Connect your Google Cloud Project with PingSafe

This article explains how you can connect your Google Cloud Project with PingSafe for detecting security vulnerabilities continuously

Prerequisites to Onboard GCP Project:

• User should have either GCP managed "Owner" role OR below permissions attached to existing user role:
  

  iam.roles.create
  iam.roles.get
  iam.serviceAccountKeys.create
  iam.serviceAccountKeys.enable
  iam.serviceAccountKeys.get
  iam.serviceAccounts.create
  iam.serviceAccounts.get
  iam.serviceAccounts.setIamPolicy
  resourcemanager.projects.getIamPolicy
  resourcemanager.projects.setIamPolicy
  serviceusage.services.list

1. Click on the Settings ⚙️ button in the top right corner.
   
2. From the left navigation panel click on "Cloud Configuration" button.
3. Click on the "Add account" button in the top right corner.
   
4. Click on the “Connect” button present under “Google Cloud Platform”.
5. From the GCP console, make a note of your "ProjectID".
6. Select “Project” from the “Onboard” option, fill in the “Account Name”, “ProjectID” and select the “Scan” Mode.
   
   • Detect Mode: PingSafe has read-only access to the resources in your Google Cloud account. 
   • Detect & Auto remediate: PingSafe have read/write access to the resources. You will have to enable/disable this feature for each plugin that supports auto remediation.
   • Enabling GCP Log Event integration during project/ organization onboarding. If you already have an existing Pub/Sub topic flowing gcp audit logs, you can enter that in the text box and click on "Next". We recommend leaving it empty (In this case PingSafe will create a new topic for you).
     
7. Click on the “Next” button.
8. Download the “Terraform script” and navigate to the Google Cloud Shell.