Skip to main content

Google Cloud Setup Guide

Use this guide to connect Google Cloud Platform (GCP) to Cloudaware by creating a service account, enabling the required APIs, validating the connection, and optionally configuring organization-, folder-, and billing-level discovery.

Before You Begin​

Make sure that:

  • You have access to Admin Console in Cloudaware.
  • You have permission in Google Cloud to create service accounts, generate service account keys, enable APIs, and assign IAM roles.
  • You know which GCP scope Cloudaware should monitor: individual projects, folders, or the entire organization.
  • You know whether you need advanced access for billing, tagging, or backups.
note

If you are new to Cloudaware and don’t have the account yet, use the Get Started guide to add cloud accounts.

High-level Setup Flow​

To integrate Google Cloud Platform with Cloudaware:

  1. Create a new service account for Cloudaware.
  2. Assign the Viewer role at the project level. Optionally, create and assign a custom role for tagging and backups.
  3. Download a service account key (JSON).
  4. Enable required Google APIs.
  5. Grant the service account the required IAM roles for the intended discovery scope.
  6. Upload the service account key file to Cloudaware.
  7. Validate credentials.
  8. Save the configuration.
  9. Assign the service account to the required projects, folders, or organization in Cloudaware.

Create the Google Service Account​

  1. Sign in to the Google Cloud console.
  2. Select the project where the Cloudaware service account will be hosted.
  3. Go to IAM & Admin → Service Accounts. Click + Create Service Account.
  4. Enter a meaningful name, for example, cloudaware-service-account. Click Create and continue.
  5. Assign the Viewer role at the project level:
    • In the Permissions section, click the Select a role field.
    • In the drop-down list, select Project in the left list, then select Viewer in the right list. Click Continue.
  6. Click Done.
tip

If you plan to use organization‑level or folder‑level discovery, or advanced features (billing, backups, tagging), extend this account with additional roles later as described in Least-Privilege Policies.

Create a Service Account Key​

  1. Open the service account you created for Cloudaware.
  2. Go to the Keys tab. Click Add Key → Create new key.
  3. Select JSON and click Create.
  4. Download the JSON key file.
  5. Store the key securely, as you will need it later in Cloudaware.

Enable Required APIs​

For the project where the service account resides, and for other projects as needed:

  1. Go to APIs & Services → Enabled APIs & services.
  2. Click + Enable APIs and services.
  3. Enable the required APIs, including:
    • Compute Engine API
    • Identity and Access Management (IAM) API
    • Cloud Resource Manager API
  4. Enable optional APIs as needed for your environment:
    • Kubernetes Engine API for GKE discovery
    • Cloud Billing API for billing integrations
note

Additional APIs may be required depending on which GCP services Cloudaware is expected to inventory.

Assign IAM Roles​

Decide whether Cloudaware should discover resources only in selected projects or across folders, organizations, and billing accounts.

Project-Level Discovery​

Use this option if you want Cloudaware to collect resources only from selected projects.

In Google Cloud:

  1. Create the service account in a project.
  2. Grant the service account the Project - Viewer role: roles/viewer.
  3. Enable the required APIs in the relevant projects.

In Cloudaware:

  1. Add the service account.
  2. Assign it to the required projects.

Folder- and Organization-Level Discovery​

Use this option if you want Cloudaware to discover folders, organizations, and child projects through inherited access.

In Google Cloud:

  1. Grant viewer-level access at the required hierarchy levels:
    • Organization Viewer
    • Folder Viewer
    • Viewer (for the Google project)
  2. Make sure the service account has access at the parent level where discovery should begin.
  3. Enable the required APIs in the relevant projects.

In Cloudaware:

  1. Add the service account.
  2. Assign it to an organization or folder so child projects can inherit collection automatically.

Billing and Advanced Features​

Use this option if you need billing visibility or support for features such as backups and tagging.

In Google Cloud:

  1. On billing accounts, grant the service account the Billing Viewer role: roles/billing.viewer.
  2. For backups, tagging, or other advanced features, create and assign the custom or additional roles described in Least-Privilege Policies.

In Cloudaware:

  1. Add the service account.
  2. Assign it to the required hierarchy level or projects after the additional permissions are in place.

Add the Service Account in Cloudaware​

In Cloudaware, open the Google Cloud Platform setup form:

  1. In Cloudaware, go to Admin..
  2. Select Google Cloud Platform.
  3. Click + ADD.
    • If GCP is already configured, go to CONFIGURED → Service Accounts and click + ADD GOOGLE SERVICE ACCOUNT.
  4. Enter a name for the Google service account entry.
  5. Click LOAD CREDENTIALS FROM FILE.
  6. Upload the JSON key file created earlier.
  7. Click SAVE.

Assign Service Accounts to Organizations, Folders, and Projects​

Use this step to control where Cloudaware collects GCP resources.

Open the Google Cloud Platform setup form in Cloudaware:

  1. Open the Projects tab.
  2. Use the TABLE or TREE view to review discovered organizations, folders, and projects.
  3. Assign the service account to:
    • An organization or folder to enable inherited collection for child projects, or
    • Specific projects for direct project-level collection
note

New projects created under a parent with an assigned service account inherit collection automatically, provided the required IAM permissions exist in Google Cloud.

Verify the Connection​

After setup, open the Service Accounts and Projects tabs.

  • Confirm that the GCP service account shows a healthy status in Cloudaware.
  • Confirm that organizations, folders, and projects appear as expected.
  • Confirm that GCP resources begin to appear in CMDB.
  • If the connection is healthy but resources are missing, review API enablement, IAM role assignments, and hierarchy assignments.

For detailed steps, see Verification.

Next Steps​