Connect GCP account

To allow Prevasio CSPM to access your GCP services programmatically, enable API access for the selected GCP project with the steps below.

If you have Google Cloud (gcloud) CLI intalled, start a new terminal session. Alternatelively, click the Activate Cloud Shell button at the top of the Google Cloud Console to open an interactive cloud shell session.

Run the following command in the terminal window to display the project IDs for your Google Cloud projects (if the Cloud Shell authorization request pops up, click the AUTHORIZE button):

gcloud projects list

Using the applicable project ID from the previous step, set the default project to the one in which you want to enable the API:

gcloud config set project YOUR_PROJECT_ID

Execute the following command to enable the APIs for your project:

curl -s -L https://prevasio-cspm-resources.s3.amazonaws.com/enable-gcp-api/enable-api | bash

Alternatively, use gcloud CLI by executing the contents of the following script:

#!/bin/bash
services=(spanner container bigquery cloudkms pubsub compute logging
          storage dns monitoring dataflow iam cloudresourcemanager
          sqladmin deploymentmanager cloudfunctions)
for service in ${services[@]}; do
    echo "Enable API for $service"
    gcloud services enable $service.googleapis.com
done

Go to IAM & Admin / Service Accounts page, select your project and press CREATE SERVICE ACCOUNT button to create a new service account for Prevasio CSPM.

Enter 'Prevasio CSPM' for the service account name. Press CREATE AND CONTINUE button.

At the next step called 'Grant this service account access to project', select the Project / Viewer role in the 'Select a role' selector. Once the Viewer role is selected, press DONE button.

Once the new service account 'Prevasio CSPM' was created, generate a new key for it by following the steps below:

  • Click the email address of the service account 'Prevasio CSPM'. It should look similar to:
    prevasio-cspm@project-name-123456.iam.gserviceaccount.com
  • At the Service account details page, select KEYS tab and press ADD KEY Create new key button. Select key type as JSON and proceed to download the private key.
  • Proceed to the next step to upload the obtained private key.

If you have an organization, and you would like Prevasio CSPM to also scan it for any misconfigurations, please follow the steps below:

  1. Take a note of the email of the newly added service account for Prevasio CSPM.
    For example, it may look like: prevasio-cspm@project-name-123456.iam.gserviceaccount.com
  2. Go to IAM & Admin / Manage resources and select your organization by ticking the box next to its name.
  3. Press the button ADD PRINCIPAL at the Permissions tab of your organization.
  4. Fill the 'New principals' field with the email address of the service account for Prevasio CSPM, and add 3 roles to it:
    • Organization Viewer
    • Organization Policy Viewer
    • Organization Role Viewer
  5. Press Save to finish adding the service account for prevasio CSPM as a viewer for your organization.

Once the private key for "Prevasio CSPM" is created and downloaded in JSON format, upload it using the form below.
Select the private key in JSON format: