Google Cloud Platform discoveries

Prerequisites

  • A Google Cloud Platform service account with the following roles:
    • Security reviewer
    • Reader
  • Cloud Resource Manager API must be enabled on accessible projects

Configure your API access

First, you need to create a Google Cloud Platform service account. You can do that from the Google Cloud Platform console by selecting your project and going to the IAM & Admin section, Service accounts menu, Keys tab. You will then be able to create a new JSON key.

Finally, to store the key into Cyberwatch, you need to access the Stored credentials menu from the lateral bar, then click Add. Select type Google Cloud Platform and fill in the form using your JSON key.

Create the discovery

  1. From Discoveries, click Add. Click Google Cloud Platform in the Cloud infrastructure category.
  2. Enter the name of the scan.
  3. Select optional groups that will be affected to the scan.
  4. Choose the source of the scan (the Cyberwatch machine that will run the operation).
  5. Using the Credentials selector, pick the Google Cloud Platform account registered in previous steps.
  6. Select the discovery mode in order to choose which information will be used to list the discovered assets.
  7. Choose a recurrence. The default value 0 days means the scan will be launched only once.
  8. Optional - Select an agentless mode connection credential.
  9. Click Confirm.

When created, the discovery is immediately started as a background task. You may check state of the task any time from Discoveries.

Scanning multiple projects

Google Cloud Platform discoveries try to scan all the projects accessible by the service account. If it does not have the capability to list them, the discovery will scan only the default project.

To work correctly, the Cloud Resource Manager API must be enabled on all the projects accessible by the service account. This can be done from the Google Cloud Platform console, menu API & Services, submenu Library.

The execution log of the discovery, accessible from its details page, tells if an error occurred while browsing the projects.

Back to top