> For the complete documentation index, see [llms.txt](https://docs.ox.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ox.security/ox-integrations/3rd-party-integrations/cloud-security/gcp-and-gke-1.md).
# GCP
The OX GCP connector connects OX Security to your Google Cloud environment and provides cloud-level visibility, asset context, and Kubernetes deployment enrichment across the platform.
The connector enables OX to collect metadata from your Google Cloud environment and correlate it with applications, workloads, container images, and security findings.
The GCP connector is also required when [connecting Google Kubernetes Engine (GKE)](/ox-integrations/3rd-party-integrations/cloud-security/gcp-and-gke-1/gcp-and-gke.md) clusters to OX.
## What the GCP connector provides
| Capability | Description |
|---|
| Cloud asset visibility | Identifies assets deployed in your Google Cloud environment |
| Kubernetes enrichment | Adds deployment and runtime context for GKE workloads |
| Internet exposure context | Detects whether workloads are publicly reachable |
| Cloud BOM generation | Builds a cloud-based bill of materials (Cloud BOM) |
| Runtime-aware prioritization | Enriches issues with severity context based on live deployment status |
| Attack path visibility | Extends Attack Path analysis with cloud reachability information |
## Kubernetes connection models
OX supports two Kubernetes connection models:
| Connection model | Description |
| --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Direct cloud integration | OX connects directly to GKE through Google Cloud APIs.
Use direct integration when the cluster is externally reachable.
|
| Inspector-based integration | The Inspector runs inside the environment and sends Kubernetes data to OX.
Use the Inspector when clusters are private, restricted, or not externally accessible.
|
## Enriched visibility across OX
After the connector is configured, cloud deployment context is reflected across multiple areas in OX.
| Area | Enrichment |
| ------------------ | ---------------------------------------------------------------------------------- |
| Applications | Displays Kubernetes deployment details, Application Flow data, and deployment Tags |
| Active Issues | Adds Kubernetes reachability and runtime severity factors |
| Attack Path | Displays cloud and Kubernetes reachability paths |
| Artifact BOM | Shows where artifacts are deployed across cloud environments and clusters |
| Artifact integrity | Detects images running from untrusted or unknown sources |
## Runtime-aware scanning
OX scans the specific container image versions that are actively running in your cloud environment, not only the latest versions available in the registry.
This improves prioritization accuracy and reduces unnecessary scanning noise.
## Supported environments
The GCP connector supports:
* Google Cloud Platform (GCP)
* Google Kubernetes Engine (GKE)
* Inspector-based Kubernetes deployments running in Google Cloud
## Connecting GCP to OX
OX supports two authentication methods for connecting Google Cloud Platform (GCP). Both methods provide the same cloud visibility, asset context, and Kubernetes enrichment, and require the same read-only IAM roles and Google Cloud APIs. The difference is only in how OX authenticates to Google Cloud.
| Authentication method | Description | Recommended when |
| ---------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------- |
| [Token & Project ID](/ox-integrations/3rd-party-integrations/cloud-security/gcp-and-gke-1/gcp-token-and-project-id.md) | Authenticates OX by using a Google Cloud project ID and a long-lived service account key. | Your organization allows long-lived credentials or you want to use the existing authentication method. |
| [Workload Identity Federation](/ox-integrations/3rd-party-integrations/cloud-security/gcp-and-gke-1/gcp-workload-identity-federation.md) | Authenticates OX by using short-lived credentials without creating, downloading, or storing a service account key. | Your organization requires a keyless authentication model or does not allow long-lived service account keys. Recommended for new connections. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.ox.security/ox-integrations/3rd-party-integrations/cloud-security/gcp-and-gke-1.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.