# Google Cloud Platform

![Google-Cloud-Platform-GCP-Logo - Serviops Solutions Inc.](https://assets.relyanceuat.xyz/images/docs/5831753418893/ext-996bf01fba.png)
Google Cloud Platform (GCP) is a suite of cloud computing services that runs on the same infrastructure that Google uses internally for its end-user products. It provides services for compute, storage, networking, big data, machine learning and IoT, as well as cloud management, security and developer tools.

### Prerequisites

- Access to GCP Console with appropriate permissions
- Write access to Tenant Relyance UI

---

#### Step 1: Create a Service Account

Create a new service account following the naming convention below. This service account will be used to run scan on your GCP project.

**Naming Convention:**

`rely-<tenant_name>-int-<suffix>`

**Example:**

`rely-boutiqueapp-int-relyancesa`

---

#### Step 2: Assign Security Auditor & VertexAI Viewer Role

A. Assign the **Security Auditor** role to the service account created in Step 1.

![Screenshot](https://assets.relyanceuat.xyz/images/docs/5831753418893/43816049331981.jpg)

B. Similarly assign the VertexAI Viewer Role and CloudFunction Viewer Role

`roles/aiplatform.viewer`

`roles/cloudfunctions.viewer`

---

#### Step 3: Configure Service Account Impersonation

![Screenshot](https://assets.relyanceuat.xyz/images/docs/5831753418893/43816029890445.jpg)
Allow the integration service account to impersonate the service account created above:

1. Navigate to the **"Principals with access"** tab under the details of the service account created in Step 1
2. Click **"Grant Access"** under **"View by Principals"**
3. In the drawer, add the following details under **"Add principals"**: **New principals:** `tenant-gcp-integrations@relyance-prod.iam.gserviceaccount.com`
4. **Assign roles:** `Workload Identity User`
5. Click **Save**

---

#### Step 4: Configure Additional GCP Projects (Optional)

![Screenshot](https://assets.relyanceuat.xyz/images/docs/5831753418893/43816049345933.jpg)
If you need to scan additional GCP projects with the same service account:

1. Navigate to the target project dashboard
2. Open the **IAM** tab in **"** **IAM** **& Admin"** view
3. Under **IAM** **> Allow > View by principals**, click **"Grant access"**
4. Add the service account principal created in Step 1
5. Assign the **Security Auditor** role and the **VertexAI Viewer** role
6. Click **Save**

---

#### Step 5: Add Connection in Relyance UI

1. Navigate to **Settings > Integrations > "Google Cloud Platform"** in the Relyance UI
2. Click to add a new connection

---

The **Authentication** step asks for:

- Using **Direct Connection** —
    - **Service Account Email**: Email of the service account to impersonate (i.e: `<name>`@`<project>`.iam.gserviceaccount.com); required.
    - **Project IDs to scan (comma separated)**: required.
- Using **Organization Scan** —
    - **Organization ID**: The GCP organization ID to scan; required.
    - **Service Account Email**: Email of the service account to impersonate (i.e: `<name>`@`<project>`.iam.gserviceaccount.com); required.
    - **Organization Configuration**: Configuration for filtering projects and folders within the organization; required; a JSON value; the field is pre-filled with the shape to complete.

### Which connection type to choose

There are two, and the choice decides where the roles from Step 2 have to be
granted:

| | **Direct Connection** | **Organization Scan** |
| --- | --- | --- |
| Scans | the projects you list | projects discovered across the organization |
| Grant roles on | each project | the organization, or the folders you allow |
| A project created later | needs adding to the list | is picked up automatically |
| Fields | Service Account Email, **Project IDs to scan** (comma separated) | **Organization ID**, Service Account Email, **Organization Configuration** |

**Organization Scan is the better default** unless the projects in scope are a
short, fixed list: with Direct Connection, a project created next quarter stays
invisible until someone edits the connection.

#### Organization Configuration

Organization Scan takes a JSON object scoping which folders and projects are in
play. `*` means everything, and the deny lists win over the allow lists:

```json
{
  "allowed_folders": ["*"],
  "allowed_project_ids": ["*"],
  "disallowed_folders": [],
  "disallowed_project_ids": []
}
```

Granting **Security Auditor** at the organization level is what makes discovery
work. Granted per project instead, an Organization Scan still connects and then
finds only the projects that happen to carry the role — the usual reason an org
scan looks like it "missed" projects.

---

#### Step 6: Configure Authentication

![Screenshot](https://assets.relyanceuat.xyz/images/docs/5831753418893/43816029892749.jpg)
Add the service account details and project information:

**Service Account Email:**

`rely-<tenant_name>-int-<suffix>@relyance-prod.iam.gserviceaccount.com`

Then fill in the rest for the connection type you chose:

- **Direct Connection** — **Project IDs to scan**, comma separated, e.g.
  `acme-dev-project,acme-stage-project-2`.
- **Organization Scan** — your **Organization ID**, and the **Organization Configuration** JSON above.

---

#### Step 7: Complete Authentication

Click **"Authenticate,"** and you're done!

### Verify the connection is really working

1. Confirm the connection reaches **Connected**. A failure here is almost always
   the impersonation grant from Step 3 — `Workload Identity User` for
   `tenant-gcp-integrations@relyance-prod.iam.gserviceaccount.com` on the service
   account you created.
2. After the first scan, check the projects you expected appear as assets. On an
   Organization Scan, fewer projects than expected means the role is granted per
   project rather than on the organization, or a folder or project is excluded by
   the Organization Configuration.
3. Missing AI assets specifically means the `roles/aiplatform.viewer` and
   `roles/cloudfunctions.viewer` grants from Step 2B did not land — the rest of
   the scan is unaffected, which is why this is easy to miss.

<!-- terraform-examples:begin (generated from the integration catalog; do not hand-edit) -->

## Manage this integration with Terraform

Connections for this integration can be managed as code with the [Relyance Terraform provider](https://registry.terraform.io/providers/Relyance/relyance/latest). Non-secret fields go in `auth.params`; secret fields go in `auth.secrets_wo`, which is write-only — never stored in Terraform state. Rotate secrets by bumping `auth.secrets_wo_version`.

### Service account — Direct Connection

```hcl
resource "relyance_integration_connection" "gcloud_0" {
  vendor = "gcloud"
  name   = "<your connection name>"

  auth = {
    method = "service-account-direct"
    params = {
      service_account_email = "<service_account_email>"
      project_ids = "acme-dev-project,acme-stage-project-2"
    }
  }

  scans = { "assets-discovery" = { enabled = true } }
}
```

### Service account — Organization Scan

```hcl
resource "relyance_integration_connection" "gcloud_1" {
  vendor = "gcloud"
  name   = "<your connection name>"

  auth = {
    method = "service-account-organization-scan"
    params = {
      organization_id = "<organization_id>"
      service_account_email = "<service_account_email>"
      organization_config = jsonencode({
        allowed_folders = [
          "*"
        ]
        allowed_project_ids = [
          "*"
        ]
        disallowed_folders = []
        disallowed_project_ids = []
      })
    }
  }

  scans = { "assets-discovery" = { enabled = true } }
}
```

<!-- terraform-examples:end -->