufficient.

  • For higher performance needs, you can optionally scale up to using two n2-standard-4s.

  • For a larger enterprise of four or more appliances, the database appliances must be n2-standard-8 to provide sufficient performance.

The number and type of appliances appropriate for an enterprise depends on numerous factors, including user counts, authentication methods, network topology, site configuration, and failover requirements.

Estimate the maximum number of user authentications per minute needed for your enterprise at peak usage.

Use the sample information in the graphic below as a general guide for estimation. Peak usage typically occurs at or near the start of a major work shift. Your Imprivata sales engineer or support person can help you with this estimation.

Determine how you handle networking for the newly deployed appliance VMs:

  • Attach VMs to an existing VPC or Subnet

  • Create a new VPC with subnets (and optional secondary ranges)

You can also enable default or custom firewall rules.

GCP Prerequisites

Before deployment, prepare your GCP project to host the Imprivata appliances.

  • GCP Project - Create a target GCP project, or identify an existing project to host the Imprivata appliances. Take note of your Project ID for use in later steps.

    • Regions and zones - Identify the geographic regions and zone where you will host the Imprivata appliances.

      Take note of the region and zone for use in later steps. For more information, see Google Cloud documentation.

  • Required APIs - In the target GCP project, enable the required APIs, including Compute Engine, Cloud Resource Manager and IAM.

    Required APIs. Click to enlarge

  • IAM Permissions - Provision a Service Account with sufficient IAM roles to run the infrastructure deployment.

    • roles/compute.admin - to create and manage Compute Engine resources.

    • roles/iam.serviceAccountUser - to attach service accounts to VMs.

    • roles/iap.tunnelResourceAccessor - to set up an Identity-Aware Proxy (IAP) tunnel to access the appliance management interface when the Imprivata appliance has only a private (internal) IP address.

  • Network prerequisites (for the existing VPC deployment):

    • Existing VPC and subnet in the target region.

    • Subnet with available IP addresses.

    • Default route to internet gateway (for outbound connectivity) or Cloud NAT configured separately.

  • Request the GCP deployment package from Imprivata.

  • Request the GCP Appliance Virtual Machine Image be shared with your Google Cloud Platform Project and provide the Project ID.

The tasks in this section prepare your workstation with the required utilities.

The Just utility is a lightweight command runner. Imprivata's automated setup automatically handles the installation and configuration of all other required tools, such as mise, OpenTofu, Terragrunt, and gcloud.

To install just on your workstation:

  1. Open a terminal window and run the following command, based on your operating system.

    Operating system Command to install the Just utility

    Windows

    Requires winget

    		 winget install Casey.Just

    macOS

    Requires brew or curl

    		 brew install just

    Linux

    Requires apt, dnf, brew, or curl

    cargo install just

    or

    sudo apt install just

  1. Verify the installation by running the following command:

    just --version

  2. After the installation is complete, restart your terminal so that just is on your PATH environment variable.

  1. Run the bootstrap command to automatically install all required tools (mise, OpenTofu, Terragrunt, and gcloud CLI):

    Copy 
    just bootstrap
    NOTE:

    The bootstrap process may take several minutes to complete.

  2. Verify the installation by running the following command:

    Copy 
    just versions

    Expected output:

    Copy 
    opentofu 1.9.0
    terragrunt 0.77.22
    gcloud (latest version)

  3. If the versions do not display correctly, restart your terminal and run just versions again.

Once per workstation, authenticate to the Google Cloud Platform.

Choose one of the following authentication methods based on your organization's GCP access configuration:

  • Direct user authentication: Recommended for interactive deployments. Use this option when:

    • Deploying interactively from your workstation.

    • You have a GCP user account with required IAM roles.

    • No service account key management is required.

  • Service account authentication with key file: Use this option when:

    • Automating deployments via CI/CD pipelines

    • Your organization's policies require service account authentication

    • You have a service account key file with required IAM roles.

  • User authentication with Service Account impersonation: Use this option when:

    • Your organization uses service account impersonation for privilege separation.

    • You need to assume a service account's permissions temporarily.

    • Required by GCP organization policies.

Authenticate using your GCP user account:

Copy 
gcloud auth application-default login

Follow the browser prompts to authenticate.

Authenticate using a service account JSON key file:

Copy 
export GOOGLE_APPLICATION_CREDENTIALS="$(pwd)/key.json"

Replace key.json with the path to your service account key file.

Authenticate as your user account, then impersonate a service account:

Copy 
gcloud auth application-default login
export GOOGLE_IMPERSONATE_SERVICE_ACCOUNT=SERVICE_ACCOUNT@PROJECT.gserviceaccount.com

Replace SERVICE_ACCOUNT@PROJECT.gserviceaccount.com with the target service account email.

