Connect Google Cloud

Give a service account project and telemetry read access, connect it and verify the evidence.

How-to · Updated 2026-10-26 · Describes release 0.1.164

Before you start

Choose one project and use Google Cloud Shell in Bash. You need an AIOps owner or operator account. Your Google Cloud administrator needs service-account creation, project IAM-binding and API-enablement rights; creating a key also requires service-account key creation to be allowed by organization policy.

The example reads Compute Engine inventory, Monitoring metrics and ordinary Cloud Logging entries. It does not grant Owner, Editor, secret access or private Data Access audit logs.

1. Create a dedicated read service account

The command asks for your real project ID, enables the four APIs used in this example and creates a dedicated account. Existing organizations may require an administrator to enable APIs separately.

bash <<'BASH'
set -euo pipefail
read -r -p 'Google Cloud project ID: ' AIOPS_PROJECT </dev/tty
: "${AIOPS_PROJECT:?A project ID is required}"
AIOPS_SA="aiops-readonly@$AIOPS_PROJECT.iam.gserviceaccount.com"
gcloud services enable cloudresourcemanager.googleapis.com compute.googleapis.com monitoring.googleapis.com logging.googleapis.com --project "$AIOPS_PROJECT"
gcloud iam service-accounts create aiops-readonly --project "$AIOPS_PROJECT" --display-name 'AIOps read-only'
for AIOPS_ROLE in roles/browser roles/compute.viewer roles/monitoring.viewer roles/logging.viewer; do
  gcloud projects add-iam-policy-binding "$AIOPS_PROJECT" --member "serviceAccount:$AIOPS_SA" --role "$AIOPS_ROLE" --condition=None --quiet
done
printf 'Service account: %s\nScope JSON: {"projects":["%s"]}\n' "$AIOPS_SA" "$AIOPS_PROJECT"
BASH

Expected result: the account and project scope are printed. If aiops-readonly already exists, review it and assign the listed roles to that account instead of creating another. Project visibility · Monitoring reads · Logging reads.

2. Choose supported authentication

Keyless Google Cloud access is unavailable on this shared deployment. Use a dedicated service account and its JSON key so this connection has only that account's permissions. A Google Cloud connection saved without a key never borrows the platform's own identity: its Test, and every tool call, fails with keyless Google Cloud is not supported. Installing a private agent does not change this requirement.

Run the command below to create the JSON key. If your organization blocks service-account keys, ask its administrator for an approved connection method before continuing. Do not grant your project to a shared platform identity as a workaround. It creates a new private file and stops rather than overwrite an existing one. Keep the file private, paste it only into the datasource secret field, and rotate/delete the cloud key through your normal credential process. Google service-account key instructions.

bash <<'BASH'
set -euo pipefail
umask 077
read -r -p 'Service account email from step 1: ' AIOPS_SERVICE_ACCOUNT </dev/tty
: "${AIOPS_SERVICE_ACCOUNT:?A service account email is required}"
test ! -e aiops-readonly-key.json || { printf 'aiops-readonly-key.json already exists; use a new filename.\n' >&2; exit 1; }
gcloud iam service-accounts keys create aiops-readonly-key.json --iam-account "$AIOPS_SERVICE_ACCOUNT"
printf 'Paste the contents of aiops-readonly-key.json into the secret field; do not share this file.\n'
BASH

3. Connect and verify

Open Data sources (in the product: /portal/datasources) → Connect datasource → Google Cloud. Choose Investigate only. Paste the complete JSON key from step 2 into Service account JSON key. Do not leave this field empty. Put the printed {"projects":["your-real-project"]} in Scope JSON; there is no separate Project ID field.

Select Connect and verify. Expected result: token acquisition and the Cloud Resource Manager project-list request succeed. Run Audit perms on the connection's row in Data sources to check representative service reads as well. IAM is the access boundary; the scope field is not a substitute for project IAM.

4. Use the connection

Scan the source in Estate x-ray (in the product: /portal/xray), use its reviewed context, then send a validation alert. Use the generic webhook adapter for a Google Cloud alert after mapping its payload to that adapter's schema; an arbitrary Cloud Monitoring payload is not automatically the same format.

Expected result: a linked incident with evidence from your project. Use its chat to ask which resource and metric support the finding. For an approved fix, the incident or Change prepares the exact action and target on a write connection you allow for approved plans.

Compliance on Google Cloud: the platform checks EST-01 to EST-06 do not probe GCP yet — a connected project makes them answer probe pending and withhold a pass — and there is no Security Command Center intake.

Next steps