Google Cloud Platform (GCP)

Overview
How to connect
Automated checks
Useful links

DSALTA connects to Google Cloud Platform (GCP) using read-only API access to collect compliance evidence automatically. Data feeds into your Data Library modules. Compliance checks re-run once a day at 02:00 America/New_York.

Read-only access. DSALTA never modifies, creates, or deletes resources in your Google Cloud Platform (GCP) environment.

What DSALTA reads

DSALTA reads every principal bound in your project’s IAM policy — users, service accounts, Google groups and domains — together with the IAM roles granted to each, which appears on your Access page; and your Google Cloud Platform (GCP) resources, which appear on your Inventory page; and open security findings, which appear on your Vulnerabilities page.DSALTA does not call GCP REST endpoints directly, so there are no URL paths to list here. It uses the official Google APIs Node.js client (the googleapis package), The IAM permissions below are the ones DSALTA calls. They are not a ceiling on the credential: the roles granted during setup are broader than this list, and the client authenticates with the cloud-platform scope. DSALTA still only reads.Permissions the checks require: 29 read-only IAM permissions.

Show all 29 IAM permissions

BigQuery — bigquery.datasets.getBigtable — bigtableadmin.instances.getCloud KMS — cloudkms.cryptoKeys.get, cloudkms.cryptoKeys.getIamPolicyCompute Engine — compute.backendServices.list, compute.instances.list, compute.regionOperations.get, compute.subnetworks.get, compute.urlMaps.listGKE — container.projects.zones.clusters.getEssential Contacts — essentialcontacts.contacts.listIAM — iam.serviceAccountKeys.list, iam.serviceAccounts.get, iam.serviceAccounts.getIamPolicy, iam.serviceAccounts.list.Cloud Logging — logging.sinks.listCloud Monitoring — monitoring.alertPolicies.list, monitoring.timeSeries.listResource Manager — resourcemanager.projects.get, resourcemanager.projects.getIamPolicySecurity Command Center — securitycenter.findings.list, securitycenter.organizations.getOrganizationSettingsSpanner — spanner.instances.getCloud SQL — sqladmin.instances.get, sqladmin.instances.listCloud Storage — storage.buckets.get, storage.buckets.getIamPolicy

Every request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your Google Cloud Platform (GCP) environment.

Troubleshooting

Integration shows Disconnected

There is no Reconnect button. Open Integrations → Connected, click Manage on the Google Cloud Platform (GCP) card, and check the Status tab — it shows either Connected and working properly or Connection issues detected. To restore a broken connection you must Disconnect and connect again, which permanently deletes the data and tests collected from Google Cloud Platform (GCP). Service account keys do not expire by default, so this usually means the key was deleted, the service account was removed or disabled, its roles were revoked, or an organization policy set a key validity period that has elapsed.

Data is not syncing

Verify the connected account still holds the permissions listed under Before you begin. Then open Integrations in the DSALTA sidebar, stay on the Connected tab, and click Sync from integrations at the top right. That button refreshes every connected integration at once — there is no per-integration sync control.

Create a service account in GCP Console with the five roles listed in step 2 — Security Reviewer, Compute Viewer, Monitoring Editor, Storage Admin and Logging Viewer — then upload the JSON key.Before you begin

GCP account with admin access
Service account created with all five roles listed in step 2 — Security Reviewer, Compute Viewer, Monitoring Editor, Storage Admin and Logging Viewer
Required Google Cloud APIs enabled on the project (Cloud Resource Manager API at minimum)
Check whether your organization blocks service-account key creation. Many organizations enforce the constraints/iam.disableServiceAccountKeyCreation org policy, which makes the Add key > Create new key button fail. If that constraint is on, this JSON-key setup cannot be completed as written — contact DSALTA before you start.

You will need:

Field	Where to find it	Example
Project ID	See the steps below	`my-gcp-project`
Project Number	See the steps below	`123456789012`
Service account JSON key	Upload the JSON key from IAM & Admin > Service Accounts > Keys.	—

Start in DSALTA

Open Integrations in the DSALTA sidebar, find Google Cloud Platform, and click Connect to open the connect panel. Leave it open — it lists every value you need, and you create those in the steps below.

Create a Service Account in GCP

Log in to GCP Console and go to IAM & Admin > Service Accounts. Create a service account named dsalta-service-account, then grant these roles:

Security Reviewer
Compute Viewer
Monitoring Editor
Storage Admin
Logging Viewer

Storage Admin and Monitoring Editor grant write access — Storage Admin permits deleting buckets and objects. DSALTA only reads. If your security team objects, the read-only equivalents cover every call DSALTA makes: Monitoring Viewer instead of Monitoring Editor, and Storage Object Viewer instead of Storage Admin (Security Reviewer already supplies storage.buckets.getIamPolicy). If a check later returns “missing permission”, DSALTA names the exact viewer role to grant.

Enable the required Google Cloud APIs

In the Google Cloud Console, open APIs & Services > Library. Search for each API below and click Enable. Cloud Resource Manager API is required — without it the connection fails.

Cloud Resource Manager API
Compute Engine API
Identity and Access Management (IAM) API
Cloud Monitoring API
Cloud Logging API
Cloud Storage API
Cloud SQL Admin API
Kubernetes Engine API
Cloud Key Management Service (KMS) API
BigQuery API
Security Command Center API

DSALTA also calls the Cloud Firestore API, Cloud Bigtable Admin API, Cloud Spanner API and Essential Contacts API. Enable each of those you use as well — while one is off, the Firestore, Bigtable, Spanner and Essential Contacts checks on the Automated checks tab record a pass without evaluating your configuration. Newly enabled Google Cloud APIs take about a minute to take effect.

