Configuring a GCP service account for CloudPoint
To protect the assets in Google Cloud Platform (GCP), CloudPoint requires permissions to be able to access and perform operations on those cloud assets. You must create a custom role and assign it with the minimum permissions that CloudPoint requires. You then associate that custom role with the service account that you created for CloudPoint.
Perform the following steps:
- Create a custom IAM role in GCP. While creating the role, add all the permissions that CloudPoint requires.
See Google Cloud Platform permissions required by CloudPoint.
For more information on creating and managing the custom roles, see Creating and managing custom roles section of Google documentation.
- Create a service account in GCP.
Grant the following roles to the service account:
The custom IAM role that you created in the earlier step. This is the role that has all the permissions that CloudPoint requires to access GCP resources.
The
iam.serviceAccountUserrole. This enables the service account to connect to the GCP using the service account context.
For more information on creating and managing service accounts, see Creating and managing service accounts section of Google documentation.