Prerequisites to setup Gmail protection with Cohesity Alta SaaS Protection
This topic covers the process of configuring the Google Workspace prerequisites to create the connector that will capture the data.
A few notes to consider:
The process will require elevated access to the Google Workspace console.
The connector only supports capturing data from users in Google Workspace; it does not support regular Gmail.
Authentication and Authorization
A service account is required to access resources, including Google Drives of delegated access to users.
A project is a collection of settings, credentials, and metadata about the application or applications you're working that make use of Google APIs and Google Cloud Platform resources.
Create a project
- Create a Ppoject by logging into the console via the following URL.
- Create a Credential of type service account.
- To enable the APIs.
Click the Enable APIS AND SERVICES.
From the list, enable the required APIs listed below: Google Drive, Service Directory API, Admin SDK API
- Create the service account, making it an owner of the project.
- Create the service account key and download the JSON
This JSON file will be used when configuring the connector.
- To enable domain-wide delegation for the service account, do the following:
Browse to: https://admin.google.com/ac/owl/domainwidedelegation
Select Security, then API controls, then Domain-wide delegation.
Click Add new.
Enter the Client ID, which is the service account Unique ID.
Enter the URL's below for the scopes:
https://www.googleapis.com/auth/admin.directory.user.readonly
https://www.googleapis.com/auth/gmail.modify
https://www.googleapis.com/auth/gmail.readonly
https://www.googleapis.com/auth/admin.directory.group.member.readonly
Click Authorize.
This completes the process. Now you can create and configure the Connector.