Connect Google Cloud

Before you start

You need the Google Cloud admin rights described below, and in Trusterio the right to manage integrations (owners and admins have it). Anybody else sees the page read-only.

Connect it

1. Open Automation and choose Connect on the Google Cloud card. (The link opens the dialog straight away.)
2. Give it a name under What to call it, and read What to grant: every permission and what it is for.
3. Press Add it and enter the credential. You land on the connection’s own page.

This is for software you run on Google Cloud. For Gmail, Drive and your users, connect Google Workspace instead: it does not need this connection.

1. Press Connect Google Cloud. Cloud Shell opens.
2. Back in Trusterio, type your project ID: the ID, not the name. It is in the project picker at the top of the Google Cloud console, or type gcloud projects list in Cloud Shell.
3. Copy the command Trusterio shows and paste it into Cloud Shell. It shows the script before it runs; press q to let it run.
4. To connect several projects in one go, type their IDs separated by spaces. Each project is its own connection.

Would rather use a key? Use a service account key instead asks for the service account JSON, and optionally the project ID and primary region.

What it creates

• A workload identity pool and provider, so Trusterio signs in without a key.
• A service account trusterio-reader with Security Reviewer, Cloud SQL Viewer and Compute Viewer, and a custom role that may only list buckets and read their settings.
• It switches on the APIs it reads: Resource Manager, IAM, Storage, SQL Admin and Compute.

What it checks

• No primitive roles (Owner, Editor, Viewer) handed out, service account keys not left to age
• Audit logging configured. Data access logging is off by default on a new project, so this one usually fails at first.
• Buckets: no public access, uniform access, customer-managed keys; encryption at rest
• Cloud SQL: SSL required, no public IP; OS Login enforced

After it is connected

• Press Sync now for the first reading. The Tests tab shows each check: what it should be, what was found, and what is affected.
• New connections are read by hand until you choose a schedule: in Monitoring, on the Collection tab, pick Every hour, Every 6 hours, Daily or Weekly.
• The page says when it was last read and its health; Sync History keeps every run.

A connection marked Beta on the Automation screen has not been tried on a real account yet: its permission list is our reading of the provider’s documentation. AWS, Azure, Google Cloud and Jira have been. If a permission is wrong, tell us.

Disconnect

On the connection’s page, choose Disconnect. Reading stops and its credentials are deleted; its history, checks and evidence stay. Then remove what you created at the provider:

• Delete the workload identity pool trusterio-pool and its provider.
• Delete the trusterio-reader service account and the custom bucket role.