Google Cloud

This guide outlines the required steps and permissions to onboard a Google Cloud Platform (GCP) environment to AiStrike using a service account and JSON key.◼︎

There are two options to create a connection with the AiStrike product for GCP.

Option 1: Create Service Account using Terraform

This option is used directly by providing details via connector UI and executing a terraform script using the organisation-level GCP user account. This option facilitates the direct input of details through the AiStrike connector UI. The execution of the terraform script is then performed using the GCP organization-level user account.

Prerequisites

GCP team (customer) should have:

1. GCP CLI (gcloud CLI) downloaded and configured. https://cloud.google.com/docs/authentication/gcloud#local

2. Project ID — This project will be used by terraform script to create a service account. (mandatory)

3. Organisation ID — In case whole organisation onboarding is required. (optional, mandatory only if organisation onboarding is required)

4. List of Project IDs — Consolidate the list of the project IDs for which we want data consolidation. (optional, mandatory only if multiple projects are required to be onboarded)

There are three methods in which we can onboard GCP cloud data with terraform:

Method 1: Organization level onboarding

Fill out the connector UI details:

1. Configuration name

2. Service account project ID

3. Organization ID

4. This process generates a terraform script, as detailed in the terraform section. Copy and save this script as "onboarding.tf" in the designated directory.

5. Execute "gcloud auth login" to login into GCP cloud in terminal via gcloud cli.

6. Execute the terraform script via terminal, go to directory where TF is saved and run "terraform init" in terminal.

7. Once done, execute the command "terraform apply".

8. Once successfully done, it will create a <file_name>.json file in the same directory of the TF file.

9. Upload the JSON file via the "File Upload" button.

10. Now click the "save" button.

11. Congratulations, configuration is saved with the "Success" message.

Method 2: Project level onboarding (Single Project)

Fill out the connector UI details:

1. Configuration name

2. Service account project ID

3. Select Scope "Projects"

4. This process generates a terraform script, as detailed in the terraform section. Copy and save this script as "onboarding.tf" in the designated directory.

5. Execute "gcloud auth login" to login into GCP cloud in terminal.

6. Execute the terraform script via terminal, go to directory where TF is saved and run "terraform init" in terminal.

7. Once done, execute the command "terraform apply".

8. Once successfully done, it will create a <file_name>.json file in the same directory of the TF file.

9. Upload the JSON file via the "File Upload" button.

10. Now click the "save" button.

11. Congratulations, configuration is saved with the "Success" message.

Method 3: Project level onboarding (Multiple Projects)

Fill out the connector UI details:

1. Configuration name

2. Service account project ID

3. Select scope "Projects"

4. Upload TXT file containing project IDs separated via new-line.

5. This will create a TF script as mentioned in the Terraform section, copy it and save it in directory as onboarding.tf. This process generates a terraform script, as detailed in the terraform section. Copy and save this script as "onboarding.tf" in the designated directory.

6. Execute "gcloud auth login" to login into GCP cloud in terminal.

7. Execute the terraform script via terminal, go to directory where TF is saved and run "terraform init" in terminal.

8. Once done execute the command "terraform apply".

9. Once successfully done, it will create a <file_name>.json file in the same directory of the TF file.

10. Upload the JSON file via the "File Upload" button.

11. Now click the "save" button.

12. Congratulations, configuration is saved with the "Success" message.

Option 2: Create Service Account Via GCP UI

Prerequisites

GCP team (Customer) should have Admin permission, to create a service account and assign roles:

• For Organization Level:

  • roles/iam.serviceAccountAdmin

  • roles/iam.organizationRoleAdmin

  • roles/iam.securityAdmin

• For Project Level:

  • Project Owner role (roles/owner) on the target GCP project

GCP IDs You'll Need

To find your Organization and Project IDs:

1. Go to the GCP Console: https://console.cloud.google.com/

2. Click the project dropdown at the top of the page.

3. Your Organization ID and Project ID will be listed there.

Step-by-Step: Create Service Account for AiStrike

1. Open the GCP Console: https://console.cloud.google.com/

2. Navigate to "IAM & Admin" > "Service Accounts".

3. Click "Create Service Account".

4. Enter a name like "AIStrike_Service_Account".

5. Click "Create and Continue".

Assign Required Roles to the Service Account

Assign the following roles on the Organization and Project level both:

• Viewer

• Browser

• Security Reviewer

• Cloud Asset Viewer

• Service Usage Viewer

Steps:

1. After creating the service account, you'll be prompted to grant it roles.

2. Add the above roles depending on your deployment scope (Org or Project).

3. If needed, go to "IAM" > "Permissions", find the service account, and click "Edit" to add roles.

Generate and Download JSON Access Key

1. Go to "IAM & Admin" > "Service Accounts".

2. Click on the service account you just created.

3. Navigate to the "Keys" tab.

4. Click "Add Key" > "Create New Key".

5. Select JSON format and click "Create".

6. A JSON key file will be downloaded — this is what you share with AiStrike.

Configure GCP Connector

1. Go to AiStrike Integration page.

2. Click GCP - AiStrike Infra.

3. Enter details: Configuration Name, Service Account Project ID, Organization ID.

4. Upload Service Account Key (Json File).

5. Click Save.

If you have any questions or need assistance configuring the integration, please contact the AiStrike team.