Google Cloud setup guide | IntegraTrace Docs

Data source

Google Cloud APIs using a service account JSON key. IntegraTrace calls read-only APIs for inventory and configuration; it does not modify your project.

What we read

Project resources, IAM bindings, and service metadata granted by roles/viewer.

Required permissions

roles/viewer on a service account.

Identity types

User accounts, service accounts, and Google-managed service accounts.

Connect your GCP project

1

Open the Google Cloud Console

✓Go to console.cloud.google.com.
✓Click “Select a project” in the header and choose the project to connect.

2

Create a service account

✓In the left menu, open IAM & Admin → Service Accounts.
✓Click + Create service account and enter a name.
✓Optionally add a description, then click Create and continue.

3

Assign the Viewer role

✓Open the Role dropdown and search for Viewer (or use the Basic category).
✓Select Viewer (roles/viewer), then click Done.

4

Create a JSON key

✓Click the service account you just created, then open the Keys tab.
✓Click Add key → Create new key, choose JSON, and click Create.
✓A JSON file downloads automatically.

Important

Keep this file safe; it provides access to your project and cannot be recovered if lost.

5

Enter credentials in IntegraTrace

In IntegraTrace, open the Add Cloud Environment dialog and provide:

Environment Name: anything you want.
Cloud Provider: GCP.
Service account email: from the service account details page.
JSON key file: upload or drag-and-drop the .json you downloaded.
Click Save Environment.

Optional: agent trails (Cloud Logging)

Only needed if you enable Agent trails for this environment. These steps use the same service account and project: enable the Cloud Logging API, grant roles/logging.viewer, and turn on data access audit logs per service.

6

Enable the Cloud Logging API

✓Open APIs & Services → Library.
✓Search for Cloud Logging API and open the result.
✓Confirm the service name logging.googleapis.com and click Enable.

7

Grant Logs Viewer on the service account

✓Go to IAM & Admin → IAM and edit your IntegraTrace service account.
✓Click Add another role and select Logs Viewer (roles/logging.viewer), then Save.
✓Viewer alone cannot list log entries; Logs Viewer (or a custom role with logging.logEntries.list) is required.

8

Turn on data access audit logs

✓Open IAM & Admin → Audit Logs.
✓For each service you need (e.g. Cloud Storage, BigQuery), enable Data read and/or Data write.
✓Admin Activity logs are on by default; data access logs add who-read-what events and increase log volume and cost; enable only where needed.

If service account key creation is disabled

If you hit an error that service account key creation is disabled, remove the project-level constraint with gcloud:

gcloud org-policies describe \
  constraints/iam.disableServiceAccountKeyCreation \
  --project=YOUR_PROJECT_ID

gcloud org-policies clear \
  constraints/iam.disableServiceAccountKeyCreation \
  --project=YOUR_PROJECT_ID

Read-only

The Viewer and Logs Viewer roles are read-only. IntegraTrace will never make changes to your GCP environment.

Google Cloud audit trails Back to environment setup