Create and download JSON key

Open the service account and go to Keys. Click Add Key > Create new key > JSON, then download the key file.

The key you download does not expire on its own, so nothing will warn you before it stops working. Deleting the key, deleting the service account, or an organization policy that sets a key validity period will each break the connection silently — the integration simply starts reporting connection issues.

Upload key and enter project details

Upload the JSON key in DSALTA and enter projectId and projectNumber. Click Connect.Project ID and Project number are different values and both are required. Find them together on the Google Cloud console Dashboard, in the “Project info” card: Project ID is the string (e.g. my-gcp-project), Project number is the 12-digit number (e.g. 123456789012). The Project ID is also visible in the console URL as ?project=.

DSALTA validates the credential when you click Connect. On success the integration moves to the Connected tab, and Manage → Status reads Connected and working properly. Checks begin reporting after the first sync.

If the connection is rejected. Failed to connect. Verify the key, projectId and projectNumber.The on-screen message is generic — see Connection error messages.

Each check below re-runs once a day, at 02:00 America/New_York, while this integration is connected. Click any check for step-by-step remediation guidance.

Check	Severity	What it verifies
GCP user should have MFA enabled	Critical	Checks that all users have MFA enabled.
GCP service account should not have admin privilege access	High	Service accounts must not have Owner or broad admin roles.
GCP service account user role/ token creator role should not be assigned at project level	Medium	Avoid granting Service Account User or Token Creator at project level.
GCP Service account keys should only be GCP-Managed	Medium	Prefer GCP-managed keys over user-managed keys.
GCP Service account User-Managed/External keys are rotated every 90 days or fewer	Medium	User-managed keys should be rotated within 90 days.
GCP should be on https	High	Ensures HTTPS is used for console and APIs.
GCP should redirect http to https	High	Load balancers and app should redirect HTTP to HTTPS.
Google Security Center should be enabled	High	Security Command Center (SCC) should be enabled.
Reported incident should be closed in security center	Medium	Open findings in Security Center should be resolved.
Google Security Center vulnerability alert should be resolved within SLA	Medium	Vulnerability findings should be resolved within defined SLA.
GCP bucket storage should be encrypted	High	Cloud Storage buckets should use encryption (default or CMEK).
GCP Cloud Storage should be uniform bucket level access enabled	Medium	Uniform bucket-level access should be enabled.
GCP Cloud storage bucket should be protected from direct internet traffic	High	Buckets should not be publicly accessible.
GCP VPC Subnet flow logs should be captured	Medium	VPC flow logs should be enabled for subnets.
GCP Kubernetes clusters have logging and cloud monitoring enabled	High	GKE clusters should have Cloud Logging and Monitoring enabled.
GKE Kubernetes Web UI (Dashboard) is disabled	Medium	Kubernetes Dashboard should be disabled or not exposed.
GKE Metadata Server is enabled	Medium	Workload Identity / metadata server should be configured.
GCP Firestore read frequency should be monitored	Low	Firestore read metrics should be monitored.
GCP Firestore write frequency should be monitored	Low	Firestore write metrics should be monitored.
GCP Compute instance CPU utilization should be monitored	Medium	VM instances should have CPU utilization monitored.
GCP Compute instance should be protected from direct internet traffic	High	VMs should not have public IPs or should be behind a firewall.
GCP Cloud SQL CPU utilization should be monitored	Medium	Cloud SQL instances should have CPU monitoring.
GCP Cloud SQL should be encrypted	High	Cloud SQL should use encryption at rest.
GCP Cloud SQL memory utilization should be monitored	Medium	Cloud SQL memory should be monitored.
GCP Cloud SQL backup should be enabled	High	Automated backups should be enabled.
GCP Cloud SQL should be protected from direct internet traffic	High	Cloud SQL should not have public IP or should be restricted.
GCP Cloud SQL connections requires to use SSL	High	SSL should be required for client connections.
GCP Cloud Spanner should be encrypted	High	Spanner instances should use encryption.
GCP Bigtable should be encrypted	High	Bigtable instances should be encrypted.
GCP Bigtable CPU utilization should be monitored	Low	Bigtable CPU should be monitored.
GCP Bigtable storage utilization should be monitored	Low	Bigtable storage should be monitored.
GCP Biqquery dataset should be protected from direct internet traffic	High	BigQuery datasets should not be publicly accessible.
GCP BigQuery storage should be encrypted	High	BigQuery data should be encrypted.
GCP KMS encryption keys should be protected from direct internet traffic	High	KMS keys should not be publicly accessible.
GCP KMS encryption keys should be rotated within 90 days	Medium	CMEK key rotation should be enabled (90 days).
GCP essential contacts should be setup	Medium	Essential Contacts should be configured for the organization/folder.
GCP Sink should be configured for all log entries	Medium	Log sinks should be configured for critical log routing.
Infra entity should be classified	Low	Resources should be classified/labeled for ownership and sensitivity.
Reported incident should be closed in DSALTA	Low	Reported incidents should be resolved and closed in DSALTA.
User should be identified	Medium	Users should be identifiable (e.g. no anonymous access).
User access to critical system should be valid	Info	Checks that everyone with GCP project IAM access is an active employee on the People page.
Offboarded users should not have active access	High	Checks that offboarded employees no longer have active GCP access.

Topic	Link
Setup	Create and manage service account keys
Setup	Google Cloud IAM roles reference
Setup	Enabling Google Cloud APIs
General	Google Cloud Platform website
DSALTA	Connection error messages

Getting Connected

Identity Providers

Cloud Infrastructure

Code Repositories

Security & Monitoring

Databases

SaaS & Productivity

What DSALTA reads

Troubleshooting

​What DSALTA reads

​Troubleshooting

What DSALTA reads

Troubleshooting