Skip to main content

Google Cloud

Visualize Google Cloud resources, map Google Cloud users to employees, and monitor visibility and governance of the environment through queries and alerts.

Installation​

info

To use this integration, JupiterOne requires the contents of a Google Cloud service account key file with the correct API services enabled. In addition, you must have permission in JupiterOne to install new integrations.

Overview​

The Google Cloud integration requires three main configuration steps:

  1. Enable Google Cloud service APIs for the services you want to ingest
  2. Create a service account with appropriate permissions
  3. Configure the integration in JupiterOne with the service account key

Google Cloud Configuration​

Google Cloud has most API services disabled by default. When a Google Cloud service API is disabled, the JupiterOne integration will not ingest the data from that API.

tip

You only need to enable the APIs for the services you want JupiterOne to ingest. If a service is not used in your Google Cloud environment, you can skip enabling its API.

The following table lists all Google Cloud service APIs supported by the JupiterOne integration. Enable the APIs for the services you want to ingest:

Service NameService APIRequired
Access Context Manageraccesscontextmanager.googleapis.comNo
AlloyDBalloydb.googleapis.comNo
API Gatewayapigateway.googleapis.comNo
API Keysapikeys.googleapis.comNo
App Engine Adminappengine.googleapis.comNo
Artifact Registryartifactregistry.googleapis.comNo
BeyondCorpbeyondcorp.googleapis.comNo
BigQuerybigquery.googleapis.comNo
BigTable Adminbigtableadmin.googleapis.comNo
Billing Budgetsbillingbudgets.googleapis.comNo
Binary Authorizationbinaryauthorization.googleapis.comNo
Certificate Authority Serviceprivateca.googleapis.comNo
Cloud Assetcloudasset.googleapis.comYes
Cloud Billingcloudbilling.googleapis.comNo
Cloud Buildcloudbuild.googleapis.comNo
Cloud Dataflowdataflow.googleapis.comNo
Cloud Dataprocdataproc.googleapis.comNo
Cloud Deployclouddeploy.googleapis.comNo
Cloud DNSdns.googleapis.comNo
Cloud Functionscloudfunctions.googleapis.comNo
Cloud Identitycloudidentity.googleapis.comNo
Cloud Key Management Service (KMS)cloudkms.googleapis.comNo
Cloud Logginglogging.googleapis.comNo
Cloud Memorystore for Memcachedmemcache.googleapis.comNo
Cloud Memorystore for Redisredis.googleapis.comNo
Cloud Pub/Subpubsub.googleapis.comNo
Cloud Resource Managercloudresourcemanager.googleapis.comYes
Cloud Runrun.googleapis.comNo
Cloud Source Repositoriessourcerepo.googleapis.comNo
Cloud Spannerspanner.googleapis.comNo
Cloud SQL Adminsqladmin.googleapis.comNo
Cloud Storagestorage.googleapis.comNo
Cloud Storage APIstorage-api.googleapis.comNo
Cloud Storage Componentstorage-component.googleapis.comNo
Cloud Workflowsworkflows.googleapis.comNo
Cloud Workstationsworkstations.googleapis.comNo
Compute Enginecompute.googleapis.comNo
Datastoredatastore.googleapis.comNo
Essential Contactsessentialcontacts.googleapis.comNo
Filestorefile.googleapis.comNo
Firestorefirestore.googleapis.comNo
Identity and Access Management (IAM)iam.googleapis.comYes
Identity-Aware Proxyiap.googleapis.comNo
Kubernetes Enginecontainer.googleapis.comNo
Network Managementnetworkmanagement.googleapis.comNo
Organization Policyorgpolicy.googleapis.comNo
Policy Intelligencepolicyanalyzer.googleapis.comNo
Secret Managersecretmanager.googleapis.comNo
Security Command Centersecuritycenter.googleapis.comNo
Service Usageserviceusage.googleapis.comYes
Stackdriver Monitoringmonitoring.googleapis.comNo
Vertex AIaiplatform.googleapis.comNo
Web Security Scannerwebsecurityscanner.googleapis.comNo
info

Required APIs: The APIs marked as "Required" (cloudasset.googleapis.com, cloudresourcemanager.googleapis.com, iam.googleapis.com, and serviceusage.googleapis.com) are necessary for the integration to function properly. All other APIs are optional and should only be enabled if you want to ingest data from those specific services.

