Full Report
The Cymbal Group is a happy (and fictional) GCP premium support customer. They enjoy the benefits of being a premium support customer - access to a dedicated Technical Account Manager (TAM), 15 minute response time for P1 Technical support cases, 24 hours a day, 7 days a week, and now - access to the Cloud Support API. Folks at Cymbal realize that when it comes to urgent situations, every second counts. Previously, the Cymbal Group team spent time finding the correct team members that have access to file cases as well as filling out several boilerplate form entries before the support case was created. Every extra minute it took to reach out to support, Cymbal knew that more and more of their customers would be impacted. To fix this they wanted to create a “red button” or “break-glass” case creation tool in these urgent situations, specifically to file top priority support cases. This tool would be a form on a simple website, helping them to cut out many of the time consuming aspects of filing a support case. Building the red button web pageThe Cymbal Group made a simple drop-down menu with preconfigured case components that map to their most commonly used Google Cloud services such as BigQuery or Dataproc. The form also can require a URL to a Google Meet video conference room that both Cymbal and Google employees could join and further discuss the situation. The Cymbal case creation page is configured to have many optional fields, such as project ID, because Cymbal automatically creates a case in the Cymbal org (not linked to a specific project) if the field is empty. While many fields are optional, Cymbal realizes that the more information it can provide to Google Support initially, the better they will be to address the issue quickly and efficiently. The Cymbal team created a wireframe mockup of their entry form and confirmation page. They then used the set up instructions on the Cloud Support API documentation page to activate the API in a Cymbal GCP project and created a Service Account with the proper roles. After reviewing the Cloud Support API documentation, Cymbal created a simple Python application using the Case Creation method from scratch. Here’s a code snippet! code_block )])]> This code snippet above initializes the Cloud Support client library and defines the Organization ID that the Cybal Group will be using to create a case under. Next, they pull from the fields from the UI web form and insert them in a JSON request body. This will contain the details used for creating a support case, such as the description of the case, and the component id which denotes which GCP product is affected - hardcoded into the drop-down menu. In this case, the case description is a combination of several fields in the form, using a custom-made function called build_description_value. code_block )])]> Cymbal hard coded the subject of the case and provided a stock description. The subject (display_name) is "BUSINESS CRITICAL P1 ISSUE - PLEASE JOIN GVC LINK " + googlemeet_link + " IMMEDIATELY". In the next code snippet, the JSON body is passed to the cases.create() method in order to create a support case. code_block )])]> When the creation of the case is completed, the API returns the case number in the response. Cymbal then displays this on a case confirmation page, as well as a link to the Cloud Console where they can view the support case and add additional comments throughout the investigation. And it’s as simple as that! The Cymbal Group team members await for the Google Support team to join the Google Meet call to further discuss the critical issue at hand. The Cymbal group is happy to have saved time getting help with their critical production issue. If you have ideas for creating your own case creation tool similar to the one described in this blog post, you can find more information about the Cloud Support API and its capabilities in our documentation here https://cloud.google.com/support/docs/reference/support-api and here https://cloud.google.com/support/docs/reference/rest.For Cloud Support API examples like the ones mentioned in this blog post, please view this GitHub repository: https://github.com/GoogleCloudPlatform/professional-services/tree/main/examples/cloud-support/ Related Article Customer Care portfolio: Flexible, scalable, robust support The Google Cloud Customer Care portfolio offers a range of technical support options designed to optimize hybrid work environments. Read Article
Analysis Summary
# Best Practices: Automated "Break-Glass" Support Case Creation
## Overview
These practices address the need for **rapid incident response** and **support accessibility** during critical system failures (P1 issues). By automating the creation of support cases via the Cloud Support API, organizations can eliminate manual bottlenecks, ensure the right information reaches support engineers immediately, and reduce Mean Time to Resolution (MTTR).
## Key Recommendations
### Immediate Actions
1. **Enable Cloud Support API:** Activate the API within a dedicated administrative GCP project.