Extract the deployment package to a new directory on your workstation.

From a command prompt, run the following commands in order:

Copy 
unzip eam-marketplace-<timestamp>.zip -d ~/eam/
cd ~/eam/gcp
just bootstrap
mise trust ./mise.toml
just init-all

where

  • just bootstrap installs the pinned tool versions.

  • mise trust authorizes mise.toml.

  • just init-all regenerates every environment's generated/ tree, with global first.

To configure deployment variables:

  1. Navigate to your GCP deployment directory.

  2. In the gcp directory, create a terraform.tfvars file.

    1. To attach to an existing VPC/Subnet, create the terraform.tfvars file with the following content:

      Copy 
      project_id = "YOUR_GCP_PROJECT_ID"
      region     = "us-central1"
      zone       = "us-central1-a"

      instances = {
        vm1 = {
          instance_name = "imprivata-appliance-1"
          instance_type = "e2-standard-4"
        }
      }

      # Attach to existing VPC/subnet
      deploy_network = { enable = false }

      network_interface = [
        {
          subnetwork = "projects/YOUR_PROJECT_ID/regions/us-central1/subnetworks/YOUR_SUBNET_NAME"
        }
      ]

    2. To create a new VPC with Cloud NAT, create the terraform.tfvars file with the following content:

      Copy 
      project_id = "YOUR_GCP_PROJECT_ID"
      region     = "us-central1"
      zone       = "us-central1-a"

      instances = {
        vm1 = {
          instance_name = "imprivata-appliance"
          instance_type = "e2-standard-4"
        }
      }

      # Create new VPC with Cloud NAT
      deploy_network = {
        enable        = true
        create_nat    = true
        ip_cidr_range = "10.0.0.0/24"
      }

      This option creates:

      • New VPC network

      • New subnet in the specified region

      • Cloud Router

      • Cloud NAT (for outbound internet access without external IPs)

      • Static internal IP address for the appliance

Variable Definitions

Variable Type Required Description Notes
project_id string required The GCP project ID Replace "YOUR_GCP_PROJECT_ID" with your GCP project ID.
region string required The GCP region where the VM will be created.

Must belong to a valid US region, such as:

us-central1

us-east1

us-east4

us-east5

us-south1

us-west1

us-west2

us-west3

us-west4
zone string required The GCP zone withing the region "us-central1-a"
instances map required The map of VM instance definitions  
instance_name string required Unique and identifiable name for the appliance VM. Example: imprivata-vm1
instance_type string required The machine type for the VM.

Adjust instance_type based on your deployment size.

Supported instance types:

  • n2-standard-2 - 2 vCPU, 8 GB RAM

  • n2-standard-4 - 4 vCPU, 16 GB RAM

  • n2-standard-8 - 8 vCPU, 32 GB RAM

  • e2-standard-2 - 2 vCPU, 8 GB RAM

  • e2-standard-4 - 4 vCPU, 16 GB RAM

  • e2-standard-8 - 8 vCPU, 32 GB RAM
deploy_network.enable boolean required Create new VPC (true) or use existing (false)

Example:

true or false
deploy_network.create_nat boolean optional Create Cloud NAT (requires enable = true)

Set create_nat = true to enable Cloud NAT (outbound internet access)

Set create_nat = false to create VPC without Cloud NAT (appliance has no outbound internet access)
deploy_network.ip_cidr_range string optional Subnet CIDR range (requires enable = true)

Example:

10.0.0.0/24
network_interface list optional Existing VPC/subnet reference (requires enable = false)  
YOUR_SUBNET_NAME string optional Name of the existing subnet. Replace YOUR_SUBNET_NAME with the name of your existing subnet
vm_disk_size string required Specifies the size of the VM boot disk in gigabytes (GB). Must be greater than 300 GB.

Initialize the OpenTofu working directory and download required provider plugins:

Copy 
tofu init

Expected output:

  • Downloads the Google Cloud provider plugin

  • Initializes the backend configuration

  • Displays "Terraform has been successfully initialized!"

Validate the configuration syntax and consistency:

Copy 
tofu validate

Expected output:

  • When validation succeeds, it displays "Success! The configuration is valid."

  • If validation fails, review the error message and correct the terraform.tfvars file.

  1. Generate a deployment plan to preview the resources that will be created:

    Copy 
    tofu plan -var-file="terraform.tfvars"

  2. Review the plan output carefully:

    • Verify the VM instance name, type, and zone.

    • Verify the network configuration (VPC, subnet, Cloud NAT if applicable).

    • Verify the boot disk size (minimum 300 GB).

    • Verify firewall rules, if configured.