Enabling Google Cloud Service APIs​

Google Cloud service APIs can be enabled using one of the following methods:

Method 1: Enable APIs from Google Cloud Console​

  1. Click on the service name link that you want to enable from the table above.
  2. Select your Google Cloud project from the project dropdown menu.
  3. Click Enable.

Method 2: Enable APIs using gcloud CLI​

Instructions on how to set up the gcloud CLI can be found in the JupiterOne Google Cloud integration developer documentation.

After setting up the gcloud CLI, you can run the following commands to enable all services that the JupiterOne integration supports.

note

Google Cloud limits you to enabling 20 services at a time, so the APIs are split into multiple commands below.

Step 1: Enable required APIs and first batch of services

gcloud services enable \
  cloudasset.googleapis.com \
  cloudresourcemanager.googleapis.com \
  iam.googleapis.com \
  serviceusage.googleapis.com \
  accesscontextmanager.googleapis.com \
  aiplatform.googleapis.com \
  alloydb.googleapis.com \
  apigateway.googleapis.com \
  apikeys.googleapis.com \
  appengine.googleapis.com \
  artifactregistry.googleapis.com \
  beyondcorp.googleapis.com \
  bigquery.googleapis.com \
  bigtableadmin.googleapis.com \
  billingbudgets.googleapis.com \
  binaryauthorization.googleapis.com \
  privateca.googleapis.com \
  cloudbilling.googleapis.com \
  cloudbuild.googleapis.com \
  dataflow.googleapis.com

Step 2: Enable remaining services (batch 2)

gcloud services enable \
  dataproc.googleapis.com \
  clouddeploy.googleapis.com \
  dns.googleapis.com \
  cloudfunctions.googleapis.com \
  cloudidentity.googleapis.com \
  cloudkms.googleapis.com \
  logging.googleapis.com \
  memcache.googleapis.com \
  redis.googleapis.com \
  pubsub.googleapis.com \
  run.googleapis.com \
  sourcerepo.googleapis.com \
  spanner.googleapis.com \
  sqladmin.googleapis.com \
  storage.googleapis.com \
  storage-api.googleapis.com \
  storage-component.googleapis.com \
  workflows.googleapis.com \
  workstations.googleapis.com \
  compute.googleapis.com

Step 3: Enable remaining services (batch 3)

gcloud services enable \
  datastore.googleapis.com \
  essentialcontacts.googleapis.com \
  file.googleapis.com \
  firestore.googleapis.com \
  iap.googleapis.com \
  container.googleapis.com \
  networkmanagement.googleapis.com \
  orgpolicy.googleapis.com \
  policyanalyzer.googleapis.com \
  secretmanager.googleapis.com \
  securitycenter.googleapis.com \
  monitoring.googleapis.com \
  websecurityscanner.googleapis.com
tip

If you don't use certain services in your Google Cloud environment, you can skip enabling their APIs. However, the required APIs (cloudasset.googleapis.com, cloudresourcemanager.googleapis.com, iam.googleapis.com, and serviceusage.googleapis.com) must always be enabled for the integration to function.

Creating Google Cloud project service account​

We must assign the correct permissions to the newly created service account for the integration to be run. We recommend using the following roles managed by Google Cloud:

Some additional data may be optionally ingested by the JupiterOne Google Cloud integration by configuring a custom role with the following permissions:

appengine.applications.get binaryauthorization.policy.get cloudasset.assets.searchAllIamPolicies compute.projects.get orgpolicy.policy.get

For BigQuery, the following additional permissions are needed to ingest BigQuery datasets, models, and tables respectively:

bigquery.datasets.get bigquery.models.getMetadata bigquery.tables.get

See the Google Cloud custom role documentation for additional information on how custom roles can be configured and assigned.

NOTE: You may also create a service account using the gcloud CLI. There is documentation on how to leverage the CLI in the JupiterOne Google Cloud integration developer documentation.

Custom Role with Specific Permissions​

Instead of using the Google Cloud managed roles listed above, you can create a custom IAM role with only the specific permissions required by the JupiterOne integration. This approach follows the principle of least privilege and gives you fine-grained control over what the integration can access.

The permissions required depend on which Google Cloud services you have enabled and want JupiterOne to ingest.

