Google Cloud Platform

Compute Engine instances and images in

Open setup wizard →

No public images found for this filter.

Select all

No custom images in this project. Deploy an instance and capture it to create one.

Region:

No Compute Engine instances deployed via this dashboard yet.

Deploy Compute Engine VM

Image

Image URI / Family *

Full self-link, projects/PROJECT/global/images/IMAGE, or projects/PROJECT/global/images/family/FAMILY.

SSH Key (from Secret Manager)

No SSH key configured.

Add a Secret Manager secret name in the wizard →

Workgroup *

Instance Name *

Count *

Lowercase letters, numbers, and hyphens only. More than one deploys copies of the same image, numbered automatically, behind a shared Gateway.

Zone

Machine Type

Subnetwork

Disk Size (GB)

External IP

Attach an ephemeral public IP address.

SSH key secret override (optional)

Any Secret Manager secret. Must be JSON with a public_key — validated on launch.

BeyondTrust PRA options — optional; fall back to the configured defaults.

Jump group

Gateway

No PRA jump groups/Gateways returned — the shell jump falls back to the configured defaults.

Gateway deploy key

Overrides the configured GCE Gateway deploy key. Supplying one gives this VM its own paired Gateway instead of the shared host (BeyondTrust only).

Requires Entitle registration enabled; private instances also need a provisioned Entitle agent.

Onboard into Password Safe (managed system + account)

Requires Password Safe registration enabled; onboards the image's adminuser account, SSH-key managed.

Capture Custom Image

Creates a custom image from the boot disk of . The instance stays running.

Image Name *

Description

Bulk Deploy GCE Instances

images selected — one VM per image. To deploy several copies of a single image, use the Count field on the normal deploy form.

Instance Names

Lowercase letters, numbers and hyphens (RFC1035).

Workgroup (shared) *

Machine Type (shared)

Zone (shared)

Disk Size (GB) (shared)

External IP

Subnetwork (shared)

Build GCE Image with Packer

Provision a public GCE image with a shell script and register the result as a new custom image in your project. Runs as a tracked background job (typically 5–15 min).

Image Name *

Lowercase letters, digits, and hyphens only. A timestamp is appended automatically.

Source Image Family *

GCP image family (e.g. debian-12, rocky-linux-9, ubuntu-2204-lts-amd64) — resolves to the family's latest image across the standard public projects.

Build Machine Type

Shared-core types (e2-micro/small) are omitted — they throttle to a fraction of a vCPU and make image builds crawl.

SSH Username

Boot Disk Type

SSD-backed disks make package installs much faster on the throwaway build VM.

Boot Disk Size (GB)

Leave blank to use the source image's default size. Cannot be smaller than the image.

Provisioner Script

Load from storage:

Shell script run on the build instance. Leave empty to build a base image with no provisioning. Loaded from .

BeyondTrust provisioner options — used by the bt-ready scripts; ignored by other provisioners.

Admin user (Password Safe / Entitle)

Install EPM-L

EPM-L package from

Storage pins the version you synced and doesn't need BeyondTrust reachable from the build — sync it first on the Storage page. Not available on local-filesystem storage.

EPM-L is installed at build; activation runs post-deploy via the EPM-L integration.

Environment variables — passed to the provisioner script.

Secret refs are resolved at build start and passed via Packer sensitive variables — never written to the generated or archived template.

Archive generated template to GCS

OT Demo Cell

Deploy a simulated plant cell — a Modbus PLC simulator (:502) + FUXA web HMI (:1881) from the Packer-baked ot-sim image — into the egress-less private subnet, with BeyondTrust access auto-wired: Web Jump → HMI, protocol tunnel → PLC port, plus the Shell Jump and optional Password Safe onboarding every GCE deploy gets. Bake the image first on the Build Image tab with provisioners/ot/ot-sim-debian.sh.

Deploy a cell

Image * show all custom images

No ot-sim image yet — build one on the Build Image tab, or tick "show all".

Instance Name *

Machine Type

Zone

Workgroup *

Subnetwork

The cell gets no external IP — access is PRA-brokered only, which is the point.

PLC Protocols (one tunnel each)

The cell simulates all of these at once — each gets its own PRA protocol tunnel, so access can be granted per vendor. Protocols the image does not simulate (e.g. DNP3) stay available on the standalone tunnel card below.

BeyondTrust PRA placement — where the cell's jump items land; defaults are the configured gcp_bt_jump_group_name / gcp_jumpoint_name.

Jump group

Gateway

Pick the pair matching the cell's region. With a Gateway override the deploy skips the shared-gateway size check — the host behind that Gateway needs ≥2 GB RAM for the Web Jump.

Onboard the cell's admin account into Password Safe (+ a synced PRA Vault account for checkout/injection) Register the VM in Entitle for just-in-time SSH access

The gateway backing the Web Jump needs ≥2 GB RAM (gcp_jumpoint_machine_type e2-small minimum, e2-medium preferred — Settings → Integrations → Privileged Remote Access) — the deploy checks and refuses early with the remedy otherwise.

Cells

No OT cells yet.

Standalone OT Protocol Tunnel

A generic-TCP PRA protocol tunnel to any host the gateway can reach — for demoing against your own lab gear without deploying a cell.