2. **Apply Least Privilege:** Create a dedicated **Service Account** specifically for this tool. Assign only the minimum necessary IAM roles required to create and view cases (e.g., `roles/cloudsupport.techSupportEditor`).
3. **Pre-configure Components:** Hardcode a dropdown menu with common service Component IDs (e.g., BigQuery, Dataproc) to prevent manual entry errors during high-stress incidents.
### Short-term Improvements (1-3 months)
1. **Standardize Incident Details:** Implement a `build_description_value` function to concatenate critical fields (Impact, Service, Timeline) into the support case description automatically.
2. **Automate Collaboration Channels:** Integrate the tool to require or auto-generate a Google Meet URL or Slack bridge link within the case subject line to ensure immediate synchronization between your team and Google Support.
3. **Implement Identity-Aware Proxy (IAP):** Secure the "Red Button" web form using IAP to ensure only authorized internal employees can trigger a P1 support case.
### Long-term Strategy (3+ months)
1. **System-Level Integration:** Connect the "Red Button" tool to your internal monitoring/alerting systems (e.g., Cloud Monitoring) to auto-populate technical error logs directly into the case.
2. **Dynamic Project Mapping:** Develop logic to automatically detect and include the affected Project ID based on the user's selection, ensuring support engineers have the correct context immediately.
## Implementation Guidance
### For Small Organizations
- Focus on a simple Python-based web form (e.g., using Flask) hosted on App Engine.
- Use a single Organization-level ID for all cases to simplify the initial setup.
### For Medium Organizations
- Implement **Organization-level case creation** as the default, but include an optional field for Project IDs to help support teams narrow down the environment.
- Use hardcoded stock descriptions for "Business Critical" issues to ensure consistency.
### For Large Enterprises
- Deploy the tool across multiple departments with **customized service menus** relevant to each business unit.
- Ensure the Service Account credentials are managed via **Secret Manager** rather than local environment files.
## Configuration Examples
To initialize the support client and define the request body, use the following logic:
python
# Initialize Client
from googleapiclient.discovery import build
support_service = build('cloudsupport', 'v1')
# JSON Request Body structure
case_body = {
"display_name": "BUSINESS CRITICAL P1 ISSUE - JOIN LINK: " + gvc_url,
"description": build_description_value(form_data),
"classification": {
"id": "component_id_for_service" # e.g., BigQuery ID
},
"severity": "S1", # Priority 1
"subscriber_email_addresses": ["[email protected]"]
}
# Create Case
request = support_service.cases().create(parent=f"organizations/{ORG_ID}", body=case_body)
response = request.execute()
## Compliance Alignment
- **NIST SP 800-61 (Incident Handling):** Aligns with the "Detection and Analysis" phase by streamlining the reporting of high-impact incidents.
- **ISO/IEC 27001:** Supports the "Information security incident management" requirement (Clause 16) by ensuring a consistent and rapid response mechanism.
- **CIS GCP Benchmark:** Follows identity management best practices by utilizing dedicated Service Accounts rather than user keys.
## Common Pitfalls to Avoid
- **Empty Context:** Avoid sending "empty" cases. Even if fields are optional, ensure the tool mandates a minimum description to avoid delaying the support engineer.
- **Insecure Access:** Do not leave the "Red Button" web form accessible to the public internet; it should be behind a VPN or IAP.
- **Hardcoded Credentials:** Never hardcode Service Account keys in the Python script. Use Google Application Default Credentials (ADC).
## Resources
- **Google Cloud Support API Documentation:** [https://cloud.google.com/support/docs/reference/support-api](https://cloud.google.com/support/docs/reference/support-api)
- **REST Resource: Cases:** [https://cloud.google.com/support/docs/reference/rest/v2/cases](https://cloud.google.com/support/docs/reference/rest/v2/cases)
- **Official API Code Examples:** [https://github.com/GoogleCloudPlatform/professional-services/tree/main/examples/cloud-support/](https://github.com/GoogleCloudPlatform/professional-services/tree/main/examples/cloud-support/)