Google Cloud Platform

Configuring the integration for Google Cloud Platform (GCP)

Cortex connects to many third-party vendors whose system interfaces frequently change. As a result, integration behavior or configuration steps may shift without notice. If you encounter unexpected issues, check with your system administrator or refer to the vendor's documentation for the most current information. Additionally, integration sync times vary and are subject to scheduling overrides and timing variance.

Why use the integration for Google Cloud Platform

Google Cloud Platform (GCP) is Google's suite of cloud computing services, including compute, storage, data, and AI/ML products. Integrating Cortex with GCP gives you automatic visibility into your cloud infrastructure and how it connects to the rest of your catalog.

This integration works alongside Cortex's broader Google integration, which also connects to Google Workspace to sync ownership from Google Groups. Together, they help Cortex build a live picture of your cloud footprint and who owns it.

With the GCP integration, Cortex can:

• Automatically discover GCP entities, like Cloud Run services, BigQuery datasets, and Kubernetes Engine clusters, and add them to your catalog.

• Link those entities to the services that depend on them, using tags Cortex matches automatically or dependencies you define explicitly.

• Pull in Service Level Objectives (SLOs) from Google Cloud Observability and surface them on entity pages.

• Power Scorecards and CQL queries that check GCP configuration, SLO health, and ownership across your catalog.

Cortex connects to GCP through a service account with read-only permissions scoped to the entity types you want to sync. Cortex only reads from GCP; it doesn't make changes to your cloud resources.

For information on configuring Google SSO for logging in to Cortex, see the Google SSO documentation.

Supported Google Cloud entity types

Cortex supports importing the following entity types from Google Cloud:

Supported Google Cloud entity types

• Google Cloud Vertex AI Batch Prediction Job

• Google Cloud Vertex AI Dataset

• Google Cloud Vertex AI Endpoint

• Google Cloud Vertex AI Featurestore

• Google Cloud Vertex AI Index

• Google Cloud Vertex AI Model

• Google Cloud Vertex AI Model Deployment Monitoring Job

• Google Cloud Vertex AI Notebooks Instance

• Google Cloud Vertex AI Pipeline Job

• Google Cloud Vertex AI Platform Index Endpoint

• Google Cloud Vertex AI Specialist Pool

• Google Cloud Vertex AI Study

• Google Cloud Vertex AI Tensorboard

• Google Cloud Vertex AI Training Pipeline

• Google Cloud Vertex AI Vision Application

• Google Cloud Vertex AI Vision Cluster

• Google Cloud Vertex AI Vision Index Point

• Google Cloud Vertex AI Vision Operator

• Google Cloud Vertex AI Vision Processor

• Google Cloud Apigee Api

• Google Cloud Apigee Instance

• Google Cloud App Engine Service

• Google Cloud Artifact Registry Repository

• Google Cloud BigQuery Connection

• Google Cloud BigQuery

• Google Cloud Composer Environment

• Google Cloud Functions

• Google Cloud Kubernetes Engine Clusters

• Google Cloud Kubernetes Engine Operations

• Google Cloud IAM Service Account

• Google Cloud Instance Group

• Google Cloud HTTP(S) Load Balancing

• Google Cloud Memorystore Memcached

• Google Cloud Memorystore Redis

• Google Cloud Project

• Google Cloud Run Job

• Google Cloud Run Service

• Google Cloud Spanner Instance

• Google Cloud Spanner Instance Config

• Google Cloud SQL

• Google Cloud Storage

• Google Cloud Pub/Sub Topics

• Google Cloud VM Instances

• Google Cloud VPC Serverless Connector

Configuring Google Cloud Platform

Prerequisites

1. Users with the Configure Integrations permission can configure GCP.

2. A Google service account and its client ID.

   • In the Advanced settings, enable Domain-wide Delegation.

   • Under Domain-wide Delegation, copy the client ID and store it in a secure location. Do not skip this step! You'll need the client ID to complete setup.

   • The service account must include permissions for each project to enable Google Cloud resources. See Google service account permissions below.

3. The Google Admin SDK API is configured and enabled.

4. Google Cloud resource project permissions are enabled for each project. See Google Cloud resource project permissions below.

Google service account permissions

Expand to view the list of Google service account permissions

• AI Platform → AI Platform Viewer, Dataform Viewer, Cloud Storage for Firebase Viewer, Data Catalog Viewer, Vision AI Viewer, Notebooks Viewer, Dataflow Viewer

• Apigee → Cloud Api Hub Viewer

• App Engine → App Engine Viewer

• Artifact Registry → Artifact Registry Reader

• BigQuery → BigQuery Metadata Viewer

• BigQuery Connection → BigQuery Connection User

• Cloud Asset → Cloud Asset Viewer

• Cloud Asset → ListResource

  • Note: This permission is necessary to run services and jobs.

