Google Cloud Operations

Google Cloud Operations (formerly Stackdriver) collects traces, logs and metrics from your services. Relyance AI reads its trace data to map the internal services, connections and endpoints your systems actually talk to.

What you'll need

• A Google Cloud service account key file for the project whose traces you want read.
• The project's ID.

Permissions Relyance needs

Grant the service account these two permissions in the project:

Relyance reads traces only. No log or metric access is requested, and nothing is written back.

In Google Cloud

1. In IAM & Admin › Service Accounts, create a service account — e.g. rely-<tenant_name>-int-operations.
2. Grant it Cloud Trace User and Service Usage Consumer on the project.
3. Open the service account's Keys tab, click Add key › Create new key, choose JSON, and download the file. Keep it somewhere safe — you will paste its contents in the next section, and it cannot be re-downloaded.

In the Relyance AI application

1. Log in to your Relyance account.

2. Navigate to Settings › Integrations, open the Infrastructure Integrations view, and find the Google Cloud Operations card.

3. Click Add Connection, give it a name, and click Add.

4. On the Overview step, select the features you want and click Continue.

5. On the Connection step, set the rescan frequency, then click Continue.

6. On the Authentication step, choose Custom under Authentication Method — the only method this integration offers — and open the Account Details JSON editor. It is a JSON array, so one connection can cover several projects: paste the contents of each downloaded key file as an object, and add a product naming the internal product those traces belong to.

   [
     {
       "type": "service_account",
       "project_id": "",
       "private_key_id": "",
       "private_key": "",
       "client_email": "",
       "client_id": "",
       "auth_uri": "",
       "token_uri": "",
       "auth_provider_x509_cert_url": "",
       "client_x509_cert_url": "",
       "product": ""
     }
   ]

7. Click Authenticate, then Finish.

8. Confirm the connection shows Connected.

Verify the connection is really working

1. A failure at Authenticate usually means the key JSON was pasted incompletely — private_key is multi-line and must keep its \n escapes exactly as they appear in the file.
2. Connected but nothing discovered generally means the project has no trace data in the scan window, or the Cloud Trace API is not enabled on it — that is what serviceusage.serviceUsageConsumer is for.

Manage this integration with Terraform

Connections for this integration can be managed as code with the Relyance Terraform provider. Non-secret fields go in auth.params; secret fields go in auth.secrets_wo, which is write-only — never stored in Terraform state. Rotate secrets by bumping auth.secrets_wo_version.

resource "relyance_integration_connection" "gcloud_operations" {
  vendor = "gcloud_operations"
  name   = "<your connection name>"

  auth = {
    method = "account-credentials"
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      accounts = var.gcloud_operations_accounts
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}