Connect Google Cloud

Safeguard reads your Google Cloud projects with read-only access: IAM, Cloud Storage buckets, logging, keys, networking and the other services the checks cover. One connection reads every project the credential can see; a project that cannot be read shows one error naming that project, and the others still run.

The Google Cloud Platform and Google Cloud Storage cards read the same Google Cloud API, so one connection covers both.

Choose a sign-in

• OAuth: you sign in with Google and approve cloud-platform.read-only. Safeguard reads what your Google account can see.
• Service account key: you create a service account, grant it read-only roles, and paste its JSON key. Best for a stable connection that does not depend on one person's account.

Option A: OAuth

1. Open Compliance › Connectors, search for Google Cloud Platform and click Connect.
2. Choose OAuth, sign in with Google and approve the read-only scope.

If the card later shows Not working because the token expired, use Re-authorize.

Option B: Service account

1. In the Google Cloud console, create a service account and a JSON key for it.

2. Grant it these roles on each project, or once on the folder or organization above them:

   roles/viewer, roles/iam.securityReviewer, roles/logging.viewer, roles/cloudkms.viewer, roles/serviceusage.serviceUsageViewer, roles/orgpolicy.policyViewer, roles/serviceusage.apiKeysViewer, roles/essentialcontacts.viewer, roles/monitoring.viewer, roles/dns.reader, roles/bigquery.metadataViewer, roles/container.clusterViewer, roles/accessapproval.viewer, roles/policyanalyzer.activityAnalysisViewer

   roles/viewer alone lets the connection verify and list resources. The IAM policy reads, such as whether a bucket is public, need roles/iam.securityReviewer; the rest each add the reads of one service.

3. For the organization-level checks, also grant on the organization: roles/resourcemanager.organizationViewer, roles/iam.securityReviewer and roles/browser.

4. In Safeguard, open Compliance › Connectors › Google Cloud Platform › Connect, choose API token and paste the whole key into Service account key (JSON).

Several organizations

Google Cloud can be connected more than once, one connection per account. When multiple accounts are switched on for your workspace, open the connected card and choose Add another account. See Several accounts of one provider.

What Safeguard checks

Cloud Storage, including public buckets and locked log buckets, plus IAM, logging, keys, networking and the other services the roles above read. Every check only reads. A read that Google refuses is reported as an error naming the missing permission or role, not as a failed control.

Troubleshooting

• Not working, naming a permission or role: grant the role it names on the project, folder or organization, then use Re-check.
• A project is missing: the credential cannot see it. Grant the roles on that project, or on a folder or organization above it.