GCP Token & Project ID

Use this authentication method to connect OX to Google Cloud by using a Google Cloud project ID and a service account key. This is the existing connection method and is suitable for environments where long-lived credentials are permitted.

Prerequisites

• A Google Cloud project with IAM permissions to:

  • Create service accounts

  • Manage service account keys

• Enable required APIs (e.g., Compute Engine API, IAM API, Kubernetes Engine API).

• Optional: gcloud CLI installed and configured.

Step 1: Create a new service account [Google]

1. Log in to the Google Cloud Console.

2. Select your GCP project.

3. Navigate to IAM & Admin.

4. Select Service Accounts.

1. Select + Create Service Account.

1. Add a meaningful name and an optional description.

2. Select Create and Continue.

1. Grant one of the following roles:

Role	Description
Access Approval Viewer	Read-only access to Access Approval settings and approval requests.
Access Context Manager Reader	Read-only access to Access Context Manager resources, including access policies, access levels, and service perimeters (VPC Service Controls).
Discovery Engine Viewer	Read-only access to Vertex AI Search & Conversation (Discovery Engine) resources.
Firebase Rules Viewer	Read-only access to Firebase Security Rules.
Firebase Viewer	Read-only access to all Firebase resources and configuration within a project, including databases, hosting, authentication settings, and functions.
Healthcare Dataset Viewer	Read-only access to Cloud Healthcare API datasets and their metadata.
Security Reviewer	Read-only access to all resources for the purpose of security auditing.
Storage Object Viewer	Read-only access to objects within Cloud Storage buckets.
Viewer	Read-only access to all Google Cloud resources within a project (basic role).

1. Select Done. The new service account appears in the Service accounts table.

1. In the Actions column, select the newly created service account, click the three dot menu related to it, and select Manage keys.

2. In the Keys pane, select Add key > Create new key.

1. Select JSON and then select Create. The file is automatically downloaded to your system.

2. Securely store the JSON key file.

3. To encode the Key File in Base64:

• On macOS/Linux, run: base64 -i <filename>.json

• On Windows, use a tool or plugin to convert the JSON to a one-line Base64 string.

Note: The Base64 encoding ensures multi-line keys are compacted into a single string.

Step 2: Enable Google Cloud APIs [Google]

1. In the Google Cloud Console, navigate to APIs & Services.

2. In the left pane, select Library.

3. Search for and enable the following APIs:

• Compute Engine API (compute.googleapis.com)

• Kubernetes Engine API (container.googleapis.com)

• Cloud Resource Manager API (cloudresourcemanager.googleapis.com)

1. Alternatively, use the gcloud CLI to enable all the required APIs at once:

    gcloud services enable \
  aiplatform.googleapis.com \
  appengine.googleapis.com \
  artifactregistry.googleapis.com \
  bigquery.googleapis.com \
  cloudfunctions.googleapis.com \
  cloudkms.googleapis.com \
  cloudresourcemanager.googleapis.com \
  compute.googleapis.com \
  container.googleapis.com \
  containerregistry.googleapis.com \
  dataproc.googleapis.com \
  datastore.googleapis.com \
  discoveryengine.googleapis.com \
  dns.googleapis.com \
  firebase.googleapis.com \
  firebasedatabase.googleapis.com \
  firebaserules.googleapis.com \
  firestore.googleapis.com \
  healthcare.googleapis.com \
  iam.googleapis.com \
  logging.googleapis.com \
  monitoring.googleapis.com \
  pubsub.googleapis.com \
  redis.googleapis.com \
  run.googleapis.com \
  secretmanager.googleapis.com \
  spanner.googleapis.com \
  sqladmin.googleapis.com \
  storage.googleapis.com

Note: The CLI command enables a broader set of APIs than the minimum required for GKE. The additional APIs (such as BigQuery, Cloud KMS, and Dataproc) support other GCP features that OX Security may scan. If you prefer to enable only the minimum required APIs, use the manual UI steps in step 16c above.

1. To verify the APIs were enabled, run:

gcloud services list --enabled

Step 3: Connect to GCP

1. In the Google Cloud Console, locate the ID of the project in which you have created a service account.

1. In the OX Security platform, go to Connectors and search for GCP.

1. Select GCP and set the following parameters in the Configure your GCP credentials dialog.

Parameter	Description
Project ID	Copy the value from the step 1
API Token	Base64-encoded key

1. Select CONNECT. A success message appears.

Multi-project access

To reuse one service account across multiple GCP projects:

1. Create a new service account.

2. In the source project, copy the email of the service account.

1. For each target project, navigate to IAM & Admin and select Grant Access.

1. In the New principals box, add the copied email address.

2. In the Role box, select the role that you want:

Role	Description
Access Approval Viewer	Read-only access to Access Approval settings and approval requests.
Access Context Manager Reader	Read-only access to Access Context Manager resources, including access policies, access levels, and service perimeters (VPC Service Controls).
Discovery Engine Viewer	Read-only access to Vertex AI Search & Conversation (Discovery Engine) resources.
Firebase Rules Viewer	Read-only access to Firebase Security Rules.
Firebase Viewer	Read-only access to all Firebase resources and configuration within a project, including databases, hosting, authentication settings, and functions.
Healthcare Dataset Viewer	Read-only access to Cloud Healthcare API datasets and their metadata.
Security Reviewer	Read-only access to all resources for the purpose of security auditing.
Storage Object Viewer	Read-only access to objects within Cloud Storage buckets.
Viewer	Read-only access to all Google Cloud resources within a project (basic role).

1. Click Save.

2. In the OX Security platform, go to Connectors and search for GCP.

3. Select GCP and set the following parameters in the Configure your GCP credentials dialog.

Parameter	Description
Project ID	Add *
API Token	Base64-encoded key

1. Select CONNECT. A success message appears.