Google Cloud Platform

View as Markdown

Community Platform

The Google Cloud Platform (GCP) integration syncs your GCP cloud inventories with runZero to give you visibility into your cloud assets. runZero also integrates with other cloud providers, such as Microsoft Azure and Amazon AWS. As with other integrations, you add the credentials needed to authenticate to GCP and set up a connector in runZero. runZero pulls in GCP compute instance VMs along with their GCP attributes, which you can view on each asset.

The integration supports these GCP asset types:

  • Compute Engine instances
  • Load balancers
  • Cloud SQL

Requirements

Before you begin, you need:

How to set up the Google Cloud Platform integration

Work through these steps in order:

Step 1: Create Google Cloud Platform credentials

  1. Go to the Credentials page and click Add Credential.
  2. From the Credentials type dropdown, choose GCP Service Account Key.
  3. Name the credential, for example GCP.
  4. Set the Include all projects toggle to Yes to gather asset data from every GCP project the service account can access. With the toggle at No, the integration gathers asset data only from the project named in the key file.
  5. Click Choose file and upload the service account key file you downloaded from GCP.
  6. If other organizations should be able to use this credential, select the Make this a global credential option. Otherwise, you can grant access per organization.
  7. Save the credential.

Step 2: Choose how to configure the GCP integration

You can run the GCP integration as either a scan probe or a connector task. A scan probe gathers integration data during a scan task. A connector task runs on its own, from the cloud or from one of your Explorers, and performs only the integration sync.

Step 3: Activate the Google Cloud Platform integration

With your GCP credential saved, set up a connector task or scan probe to sync your data.

Step 3a: Configure the GCP integration as a connector task

  1. Activate a connection to GCP. All third-party connections are also available from the integrations page, your inventory, or the tasks page.
  2. Choose the credential you added earlier. If it is missing from the list, confirm that the credential has access to the organization you are working in.
  3. Name the task, for example Google Cloud Platform sync.
  4. Schedule the sync to run once or on a recurring schedule. The schedule starts on the date and time you set.
  5. Choose the site to add your assets to, either an existing site or a new one created when the sync runs. Sites group related assets, and you can have runZero automatically generate a new site per GCP project by selecting that option in the task configuration.
  6. To leave out assets that runZero has not scanned, switch the Exclude unknown assets toggle to Yes. By default, the integration includes assets that runZero has not scanned.
  7. Activate the connection. The sync runs on the schedule you set, and the Scheduled tasks page shows when the next sync will occur.

Step 3b: Configure the GCP integration as a scan probe

  1. Create a new scan task, or select a future or recurring scan task from your Tasks page.
  2. Add or update the scan parameters as needed.
  3. On the Probes and SNMP tab, choose any additional probes to include, set the GCP toggle to Yes, and adjust the default options if needed.
  4. On the Credentials tab, set the GCP toggle to Yes for the credential you want to use.
  5. Click Initialize scan to save the scan task. It runs immediately or at the scheduled time.

Step 4: View your Google Cloud Platform assets

After a successful sync, open your inventory to see your GCP assets. They show a Google icon in the Source column.

To filter for GCP assets, run this query:

source:gcp

Click into any asset to see its attributes, including those returned by GCP. For more ways to filter, see the asset inventory search keywords.

Troubleshooting

If you are having trouble with this integration, the questions and answers below may help.

Why is the Google Cloud Platform integration unable to connect?

  1. Check whether the GCP integration is returning any data.
    • Query the inventory rather than the task details to review all the data available from this integration.
    • In some cases, an integration’s configuration limits how much data reaches the runZero console.
  2. Some integrations require specific actions that are easy to overlook. If you miss a step during setup, the integration may not work correctly. Review this page and follow the steps exactly.
  3. If the GCP integration can’t connect, check the task log for errors. Common errors include:
    • 500: server error, unable to connect to the endpoint
    • 404: hitting an unknown endpoint on the server
    • 403: not authorized, likely a credential issue
Updated