# Google Cloud Operations

Google Cloud Operations (formerly Stackdriver) collects traces, logs and metrics
from your services. Relyance AI reads its **trace** data to map the internal
services, connections and endpoints your systems actually talk to.

### What you'll need

- A Google Cloud service account **key file** for the project whose traces you
  want read.
- The project's ID.

### Permissions Relyance needs

Grant the service account these two permissions in the project:

| Permission | Used for |
| --- | --- |
| `cloudtrace.user` | reading trace spans (`roles/cloudtrace.user`) |
| `serviceusage.serviceUsageConsumer` | calling the Cloud Trace API in that project (`roles/serviceusage.serviceUsageConsumer`) |

Relyance reads traces only. No log or metric access is requested, and nothing is
written back.

### In Google Cloud

1. In **IAM & Admin › Service Accounts**, create a service account — e.g.
   `rely-<tenant_name>-int-operations`.
2. Grant it **Cloud Trace User** and **Service Usage Consumer** on the project.
3. Open the service account's **Keys** tab, click **Add key › Create new key**,
   choose **JSON**, and download the file. Keep it somewhere safe — you will
   paste its contents in the next section, and it cannot be re-downloaded.

### In the Relyance AI application

1. Log in to your Relyance account.
2. Navigate to **Settings › Integrations**, open the **Infrastructure
   Integrations** view, and find the **Google Cloud Operations** card.
3. Click **Add Connection**, give it a name, and click **Add**.
4. On the **Overview** step, select the features you want and click **Continue**.
5. On the **Connection** step, set the rescan frequency, then click **Continue**.
6. On the **Authentication** step, choose **Custom** under **Authentication Method** — the only method this integration offers — and open the **Account Details** JSON editor. It is a JSON *array*, so one connection can cover several projects: paste the contents of each downloaded key file as an object, and add a `product` naming the internal product those traces belong to.

    ```json
    [
      {
        "type": "service_account",
        "project_id": "",
        "private_key_id": "",
        "private_key": "",
        "client_email": "",
        "client_id": "",
        "auth_uri": "",
        "token_uri": "",
        "auth_provider_x509_cert_url": "",
        "client_x509_cert_url": "",
        "product": ""
      }
    ]
    ```
7. Click **Authenticate**, then **Finish**.
8. Confirm the connection shows **Connected**.

### Verify the connection is really working

1. A failure at **Authenticate** usually means the key JSON was pasted
   incompletely — `private_key` is multi-line and must keep its `\n` escapes
   exactly as they appear in the file.
2. Connected but nothing discovered generally means the project has no trace data
   in the scan window, or the Cloud Trace API is not enabled on it — that is what
   `serviceusage.serviceUsageConsumer` is for.

<!-- terraform-examples:begin (generated from the integration catalog; do not hand-edit) -->

## Manage this integration with Terraform

Connections for this integration can be managed as code with the [Relyance Terraform provider](https://registry.terraform.io/providers/Relyance/relyance/latest). Non-secret fields go in `auth.params`; secret fields go in `auth.secrets_wo`, which is write-only — never stored in Terraform state. Rotate secrets by bumping `auth.secrets_wo_version`.

```hcl
resource "relyance_integration_connection" "gcloud_operations" {
  vendor = "gcloud_operations"
  name   = "<your connection name>"

  auth = {
    method = "account-credentials"
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      accounts = var.gcloud_operations_accounts
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}
```

<!-- terraform-examples:end -->