Expected Resources - Existing VPC

  • 1 Compute Engine instance

  • 1 static internal IP address

Expected Resources New VPC with Cloud NAT

  • 1 VPC network

  • 1 subnet

  • 1 Compute Engine instance

  • 1 Cloud Router

  • 1 Cloud NAT

  • 1 external IP address (for Cloud NAT)

  • 1 static internal IP address (for appliance)

  1. Apply the configuration to create the appliance and associated resources:

    Copy 
    tofu apply -var-file="terraform.tfvars"

  2. Type yes to when prompted to confirm the deployment.

    NOTE:

    The deployment may take five to ten minutes to create the VMs, initialize disks, and configure the network.

After deployment completes, OpenTofu displays output parameters with commands for accessing the appliance.

Example

Copy 
INSTANCE_PARAMS = {
  "imprivata-appliance" = {
    "console_connection" = "gcloud compute connect-to-serial-port --project=YOUR_PROJECT_ID --zone=us-central1-a --port=1 imprivata-appliance"
    "instance_ip"        = "10.0.0.2"
    "instance_name"      = "imprivata-appliance"
    "port_forward"       = "gcloud compute start-iap-tunnel --project=YOUR_PROJECT_ID --zone=us-central1-a imprivata-appliance 81 --local-host-port=localhost:81"
  }
}

Save the following commands for post-deployment configuration tasks:

  • console_connection: The command to connect to VM serial console.

  • port_forward: The command to set up IAP tunnel (for private-IP appliances).

  • instance_ip: The internal IP address of the appliance.

After deploying the appliance, complete the following configuration steps to finalize network settings and access the appliance management interface.

From the deployment output, run the console_connection command to connect to the VM serial console:

Copy 
gcloud compute connect-to-serial-port --project=YOUR_PROJECT_ID --zone=us-central1-a --port=1 imprivata-appliance

where:

  • YOUR_PROJECT_ID is your GCP project ID.

  • zone is the zone you specified for your appliance.

  • imprivata-appliance is the instance name of your appliance.

To exit the serial console, use the following keyboard shortcuts:

  • Windows and Linux: Press CTRL + ]

  • macOS: Press Cmd + ]

By default, GCP assigns a /32 netmask to VM network interfaces. The appliance cannot communicate with other hosts on the subnet with the /32 netmask. You must update the netmask to match your subnet configuration.

For example, if your subnet is 10.0.0.0/24, update the netmask from /32 to /24.

From the appliance console, test outbound network connectivity:

Copy 
ping -c 4 8.8.8.8

Expected Results

  • If using Cloud NAT or existing VPC with internet gateway: ping succeeds.

  • If using a private VPC without NAT/gateway: ping fails. This is expected if no outbound internet access is configured.

If ping fails and internet access is required:

  • Verify that Cloud NAT is configured (for new VPC deployments with create_nat = true).

  • Verify that the default route to your internet gateway exists (for existing VPC deployments).

Access Private-IP Appliance via IAP Tunnel

When the appliance has only a private (internal) IP address, set up an Identity-Aware Proxy (IAP) tunnel to access the management interface.

Prerequisites

  • The user account must have roles/iap.tunnelResourceAccessor or roles/compute.admin IAM role.

  • Firewall rule allowing TCP traffic from 35.235.240.0/20 (IAP IP range) to the appliance.

  1. From the deployment output, run the port forwarding command:

    Copy 
    gcloud compute start-iap-tunnel --project=YOUR_PROJECT_ID --zone=us-central1-a imprivata-appliance 81 --local-host-port=localhost:81

    where:

    • YOUR_PROJECT_ID is your GCP project ID.

    • zone is the zone you specified for your appliance.

    • imprivata-appliance is the instance name of your appliance.

    • 81 is the port.

    • localhost:81 is the localhost and port for the management interface.

  2. Leave this command running in a terminal window. The tunnel remains active until you terminate the command by pressing CTRL+C.

  3. Open a browser to: http://localhost:81.

Access Public-IP Appliance Directly

CAUTION:

Security reminder: External IPs expose the Imprivata appliance to the internet.

Ensure that your firewall rules restrict access to authorized IP addresses only.

When the appliance has an external (public) IP address, access the management interface directly.

Prerequisites

  • The appliance must have external IP assigned (configured via network_interface.access_config in your deployment variables).

  • A firewall rule allowing TCP port 81 from your IP address or corporate network range.

  1. Retrieve the external IP address by running the following command:

    Copy 
    gcloud compute instances describe imprivata-appliance --project=YOUR_PROJECT_ID --zone=us-central1-a --format="get(networkInterfaces[0].accessConfigs[0].natIP)"

  2. Open a browser to: http://<EXTERNAL_IP>:81.

Access the appliance management interface, via IAP tunnel or direct IP.

Follow the on-screen setup wizard to configure:

  • Authentication policies

  • User directory integration (Active Directory, LDAP, etc.)

