Skip to main content

Google Cloud Least Privilege Policies

Cloudaware’s GCP integration is designed to use read‑only access wherever possible. Use the patterns below to grant only the minimum rights required for each scenario.

Identity Model​

  • Use one or more dedicated service accounts for Cloudaware (for example, cloudaware-service-account).
  • Assign IAM roles to those service accounts at the organization, folder, or project level depending on where you want Cloudaware to collect resources.
  • Manage which projects are actually collected from within Cloudaware (via service account assignment to org/folder/project objects).

Baseline Discovery Access (Required)​

At minimum, Cloudaware needs read‑only access to compute, networking, storage, IAM metadata, and Resource Manager to build the CMDB.

  • Assign the role:
    • Viewer roles/viewer at the project level, or
    • Equivalent viewer roles at folder or organization level if you want automatic discovery of projects under those scopes.
  • If using organization‑level discovery, ensure the service account has viewer‑type permissions for:
    • Organization, folders, and projects (for example, Organization - Viewer, Folder - Viewer, etc.).

Cloudaware will use these permissions to list resources and retrieve configuration, not to modify them.

To learn more about IAM roles and related permissions in Google Cloud, refer to the Google Cloud documentation.

Optional Extended Permissions by Feature​

Enable the following only if you plan to use the corresponding Cloudaware features.

Organizations & Hierarchy​

To allow Cloudaware to discover organizations, folders, and projects and show the hierarchy in tree view:

  • Assign Viewer roles at the organization level, including:
    • Organization - Viewer roles/resourcemanager.organizationViewer
    • Folder - Viewer roles/resourcemanager.folderViewer
    • Viewer roles/viewer

This enables Cloudaware to auto‑discover projects within the organization.

Billing Accounts​

To allow Cloudaware to inventory billing accounts and related data:

  • On each relevant billing account, grant the service account:
    • Billing Account Viewer roles/billing.viewer.

Backups​

To use Cloudaware backup features for Compute Engine disks and snapshots, include the following permissions (usually via a custom role attached to the service account):

  • compute.disks.get
  • compute.disks.createSnapshot
  • compute.disks.list
  • compute.disks.setLabels
  • compute.snapshots.create
  • compute.snapshots.delete
  • compute.snapshots.get
  • compute.snapshots.list
  • compute.snapshots.setLabels
  • compute.zones.get
  • compute.zones.list

Tagging (Labels)​

To manage labels (tags) on resources directly from Cloudaware, add label‑related permissions to the custom role, such as:

  • bigquery.datasets.update
  • bigquery.tables.update
  • cloudsql.instances.update
  • compute.addresses.setLabels
  • compute.disks.setLabels
  • compute.forwardingRules.setLabels
  • compute.globalAddresses.setLabels
  • compute.globalForwardingRules.setLabels
  • compute.images.setLabels
  • compute.instances.setLabels
  • compute.snapshots.setLabels
  • compute.targetVpnGateways.setLabels
  • compute.vpnTunnels.setLabels
  • dataproc.clusters.update
  • dataproc.jobs.update
  • cloudkms.cryptoKeys.update
  • storage.buckets.update

Scope such roles to only those projects where you intend to allow Cloudaware‑driven backups or tagging.

To learn how to work with tags in Cloudaware, see Cloudaware Tag Analyzer.

Scoping Recommendations​

  • Prefer service accounts dedicated to Cloudaware rather than reusing existing accounts.
  • Grant broad viewer roles at org/folder level only when you explicitly want Cloudaware to see the full hierarchy; otherwise, keep roles at the project level.
  • Use custom roles to bundle backup and tagging permissions instead of granting wide admin roles.
  • Review service account permissions periodically, especially for custom roles, and remove unused capabilities to keep the privilege footprint small.