Google Cloud Platform

About Google Cloud Platform

Iru connects to your Google Cloud project with a service account and a JSON key. Create the account once, grant the read-only roles you need, then upload the key in Iru. Iru collects configuration and inventory evidence. It does not change resources in your project.

How It Works

Iru authenticates with the service account JSON key you upload in the connector wizard. Grant roles at the project level so Iru can read resources in that project.

Detail	Value
Category	Cloud infrastructure
Authentication	Service account JSON key

What Iru collects

Source	Evidence Iru collects
Google BigQuery	Dataset and table inventory, dataset access, encryption, and expiration settings
Google Cloud IAM	Principals, service accounts, custom roles, and role bindings across the resource hierarchy
Google Cloud Key Management Service	Key rings and keys, including protection level, rotation schedule, and state
Google Cloud Logging	Log sinks, retention settings, and admin activity records (excluding logs with private contents)
Google Cloud Storage	Bucket inventory and settings such as public access prevention, uniform bucket-level access, versioning, retention, encryption, and access logging
Google Compute Engine	VPC networks, subnets, firewall rules, and routes

Read-only roles

Add each role you need. All of these roles are read-only.

Role	Role ID	What it covers
Security Auditor	`roles/iam.securityAuditor`	IAM: resources, folder and project hierarchy, policies, and security configuration
BigQuery Data Viewer	`roles/bigquery.dataViewer`	BigQuery: datasets and their contents
Cloud KMS Viewer	`roles/cloudkms.viewer`	Cloud KMS: get and list on keys and key rings
Compute Network Viewer	`roles/compute.networkViewer`	Compute Engine: read-only networking resources
Logs Viewer	`roles/logging.viewer`	Cloud Logging: view logs except those with private contents
Storage Bucket Viewer	`roles/storage.bucketViewer`	Cloud Storage: buckets and metadata (excluding IAM policies)

Official references: Service accounts, Create service account keys, Organization policies for service accounts.

Prerequisites

Permission in Google Cloud to create service accounts and service account keys in the project you want Iru to monitor (for example Service Account Admin and Service Account Key Admin).
Admin access to the Iru web app.
The Google Cloud project you want Iru to monitor. Grant roles on that project so evidence covers its resources.

Connect Google Cloud Platform to Iru

Create the service account and JSON key in Google Cloud, then upload the key in Iru Compliance.

Google Cloud
Iru Compliance

Complete this tab before you turn on Google Cloud Platform in Iru Compliance.

Create the service account and grant roles

Open the Google Cloud console and select the project Iru should monitor.

Open Service Accounts

In the navigation menu, go to IAM & Admin → Service Accounts.

Google Cloud console navigation showing IAM and Admin with Service Accounts selected

Create the service account

Click Create service account. Enter a Service account name (for example Iru Compliance). Google fills in the service account ID and email. Click Create and continue.

Grant the read-only roles

In the Permissions step, add each role from the Read-only roles table that you need, then click Continue and Done.

Google Cloud Permissions step with Security Auditor, BigQuery Data Viewer, Cloud KMS Viewer, Compute Network Viewer, Logs Viewer, and Storage Bucket Viewer roles

You can grant only the roles you need now. Adding all six means you do not have to return to the console later.

Create and download the JSON key

Open the service account

Go to IAM & Admin → Service Accounts, then open the account you created.

Select the Keys tab

Select the Keys tab.

Click Add key

Click Add key.

Google Cloud service account Keys tab with Add key for Iru Compliance

Create a new key

Click Create new key.

Select JSON and create the key

Select JSON, then click Create. The key file downloads to your computer.

Create private key dialog for Iru Compliance with JSON selected

Store the key securely

Google cannot recover this file if you lose it. Anyone with the file has the service account’s access. Store it in a password manager or secrets vault, and delete your local copy after you connect the source in Iru.

If your organization restricts predefined roles

Some organizations limit which predefined roles an admin can grant. Build a custom role with the same read-only permissions instead:

Go to IAM & Admin → Roles and click Create role.
Add the permissions you need. Use the role IDs in Read-only roles as a reference for what each predefined role includes.
Assign the custom role to the service account instead of the predefined roles.

Optional: create the service account with gcloud

If you prefer the CLI, run this with gcloud while signed in as a user who can create service accounts and keys in the project. Set PROJECT_ID, then run the script.

# Set these two values, then run the script.
PROJECT_ID="your-project-id"
SA_NAME="iru-compliance"
SA_EMAIL="${SA_NAME}@${PROJECT_ID}.iam.gserviceaccount.com"

gcloud config set project "$PROJECT_ID"

# 1. Create the service account
gcloud iam service-accounts create "$SA_NAME" \
  --display-name="Iru Compliance"

# 2. Bind the read-only roles at the project level
for ROLE in \
  roles/iam.securityAuditor \
  roles/bigquery.dataViewer \
  roles/cloudkms.viewer \
  roles/compute.networkViewer \
  roles/logging.viewer \
  roles/storage.bucketViewer
do
  gcloud projects add-iam-policy-binding "$PROJECT_ID" \
    --member="serviceAccount:${SA_EMAIL}" \
    --role="$ROLE"
done

# 3. Create the JSON key in the current directory
gcloud iam service-accounts keys create iru-compliance-key.json \
  --iam-account="$SA_EMAIL"

The script writes iru-compliance-key.json to the directory you run it from. Upload that file in the Iru Compliance tab.

Continue on the Iru Compliance tab.

Troubleshooting

Nothing opens when you turn the source on

Check pop-up blocker settings for the Iru site and try again.

Key creation is blocked by organization policy

If Create returns a policy error, your organization may enforce constraints/iam.disableServiceAccountKeyCreation. An organization policy administrator must add an exception for your project before you can download a key. See Google’s guide to organization policies for service accounts.

Connection fails or evidence is incomplete

Confirm the JSON key belongs to the service account in the correct project, and that the account has the roles listed under Read-only roles for the evidence you need.

Sources Management

Browse and manage every Compliance source.

Getting Started With Compliance

Frameworks, actions, and Artifacts.

Iru Overview

How Endpoint, Compliance, and Identity fit together.

Artifacts Management

Upload, review, and organize evidence from sources and actions.

Getting Started

Actions

Frameworks

Artifacts

Sources

Policies

Trust Center

Workflows

Google Cloud Platform

About Google Cloud Platform

How It Works

What Iru collects

Read-only roles

Prerequisites

Connect Google Cloud Platform to Iru

Create the service account and grant roles

Create and download the JSON key

Troubleshooting

Sources Management

Getting Started With Compliance

Iru Overview

Artifacts Management

​About Google Cloud Platform

​How It Works

​What Iru collects

​Read-only roles

​Prerequisites

​Connect Google Cloud Platform to Iru

​Create the service account and grant roles

​Create and download the JSON key

​Troubleshooting

​Related Articles

Sources Management

Getting Started With Compliance

Iru Overview

Artifacts Management

About Google Cloud Platform

How It Works

What Iru collects

Read-only roles

Prerequisites

Connect Google Cloud Platform to Iru

Create the service account and grant roles

Create and download the JSON key

Troubleshooting

Related Articles