  • Certificate management

  • Other appliance-specific settings

After completing post-deployment configuration, verify the appliance is operational.

To verify the appliance is operational:

  1. Verify the VM instance status by running the following command:

    Expected output:

    Appliance instance appears with the status RUNNING.

    Copy 
    gcloud compute instances list --project=YOUR_PROJECT_ID --filter="name:imprivata-*"

  2. Verify the boot disk configuration by running the following command:

    Copy 
    gcloud compute disks list --project=YOUR_PROJECT_ID --filter="name:imprivata-*"

    Expected output:

    • The boot disk size is greater than 300 GB

    • The disk type is pd-ssd.

  3. Verify the network configuration:

    1. For deployments with Cloud NAT, verify the NAT external IP address:

      Copy 
      gcloud compute addresses list --project=YOUR_PROJECT_ID

      Expected output:

      • External IP address exists for Cloud NAT (when create_nat = true).

Quota 'CPUS' exceeded in region [REGION]

Symptom

Error of "Quota 'CPUS' exceeded in region [REGION]".

Cause

Your GCP project has insufficient CPU quota in the target region.

Resolution

  1. Verify your current quota by running the following command:

    Copy 
    gcloud compute project-info describe --project=YOUR_PROJECT_ID

  2. Request a quota increase:

    1. In the GCP Console, go to IAM & Admin > Quotas.

    2. Filter on Compute Engine API > CPUs (per region).

    3. Select your target region and request an increase.

User Does Not Have Permission to Access Project

Symptom

Error of "The user does not have permission to access project [PROJECT_ID]".

Cause

Insufficient IAM permissions or authentication is not configured.

Resolution

  1. Verify authentication is active:

    Copy 
    gcloud auth list

  2. Verify IAM roles are assigned to your user account:

    Copy 
    gcloud projects get-iam-policy YOUR_PROJECT_ID --flatten="bindings[].members" --filter="bindings.members:user:YOUR_EMAIL"

  3. Confirm that roles/compute.admin and roles/iam.serviceAccountUser are present.

  4. Re-authenticate if necessary:

    Copy 
    gcloud auth application-default login

Invalid Value for Field 'resource.zone'

Symptom

Error of "Invalid value for field 'resource.zone'"

Cause

The zone value is not in a supported region.

Resolution

Update the zone in the terraform.tfvars file to a zone in a supported US region.

Disk Size Must Be At Least 300 GB

Symptom

Error of "Disk size must be at least 300 GB".

Cause

The vm_disk_size variable is set below the 300 GB minimum.

Resolution

  • Remove vm_disk_size from terraform.tfvars (defaults to 300 GB)

  • Or set explicitly: vm_disk_size = 300 or greater.

Cannot Access the Appliance Management Interface

Symptom

You cannot access the Imprivata appliance

Cause

The Network netmask is still the default GCP asssignment of /32.

Resolution

  1. Connect to serial console by running the following command:

    Copy 
    gcloud compute connect-to-serial-port --project=YOUR_PROJECT_ID --zone=us-central1-a --port=1 imprivata-appliance

  2. Correct the netmask to match your subnet.

IAP Tunnel Command Fails with Permission Denied

Symptom

The IAP Tunnel Command Fails with "Permission Denied"

Cause

The IAP firewall rule was not configured or the IAM role is missing.

Resolutions

  1. Verify that the IAP firewall rule exists:

    Copy 
    gcloud compute firewall-rules list --project=YOUR_PROJECT_ID --filter="sourceRanges:35.235.240.0/20"

  2. If missing, create the firewall rule allowing TCP from 35.235.240.0/20 to the appliance.

  3. Verify IAM role assignment:

    Copy 
    gcloud projects get-iam-policy YOUR_PROJECT_ID --flatten="bindings[].members" --filter="bindings.members:user:YOUR_EMAIL"

  4. The user must have roles/iap.tunnelResourceAccessor or roles/compute.admin.

Appliance Has No Outbound Internet Connectivity

Symptom

The appliance has no outbound internet connectivity.

Cause

The Cloud NAT not configured or default route missing.

Resolution

For existing VPC deployments:

  1. Verify the default route to the internet gateway exists:

    Copy 
    gcloud compute routes list --project=YOUR_PROJECT_ID --filter="destRange:0.0.0.0/0"

  2. If no route exists, configure Cloud NAT or internet gateway separately.

For new VPC deployments:

  1. Verify deploy_network.create_nat = true in terraform.tfvars.

  2. Verify the Cloud NAT exists:

    Copy 
    gcloud compute routers nats list --project=YOUR_PROJECT_ID --region=us-central1

  3. If the Cloud NAT is missing, re-run tofu apply with the corrected configuration.