Google Cloud Platform Setup Guide

This guide walks you through creating a service account with read-only access to your Google Cloud Platform project for comprehensive security assessment.

Quick Start

The recommended method is to create a Service Account with read-only roles and generate a JSON key file. This provides secure, auditable access to your GCP resources.

Option 1: Service Account (Recommended)

Service accounts provide the most straightforward way to grant SecureStack read-only access to your GCP project.

Step-by-Step Instructions

1. Sign in to the Google Cloud Console → IAM & Admin → Service Accounts
2. Select your project from the dropdown at the top
3. Click "+ Create Service Account"
4. Fill in the service account details:
   • Name: ssap-security-scanner
   • ID: ssap-security-scanner (auto-generated)
   • Description: SecureStack security assessment read-only access
5. Click "Create and Continue"
6. Grant the following roles (click "+ Add Another Role" for each):
   • Viewer (roles/viewer) — Basic read access to all resources
   • Security Reviewer (roles/iam.securityReviewer) — View IAM policies
7. Click "Continue"
8. Skip the "Grant users access" step and click "Done"
9. Click on the newly created service account
10. Go to the "Keys" tab
11. Click "Add Key" → "Create new key"
12. Select "JSON" format
13. Click "Create" — the key file will download automatically
14. Upload this JSON file to SecureStack during onboarding

Option 2: Workload Identity Federation

For organizations with existing AWS-GCP federation or those wanting to avoid long-lived credentials, Workload Identity Federation provides keyless authentication.

Overview

1. Create a Workload Identity Pool in your GCP project
2. Add AWS as an identity provider with SecureStack's account ID:589062477585
3. Create a service account with the required roles
4. Configure the workload identity pool to impersonate the service account
5. Share the configuration with SecureStack support

Using gcloud CLI

You can also create the service account and assign roles using the gcloud CLI:

# Set your project ID
PROJECT_ID="your-project-id"
gcloud config set project $PROJECT_ID

# Create the service account
gcloud iam service-accounts create ssap-security-scanner \
  --display-name="SecureStack Security Scanner" \
  --description="Read-only access for SecureStack security assessments"

# Get the service account email
SA_EMAIL="ssap-security-scanner@$PROJECT_ID.iam.gserviceaccount.com"

# Grant Viewer role
gcloud projects add-iam-policy-binding $PROJECT_ID \
  --member="serviceAccount:$SA_EMAIL" \
  --role="roles/viewer"

# Grant Security Reviewer role
gcloud projects add-iam-policy-binding $PROJECT_ID \
  --member="serviceAccount:$SA_EMAIL" \
  --role="roles/iam.securityReviewer"

# Create and download the key file
gcloud iam service-accounts keys create ssap-key.json \
  --iam-account=$SA_EMAIL

echo "Key file created: ssap-key.json"
echo "Upload this file to SecureStack during onboarding"

Required Roles

At minimum, the service account needs these roles for comprehensive security assessment:

What SecureStack Scans

Once connected, SecureStack performs read-only analysis of your GCP project for:

• Compute Engine: VM instances, firewall rules, instance templates, disk encryption
• Cloud Storage: Bucket permissions, IAM policies, public access, encryption settings
• IAM: Service accounts, roles, policy bindings, key rotation
• Cloud SQL: Database instances, backups, SSL enforcement, authorized networks
• GKE: Kubernetes clusters, node pools, network policies, RBAC configuration
• Cloud Functions: Function configurations, triggers, IAM permissions
• VPC: Networks, subnets, firewall rules, Cloud NAT, Cloud Armor
• Cloud Logging: Audit log configuration, log sinks, retention policies
• Secret Manager: Secret metadata, rotation policies (not secret values)

Testing Your Setup

After creating the service account and downloading the key file, verify it works:

# Activate the service account
gcloud auth activate-service-account \
  --key-file=/path/to/ssap-key.json

# Verify the identity
gcloud auth list

# Test read access to various services
gcloud compute instances list --limit=1
gcloud storage buckets list --limit=1
gcloud iam service-accounts list --limit=1
gcloud sql instances list --limit=1

Multi-Project Setup

For organizations with multiple GCP projects:

1. Option A: Create a service account in each project with the same roles
2. Option B: Create a service account in one project and grant it cross-project access by adding IAM bindings in each target project
3. Option C: Use organization-level roles if you have Google Cloud Organization

Security Best Practices

• Use a dedicated project for shared service accounts when possible
• Enable audit logging for service account usage
• Rotate service account keys every 90 days
• Consider using Workload Identity Federation for keyless authentication
• Delete keys immediately after assessments if they're temporary
• Monitor service account activity in Cloud Audit Logs
• Use organization policies to restrict key creation if needed

Troubleshooting

"Permission denied" errors

Verify the service account has the roles/viewer role assigned at the project level. Check for any organization policies that might be restricting access.

"API not enabled" errors

Some APIs need to be enabled before they can be scanned. Enable the required APIs in theAPI Library.

Key file authentication fails

Ensure the JSON key file is complete and hasn't been modified. Try regenerating the key if issues persist.