Google Cloud Platform

Google Cloud Platform (GCP) is a suite of cloud computing services that runs on the same infrastructure that Google uses internally for its end-user products. It provides services for compute, storage, networking, big data, machine learning and IoT, as well as cloud management, security and developer tools.

Prerequisites

• Access to GCP Console with appropriate permissions
• Write access to Tenant Relyance UI

---

Step 1: Create a Service Account

Create a new service account following the naming convention below. This service account will be used to run scan on your GCP project.

Naming Convention:

rely-<tenant_name>-int-<suffix>

Example:

rely-boutiqueapp-int-relyancesa

---

Step 2: Assign Security Auditor & VertexAI Viewer Role

A. Assign the Security Auditor role to the service account created in Step 1.

B. Similarly assign the VertexAI Viewer Role and CloudFunction Viewer Role

roles/aiplatform.viewer

roles/cloudfunctions.viewer

---

Step 3: Configure Service Account Impersonation

Allow the integration service account to impersonate the service account created above:

1. Navigate to the "Principals with access" tab under the details of the service account created in Step 1
2. Click "Grant Access" under "View by Principals"
3. In the drawer, add the following details under "Add principals": New principals: tenant-gcp-integrations@relyance-prod.iam.gserviceaccount.com
4. Assign roles: Workload Identity User
5. Click Save

---

Step 4: Configure Additional GCP Projects (Optional)

If you need to scan additional GCP projects with the same service account:

1. Navigate to the target project dashboard
2. Open the IAM tab in " IAM & Admin" view
3. Under IAM > Allow > View by principals, click "Grant access"
4. Add the service account principal created in Step 1
5. Assign the Security Auditor role and the VertexAI Viewer role
6. Click Save

---

Step 5: Add Connection in Relyance UI

1. Navigate to Settings > Integrations > "Google Cloud Platform" in the Relyance UI
2. Click to add a new connection

---

The Authentication step asks for:

• Using Direct Connection —
  • Service Account Email: Email of the service account to impersonate (i.e: <name>@<project>.iam.gserviceaccount.com); required.
  • Project IDs to scan (comma separated): required.
• Using Organization Scan —
  • Organization ID: The GCP organization ID to scan; required.
  • Service Account Email: Email of the service account to impersonate (i.e: <name>@<project>.iam.gserviceaccount.com); required.
  • Organization Configuration: Configuration for filtering projects and folders within the organization; required; a JSON value; the field is pre-filled with the shape to complete.

Which connection type to choose

There are two, and the choice decides where the roles from Step 2 have to be granted:

Organization Scan is the better default unless the projects in scope are a short, fixed list: with Direct Connection, a project created next quarter stays invisible until someone edits the connection.

Organization Configuration

Organization Scan takes a JSON object scoping which folders and projects are in play. * means everything, and the deny lists win over the allow lists:

{
  "allowed_folders": ["*"],
  "allowed_project_ids": ["*"],
  "disallowed_folders": [],
  "disallowed_project_ids": []
}

Granting Security Auditor at the organization level is what makes discovery work. Granted per project instead, an Organization Scan still connects and then finds only the projects that happen to carry the role — the usual reason an org scan looks like it "missed" projects.

---

Step 6: Configure Authentication

Add the service account details and project information:

Service Account Email:

rely-<tenant_name>-int-<suffix>@relyance-prod.iam.gserviceaccount.com

Then fill in the rest for the connection type you chose:

• Direct Connection — Project IDs to scan, comma separated, e.g. acme-dev-project,acme-stage-project-2.
• Organization Scan — your Organization ID, and the Organization Configuration JSON above.

---

Step 7: Complete Authentication

Click "Authenticate," and you're done!

Verify the connection is really working

1. Confirm the connection reaches Connected. A failure here is almost always the impersonation grant from Step 3 — Workload Identity User for tenant-gcp-integrations@relyance-prod.iam.gserviceaccount.com on the service account you created.
2. After the first scan, check the projects you expected appear as assets. On an Organization Scan, fewer projects than expected means the role is granted per project rather than on the organization, or a folder or project is excluded by the Organization Configuration.
3. Missing AI assets specifically means the roles/aiplatform.viewer and roles/cloudfunctions.viewer grants from Step 2B did not land — the rest of the scan is unaffected, which is why this is easy to miss.

Manage this integration with Terraform

Connections for this integration can be managed as code with the Relyance Terraform provider. Non-secret fields go in auth.params; secret fields go in auth.secrets_wo, which is write-only — never stored in Terraform state. Rotate secrets by bumping auth.secrets_wo_version.

Service account — Direct Connection

resource "relyance_integration_connection" "gcloud_0" {
  vendor = "gcloud"
  name   = "<your connection name>"

  auth = {
    method = "service-account-direct"
    params = {
      service_account_email = "<service_account_email>"
      project_ids = "acme-dev-project,acme-stage-project-2"
    }
  }

  scans = { "assets-discovery" = { enabled = true } }
}

Service account — Organization Scan

resource "relyance_integration_connection" "gcloud_1" {
  vendor = "gcloud"
  name   = "<your connection name>"

  auth = {
    method = "service-account-organization-scan"
    params = {
      organization_id = "<organization_id>"
      service_account_email = "<service_account_email>"
      organization_config = jsonencode({
        allowed_folders = [
          "*"
        ]
        allowed_project_ids = [
          "*"
        ]
        disallowed_folders = []
        disallowed_project_ids = []
      })
    }
  }

  scans = { "assets-discovery" = { enabled = true } }
}