Failed Uptime checks/ Cloud Armor IP range issues

[felixwpcloud]

Hello everyone,

I have been trying to solve a strange and consistent daily failed uptime check error I have been experiencing for nearly 3 years now on my GCP standard VM e2-micro (2 vCPUs, 1 GB Memory). Using a spot or preemptable VM is not the issue.

My website is offline consistently ~16 hours a day while recovering and working perfectly for the other 8-9 hours. It is weird to me that these uptime check failures seem to run on scheduled blocks of time? I get a failed time check alert email every day at ~8:20 AM UTC and an uptime check recovered email every time at about 0:00 UTC. It recovers itself at the start of each UTC day? This seems very strange to me?

When I get the failed uptime check errors, I check my VM instances and see that the VM is in fact still running.

I found this article which I believe seems very similar to my issue:

https://cloud.google.com/knowledge/kb/uptime-checks-fail-even-if-instance-works-as-expected-000004167

I request some assistance setting up my Cloud Armor Security Policies. The article says to “download all the Uptime Check source IP addresses” which I have done, but am not sure how to complete the next step to “configure your Cloud Armor Security Policies to allow these IPs making requests to resources in your project”

I cannot tell for sure, but I don’t think I even have “Cloud Armor Security Policies that deny specific IP ranges.” I certainly never set up the instance to deny specific ranges.

How do I go about whitelisting these Uptime Check source IP addresses? When I go into Cloud Armor Security policies, I see “create policy” meaning that I do not have any policies currently running? When I click to create one, it only allows me to input 10 IP addresses yet the Uptime Check IP addresses include more like 50+ IPs across different regions of the world. Do I need to create multiple policies for each region (USA, South America, Asia Pacific, Europe) ?

This gets very complicated for me to understand, if anyone has any experience setting this up I would really appreciate the help!

I don’t have access to support in my GCP tier, that is why I am asking here.

Checking my error logs: I see the following error “Error response: Guest attributed endpoint access is disabled”

Screenshots of my error logs: 403 error

Screenshot of uptime failures:

Screenshot of quota and limits:

Screenshot CPU utilization:

Let me know if you need any additional info!

I will tag a few staff here hoping to get a response:

@alexmoore @willie @dchiesa1 @Rhett @DamianS @caryna @reinc @JuatonCJ @greb @ChieKo

Thank you for your help!

[diannemcm]

Hi @felixwpcloud ,

Welcome to Google Cloud Community!

403 Forbidden error occurring when accessing the Compute Engine Metadata Server, specifically related to guest attributes. This error typically happens when the required permissions are missing or when guest attributes are not enabled on the virtual machine (VM):

• Enable Guest Attributes for your VM - You can do this by adding the following metadata key to your instance - Guide to Managing Guest Attributes
• Verify Service Account Permissions - Confirm that the VM’s service account has the necessary permissions to access and modify metadata.

Troubleshooting Metadata Server Access - The service account should have roles that include:

compute.instances.get

compute.instances.setMetadata

• There should be no firewall rules or network policies blocking access to the metadata server. Since metadata traffic does not leave the VM, ensure that host-level firewall settings are not inadvertently blocking access.

Additionally, you may find this GitHub discussion helpful in understanding similar issues:
OSConfigAgent Error: Guest Attributes Endpoint Access is Disabled

Was this helpful? If so, please accept this answer as “Solution”. If you need additional assistance, reply here within 2 business days and I’ll be happy to help.