Google Cloud Platform
Cloud · Service-account JSON key · Daily
Service-account auth (JSON key). Pulls IAM policy bindings (admin-role count), Cloud Audit Logs config, and Cloud Storage public-access prevention status.
- Authentication
- Service-account JSON key
- Sync cadence
- Daily
- Stale threshold
- Every 2 days
- Category
- Cloud
Evidence this connector produces
Every sync writes typed evidence rows linked to the controls below. Evidence is immutable once attached to an approved assessment, fingerprinted for de-dup, and surfaced in the control coverage calculation on your dashboard.
How to connect
Create a service account in your GCP project with read-only viewer roles, generate a JSON key, and paste the project ID + JSON key contents.
- 1Create the service account
GCP Console → IAM & Admin → Service Accounts → Create. Grant the Viewer + Security Reviewer roles at the project (or organization) level.
- 2Create a JSON key
On the service account → Keys → Add Key → JSON. Download the file — it contains the private key. Treat it like a password.
- 3Paste the project ID + key contents
Project ID is shown at the top of the GCP Console. Paste the entire JSON key (including the BEGIN/END PRIVATE KEY block) into the form.
Security model
Every connector ships behind the same auditor-grade primitives — not just RBAC config, but architectural enforcement.
Tokens, client secrets, and service-account keys are encrypted under a per-tenant AWS KMS data key. The plaintext is never persisted, never logged, and never leaves the FastAPI process boundary.
Every Connection, ConnectorRun, and emitted Evidence row carries an organization ObjectId. The scheduler never iterates without an org-scoped filter; cross-tenant evidence bleed is impossible at the data layer.
Connect, sync, sync-failure, re-auth, and revoke each write a row to the immutable AuditLog. The full lifecycle is reconstructable for any examiner.
Revoking a connection sets deletedAt and clears the encrypted credential blob, but the historical evidence + sync log stays queryable for the retention window. Auditors can still trace what was attested when.
If this connector hasn't synced in Every 2 days, control coverage degrades automatically and an alert fires. Auditors don't trust stale evidence — neither do we.
We request the minimum read-only scopes needed for the listed evidence. No write scopes, no admin scopes, no scopes outside the documented set.
Ready to connect Google Cloud Platform?
Connect from Settings → Integrations — typically under 5 minutes. Or talk to us first.