• Cloud Functions → Cloud Functions Viewer

• Cloud Pub/Sub → Pub/Sub Viewer

• Cloud Resource Manager → Browser

• Cloud Run → Cloud Run Viewer

• Cloud SQL → Cloud SQL Viewer

• Cloud Storage → Storage Admin

• Composer → Composer User

• Compute Engine, VM Instances → Compute Viewer

• Kubernetes Engine → Kubernetes Engine Viewer

• Memorystore Memcached → Cloud Memorystore Memcached Viewer

• Memorystore Redis → Cloud Memorystore Redis Viewer

• Monitoring → Monitoring Viewer

• Service Accounts → View Service Accounts

• Spanner → Cloud Spanner Viewer

• VM Instances Vulnerabilities → OS VulnerabilityReport Viewer

• VPC Serverless Connector → Serverless VPC Access Viewer

To create a custom role with only the minimum required permissions, add the following:

Expand to view the list of custom role minimum permissions

aiplatform.datasets.get
aiplatform.datasets.list

aiplatform.endpoints.get
aiplatform.endpoints.list

aiplatform.featurestores.get
aiplatform.featurestores.list

aiplatform.indexEndpoints.get
aiplatform.indexEndpoints.list

aiplatform.batchPredictionJobs.get
aiplatform.batchPredictionJobs.list

aiplatform.modelDeploymentMonitoringJobs.get
aiplatform.modelDeploymentMonitoringJobs.list

aiplatform.trainingPipelines.get
aiplatform.trainingPipelines.list

aiplatform.pipelineJobs.get
aiplatform.pipelineJobs.list

aiplatform.specialistPools.get
aiplatform.specialistPools.list

aiplatform.tensorboardExperiments.get
aiplatform.tensorboardExperiments.list

aiplatform.studies.get
aiplatform.studies.list

aiplatform.apps.get
aiplatform.apps.list

aiplatform.indexes.get
aiplatform.indexes.list

aiplatform.models.get
aiplatform.models.list

aiplatform.tensorboards.get
aiplatform.tensorboards.list

iam.serviceAccounts.get

apihub.apiHubInstances.get

apihub.apis.get
apihub.apis.list

appengine.services.get
appengine.services.list

artifactregistry.repositories.get
artifactregistry.repositories.list

bigquery.connections.get
bigquery.connections.list

bigquery.datasets.get
bigquery.routines.get
bigquery.routines.list

cloudasset.assets.listResource

cloudfunctions.functions.get
cloudfunctions.functions.list

cloudsql.instances.get
cloudsql.instances.list

composer.environments.get
composer.environments.list

compute.urlMaps.list
compute.urlMaps.get
compute.instances.list
compute.instances.get
compute.instanceGroups.list
compute.instanceGroups.get

container.clusters.get
container.clusters.list

container.operations.get
container.operations.list

iam.serviceAccounts.get
iam.serviceAccounts.list

memcache.instances.list
memcache.instances.get

monitoring.services.get
monitoring.services.list
monitoring.slos.get
monitoring.slos.list
monitoring.timeSeries.list

notebooks.instances.get
notebooks.instances.list

osconfig.vulnerabilityReports.get

pubsub.topics.get
pubsub.topics.list

redis.instances.list
redis.instances.get

resourcemanager.projects.get
resourcemanager.projects.list

run.jobs.list
run.jobs.get

run.services.list
run.services.get

spanner.instances.get
spanner.instances.list

spanner.instanceConfigs.get
spanner.instanceConfigs.list

storage.buckets.get
storage.buckets.list

visionai.applications.get
visionai.applications.list

visionai.processors.get
visionai.processors.list

visionai.operators.get
visionai.operators.list

visionai.clusters.get
visionai.clusters.list

vpcaccess.connectors.get
vpcaccess.connectors.list

Google Cloud resource project permissions

Expand to view the list of Google Cloud resources project permissions

• App Engine Admin API

• ArtifactRegistry API

• Apigee APIs

• BigQuery API

• BigQuery Connection API

• Cloud Asset API

• Cloud Composer API

• Cloud Functions

• Cloud SQL Admin

• Cloud Storage

• Compute Engine API

• Kubernetes Engine API

• Memorystore for Memcached API

• Memorystore for Redis API

• OS Config API

• Kubernetes Engine API

• Resource Manager API

• Spanner API

• Serverless VPC Access API

For each project in Vertex AI, enable the following:

Expand to view the list of permissions needed for Vertex AI projects

• Cloud Storage API

• DataCatalog API

• Dataflow AI API

• DataForm API

• Notebooks AI API

• Vertex AI API

• Vision AI API

Step 1: Configuring the integration in GCP

1. In the G Suite admin console, navigate to Security > API Controls > Manage Domain Wide Delegation. Click Add new.

2. Click Add new.

3. Add the client ID and include the following scopes:

   • https://www.googleapis.com/auth/admin.directory.group.readonly

   • https://www.googleapis.com/auth/admin.directory.group.member.readonly

4. Go to the service account you created for this integration.

5. Click Keys, then generate a key in JSON format.

6. Navigate to Admin Roles > Groups Reader and expand the Admins panel.

7. Click Assign service accounts then enter the email of the service account you created for this integration.

Step 2: Configuring the integration in Cortex

1. From the main sidebar, select Integrations.

2. Locate Google, then click Install. The Google side panel opens.

3. In the Google side panel, do the following:

   1. From the Category dropdown, select at least one category that applies to the integration (required).

   2. Under Domain, enter your organization's Google domain (required).

   3. Under Service account user (email), enter the email address for the service account (required).

   4. Under Credentials, paste the service account JSON exactly as it is (required).

4. Click Test connection. A successful connection means your integration is configured correctly.

5. Click Save.

By default, a service depends on any resource whose Google Cloud tag has key "service" and value matching the service's Cortex tag. After saving the configuration, you can customize the key name or leave it blank to use "service".

Customizing the key name

Follow the steps below to customize the key name.

1. From the main sidebar, select Integrations.

2. Locate Google, then click Settings.

3. In the Details section, enter the key name under Custom label key.

4. Click Save custom label key.

To modify an existing configuration, see Modifying an integration configuration.