Permissions to be added

"accesscontextmanager.accessLevels.list", "accesscontextmanager.accessPolicies.list", "accesscontextmanager.servicePerimeters.list", "aiplatform.batchPredictionJobs.list", "aiplatform.datasets.list", "aiplatform.endpoints.list", "aiplatform.models.list", "aiplatform.trainingPipelines.list", "alloydb.backups.get", "alloydb.clusters.list", "alloydb.instances.connect", "alloydb.instances.list", "alloydb.users.list", "apigateway.apiconfigs.getIamPolicy", "apigateway.apiconfigs.list", "apigateway.apis.getIamPolicy", "apigateway.apis.list", "apigateway.gateways.getIamPolicy", "apigateway.gateways.list", "apikeys.keys.get", "apikeys.keys.list", "appengine.applications.get", "appengine.instances.list", "appengine.services.list", "appengine.versions.list", "artifactregistry.packages.list", "artifactregistry.repositories.list", "artifactregistry.vpcscconfigs.get", "bigquery.datasets.get", "bigquery.models.getData", "bigquery.models.getMetadata", "bigquery.models.list", "bigquery.tables.get", "bigquery.tables.getIamPolicy", "bigquery.tables.list", "bigtable.appProfiles.list", "bigtable.backups.list", "bigtable.clusters.list", "bigtable.instances.list", "bigtable.tables.list", "billing.budgets.list", "binaryauthorization.policy.get", "cloudasset.assets.listCloudbillingBillingAccounts", "cloudasset.assets.listCloudbillingProjectBillingInfos", "cloudasset.assets.searchAllIamPolicies", "cloudbuild.builds.get", "cloudbuild.builds.list", "cloudbuild.integrations.get", "cloudbuild.integrations.list", "cloudbuild.repositories.get", "cloudbuild.repositories.list", "cloudbuild.workerpools.list", "clouddeploy.automations.list", "clouddeploy.deliveryPipelines.list", "cloudfunctions.functions.list", "cloudkms.cryptoKeys.getIamPolicy", "cloudkms.cryptoKeys.list", "cloudkms.keyRings.list", "cloudsecurityscanner.scanruns.list", "cloudsecurityscanner.scans.list", "cloudsql.databases.list", "cloudsql.instances.list", "cloudsql.users.list", "compute.addresses.list", "compute.backendBuckets.list", "compute.backendServices.list", "compute.disks.list", "compute.externalVpnGateways.list", "compute.firewalls.list", "compute.forwardingRules.list", "compute.globalAddresses.list", "compute.globalForwardingRules.list", "compute.healthChecks.list", "compute.images.get", "compute.images.getIamPolicy", "compute.images.list", "compute.instanceGroups.list", "compute.instances.list", "compute.networks.list", "compute.projects.get", "compute.regionBackendServices.list", "compute.regionHealthChecks.list", "compute.regionTargetHttpProxies.list", "compute.regionTargetHttpsProxies.list", "compute.regionUrlMaps.list", "compute.routers.list", "compute.snapshots.list", "compute.sslPolicies.list", "compute.subnetworks.list", "compute.targetHttpProxies.list", "compute.targetHttpsProxies.list", "compute.targetPools.list", "compute.targetSslProxies.list", "compute.targetVpnGateways.list", "compute.urlMaps.list", "compute.vpnGateways.list", "compute.vpnTunnels.list", "container.clusters.list", "dataproc.clusters.list", "dns.managedZones.list", "dns.policies.list", "dns.resourceRecordSets.get", "essentialcontacts.contacts.list", "file.instances.list", "firestore.databases.list", "iam.roles.list", "iam.serviceAccountKeys.list", "iam.serviceAccounts.list", "logging.logMetrics.list", "logging.sinks.list", "memcache.instances.list", "monitoring.alertPolicies.list", "orgpolicy.policies.list", "orgpolicy.policy.get", "osconfig.inventories.get", "privateca.caPools.list", "privateca.certificateAuthorities.getIamPolicy", "privateca.certificateAuthorities.list", "privateca.certificates.list", "pubsub.subscriptions.list", "pubsub.topics.getIamPolicy", "pubsub.topics.list", "redis.instances.list", "resourcemanager.folders.list", "resourcemanager.organizations.get", "resourcemanager.projects.get", "resourcemanager.projects.getIamPolicy", "resourcemanager.projects.list", "run.configurations.list", "run.routes.list", "run.services.list", "secretmanager.secrets.list", "secretmanager.versions.list", "securitycenter.findings.list", "serviceusage.services.list", "source.repos.list", "spanner.backups.get", "spanner.databases.getIamPolicy", "spanner.databases.list", "spanner.databasesRoles.list", "spanner.instanceConfigs.list", "spanner.instances.list", "storage.buckets.getIamPolicy", "storage.buckets.list", "workflows.workflows.list", "workstations.clusters.list", "workstations.configs.list", "workstations.workstations.list"

Generate a service account key​

See the Google Cloud service account key documentation for more information on how to create a service account key for the service account that you would like to ingest data using.

