Google Cloud Platform

Caution

Connect your identity provider before you configure Google Cloud Platform (GCP) in Trustle. Trustle needs the identity provider to manage GCP users and groups.

GCP best practices require a service account so Trustle can manage your users and IAM policies through the APIs. Assign minimal, specific permissions to a custom role. This lets Trustle manage all your GCP projects without super administrator access.

Prerequisites

For Trustle:

• The JSON key file for the Trustle service account, downloaded during setup.

For Google Cloud Console:

• Project IAM Admin or Owner permissions, to create roles and service accounts.
• The IAM permissions listed below, to create the custom role.

Configure Google Cloud Platform

Step 1: Create the Custom Role

1. Navigate to IAM & Admin.

   1. Sign in to the Google Cloud Console.

   2. Search for IAM & Admin in the search bar and select the result.

      

   3. Make sure your organization is selected from the dropdown list, not a project or folder.

      

   4. Click the navigation menu (☰) in the top-left corner.

   5. Navigate to IAM & Admin > Roles.

2. Create a new role.
   1. Click + CREATE ROLE at the top of the page.
   2. In the Create Role form, fill in the following:
      1. Title: enter a descriptive name, for example SaaS Integration Viewer.
      2. Description: add a description, for example Custom role for SaaS integration with read-only IAM permissions.
      3. ID: this auto-generates from your title, or you can customize it.
      4. Role launch stage: select General Availability.
3. Add the required permissions.
   1. Click ADD PERMISSIONS.
   2. In the filter box, search for and add each of the following permissions:
      • resourcemanager.projects.get
      • resourcemanager.projects.list
      • resourcemanager.projects.getIamPolicy
      • resourcemanager.projects.setIamPolicy
      • resourcemanager.organizations.get
      • resourcemanager.organizations.getIamPolicy
      • resourcemanager.organizations.setIamPolicy
      • resourcemanager.folders.list
      • resourcemanager.folders.get
      • resourcemanager.folders.getIamPolicy
      • resourcemanager.folders.setIamPolicy
      • iam.serviceAccounts.list
      • iam.roles.list
      • iam.roles.get
      • iam.serviceAccountKeys.list
      • logging.logEntries.list
      • logging.privateLogEntries.list
      • logging.logs.list
   3. Verify that all permissions appear in the Assigned permissions section.
   4. Click CREATE at the bottom of the page.
   5. Note the role name or ID. You need it in a later step.

Step 2: Create the Service Account

Caution

Best practice is to create a dedicated project for this service account, for security and isolation. You can also use an existing project, but it must have the IAM API and the Cloud Resource Manager API enabled.

1. Navigate to service accounts.
   1. From the navigation menu (☰), go to IAM & Admin > Service accounts.
2. Create a new service account.
   1. Click + CREATE SERVICE ACCOUNT at the top of the page.
3. Configure the service account details.
   1. Service account name: enter a descriptive name, for example saas-integration-account.
   2. Service account ID: this auto-generates from the name, or you can customize it.
   3. Service account description: add a description, for example Service account for SaaS platform integration.
   4. Click CREATE AND CONTINUE.
4. Skip the optional steps for now.
   1. Grant this service account access to project: skip this step. You assign the role in the next section.
   2. Click CONTINUE.
   3. Grant users access to this service account: this step is optional. Skip it.
   4. Click DONE.

Step 3: Assign the Role to the Service Account and Generate the Key

Assign the custom role

1. Navigate to IAM.
   1. From the navigation menu (☰), go to IAM & Admin > IAM.
2. Add a role binding.
   1. Click GRANT ACCESS at the top of the page.
3. Configure access.
   1. In the Add principals field, enter the service account email. It has the format service-account-name@project-id.iam.gserviceaccount.com. Find this email under IAM & Admin > Service accounts if you need to copy it.
   2. In the Assign roles section, click the Select a role dropdown.
   3. In the filter box, type the name of the custom role you created earlier.
   4. Select your custom role from the filtered results.
   5. Click SAVE.

Generate and download the JSON key file

1. Navigate back to service accounts.

   1. From the navigation menu (☰), go to IAM & Admin > Service accounts.

2. Open the service account.

   1. Find your new service account in the list.
   2. Click the service account email to open its details page.

3. Create a new key.

   1. Click the KEYS tab at the top of the service account details page.
   2. Click the ADD KEY dropdown.
   3. Select Create new key.

4. Generate the JSON key.

   1. Select JSON as the key type. This is the default.
   2. Click CREATE.

5. Save the key file. It downloads automatically.

   Caution

   Save this file securely — it contains sensitive credentials. The file name looks like project-id-xxxxx.json. You cannot download this key again, so store it safely.

Connect in Trustle

1. Navigate to the Connections page. Find Google Cloud under Cloud Providers. Click + Connect.

2. On the Google Cloud Connect page, enter a Name and Description for the new connection. For Service Account Key File, paste the JSON content or upload the JSON file.

   Example JSON:

   {
     "type": "service_account",
     "project_id": "trustle-example",
     "private_key_id": "907fbc88218d334a84772f79aaee72630fd8b0bc",
     "private_key": "-----BEGIN PRIVATE KEY-----\nMIIiZMn5X3+S8iYKeMaWz4ZPJYXH1\nS2FF0M6dQyKdlwwYw0bUrw==\n-----END PRIVATE KEY-----\n",
     "client_email": "sa-trustle-connector@<project-id>.iam.gserviceaccount.com",
     "client_id": "112160954452881678260",
     "auth_uri": "https://accounts.google.com/o/oauth2/auth",
     "token_uri": "https://oauth2.googleapis.com/token",
     "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
     "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/sa-trustle-connector-customer%40trustle-example.iam.gserviceaccount.com",
     "universe_domain": "googleapis.com"
   }

   

3. Click Test Connection. If the connection is valid, the Save Connection button becomes available. Click Save to finish.

   

Security notes

Note

• Store the JSON key file in a secure location.
• Never commit the JSON key file to version control.
• Upload the JSON key file to Trustle on the connections page.
• Consider setting up a key rotation policy for the service account.