Configure Service Account for GCP

Cloud Snapshot Manager allows you to use Service Account to discover and protect resources within a GCP project.

Prerequisites

Following are the prerequisites to configure a Service Account for GCP.

  • IAM Custom Role: GCP IAM custom roles are used to create and manage roles with specific permissions for Service Account. They allow for granular access control to GCP resources. This custom IAM role has the minimum permissions necessary for the CSM to safeguard the GCP resources.
  • Service Account: A GCP Service Account is a special type of account in Google Cloud Platform. It is used to authenticate and authorize access to GCP resources and can be granted specific roles and permissions to perform certain actions. In CSM, it is used to discover, protect, and expire resources. This should be a dedicated Service Account for CSM per GCP project.
  • Service Account Key: A service account key in GCP is a JSON file that contains the private key and other information that is associated with a service account. The key is used to authenticate the service account and authorize access to GCP resources.

About this task

The following steps have been provided as an example to assist you create a Service Account:

Create IAM Custom Role

Steps

  1. Log in to GCP Management Console.
  2. Select the project where you want to create a role.
  3. Complete the following steps to create a custom role.
    1. Go to IAM and Admin page > Roles tab.
    2. Click Create Role.
    3. Update details such as Title, Description, ID, and Role launch state.
    4. Click ADD PERMISSIONS. Add all required permission ( GCP Privileges).
    5. Click Create.
      NOTE: You can also create a custom IAM role with minimum permissions using the cloud shell command in GCP Cloud Shell command for custom IAM role with minimum GCP permissions

Create Service Account

Steps

  1. Log in to GCP Management Console
  2. Select the project where you want to create a role.
  3. Provide Service Accounts details such as Service account name, Service account ID, and Service account description.
  4. Click CREATE AND CONTINUE .
  5. Select the custom role that you created in the previous step.
  6. Click DONE.

Generate Service Account Key

Steps

  1. Go to IAM & Admin > Service Account tab.
  2. Select the service account for which you want to generate the key.
  3. Click Manage Keys.
  4. On Keys page, click Create new key.
  5. Select the Key type as JSON, and then click CREATE.
    The Key file gets downloaded on your local system.
  6. Open the file in the text editor.
    Text editor
    NOTE: Ensure that when registering a cloud account, for a private key, you fill in the entire value within the double quotes and do not omit any characters.