Google Cloud Platform

The Google Cloud Platform (GCP) connector retrieves the inventory of an organization, a folder or a project through the Cloud Asset Inventory API, and imports it into OverView.

Objective

The GCP connector imports the following information:

• Compute Engine instances: machine type, network interfaces and public exposure, labels, and operating system and installed software when OS inventory is available
• Google Kubernetes Engine (GKE) clusters and nodes, with the container images running on each node
• Docker images stored in Artifact Registry
• IAM principals (users, groups and service accounts) with the roles granted to them
• The project of each asset, added as a tag

Prerequisites

• A Google Cloud organization, folder or project to inventory
• A Google Cloud account allowed to create a service account and its key, and to grant IAM roles on the scope to inventory
• Service account key creation not blocked by an organization policy
• For the installed software of Compute Engine instances: VM Manager set up on the instances (OS Config API enabled and enable-osconfig metadata set to TRUE). Instances without VM Manager are imported without their software list.

Information to provide in OverView

Procedure

Create a Service Account

1. Access Google Cloud Console:
   • Log in to Google Cloud Console.
2. Navigate to IAM & Admin:
   • Click the Menu icon (top left).
   • Go to IAM & Admin > Service Accounts.
3. Create Service Account:
   • Click Create Service Account.
   • Enter a name and description (e.g., "OverView Connector").
   • Click Create and Continue.

Generate and Download JSON Key

1. Access Service Account:
   • Click on the created service account email.
   • Go to the Keys tab.
2. Create JSON Key:
   • Click Add Key > Create new key.
   • Select JSON as the key type.
   • Click Create.
   • The JSON file downloads automatically.
3. Secure the Key:
   • Save the JSON file securely in a protected location.
   • Its content is the Service Account Key to provide in OverView.

Enable the Cloud Asset API

1. Select the Quota Project:
   • In the project picker at the top of the console, select the project of the service account, or the project provided as Quota Project ID.
2. Enable the API:
   • Go to APIs & Services > Library.
   • Search for Cloud Asset API and click Enable.

Grant Roles on the Scope

1. Grant Cloud Asset Viewer on the Scope:
   • Go to IAM & Admin > IAM.
   • In the project picker, select the organization, folder or project to inventory.
   • Click Grant Access.
   • In New principals, enter the service account email.
   • In Select a role, choose Cloud Asset Viewer.
   • Click Save.
2. Grant Service Usage Consumer on the Quota Project:
   • Repeat the previous step on the quota project with the Service Usage Consumer role.
   • A grant on an organization or folder that contains the quota project also applies to it.

Retrieve the Scope

1. Organization:
   • In the project picker, select the organization.
   • Click More > Settings: the page displays the organization resource ID.
   • The scope is organizations/ followed by this ID.
2. Folder or Project:
   • Go to IAM & Admin > Manage Resources.
   • The ID column shows the folder ID or the project ID.
   • The scope is folders/ followed by the folder ID, or projects/ followed by the project ID.

Required Permissions

Both roles are read-only: the connector does not modify any Google Cloud resource.

Official Documentation

For more details, see:

• Cloud Asset Inventory roles and permissions
• Set up VM Manager
• Create and delete service account keys