NOTE: You may also create a service account key using the gcloud CLI. Read more about the CLI in the Google Cloud integration developer documentation.

JupiterOne + Google Cloud Organization​

Given the correct permissions, JupiterOne has the ability to automatically discover each project under a Google Cloud organization and configure integration instances for each of the projects.

Setup​

  1. Select one Google Cloud project to configure a service account for JupiterOne.

  2. Create the service account without a role. Copy the email address of the new service account (e.g. my-sa@my-j1-project.iam.gserviceaccount.com).

  3. Generate and copy a new service account key.

  4. Enable service APIs in both the "main" project and each "child" project that you'd like JupiterOne to access.

    Important: The following APIs must be enabled in the "main" project:

    • cloudasset.googleapis.com (Cloud Asset)
    • cloudresourcemanager.googleapis.com (Cloud Resource Manager)
    • iam.googleapis.com (Identity and Access Management)
    • serviceusage.googleapis.com (Service Usage)

    For child projects: Enable the service APIs for the specific services you want to ingest from each project. Refer to the API table in the earlier section for the complete list of supported services.

  5. Switch to the organization that you'd like to create individual integration instances for each project

  6. Create a new custom role with the following permissions:

resourcemanager.folders.get resourcemanager.folders.list resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list serviceusage.services.list resourcemanager.organizations.getIamPolicy cloudasset.assets.searchAllIamPolicies

The integration will also try to ingest organization policy for "storage.publicAccessPrevention" to precisely calculate storage buckets public access, it is therefore recommended that the following permission is also included in the custom role above:

orgpolicy.policy.get

The integration will calculate if a storage bucket is public or not based on the following conditions:

  • Public to internet means one or more bucket-level permissions grant access to allUsers or allAuthenticatedUsers.
  • Not public means the bucket’s policy controls all objects uniformly, and no permissions have been granted to allUsers or allAuthenticatedUsers.
  • Subject to object ACLs means fine-grained, object-level access control lists (ACLs) are enabled. Objects may be public if they grant access to allUsers or allAuthenticatedUsers.

  1. Navigate to the Cloud Resource Manager for that organization and add a new member to the organization. The new member email address is the email address of the service account that was created earlier. Select the new organization role that was created above, as well as the Google Cloud managed role "Security Reviewer" (roles/iam.securityReviewer) or an alternative JupiterOne custom role that you've created.

  2. Navigate to the JupiterOne Google Cloud integration configuration page to begin configuring the "main" integration instance.

Use the generated service account key as the value for the "Service Account Key File" field.

note

The "Polling Interval" that is selected for the "main" integration instances will be the same polling interval that is used for each of the child integration instances.

  1. Select the "Configure Organization Projects" checkbox.
  2. Enter the numerical value of the Google Cloud organization into the "Organization ID" text field (e.g. "1234567890").
  3. Click CREATE CONFIGURATION.

Depending on how many projects exist under a Google Cloud organization, the auto-configuration process may take a few minutes to complete. When the process has been completed, you will see your new integration instances on the JupiterOne Google Cloud integration list page.

Configuration in JupiterOne​

To install the Google Cloud integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select Google Cloud. Click New Instance to begin configuring your integration.

Creating an instance requires the following:

  • Account Name by which you want to identify this Google Cloud account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when Add AccountName Tag is enabled.
  • Description that will assist your team to identify the integration instance.
  • Polling Interval that you feel is sufficient for your monitoring needs. You can leave this as DISABLED and manually execute the integration.
  • Service Account Key File contents of the Google Cloud service account.
  • Add any tags you want to use to simplify data management and queries.

Optionally, you can enter a project ID to target for data ingestion. The default is the project ID specified in the service account key file.

Select Configure Organization Projects if you want J1 to auto-configure all projects in your organization. J1 applies the configuration to all other projects that do not have optional j1-integration: SKIP tag applied to the project in your infrastructure-as-code. Do not use the optional project ID if you want to use this feature.

Optionally, enter a numerical folder ID if you want to specify that J1 is to only ingest projects in a specific folder and any of its subfolders. If you have enabled Configure Organization Projects, J1 only auto-configures projects in this specified folder.

Click Create after all values are provided to finalize the integration.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.