Onboarding Permissions for GCP - Assessment
Introduction
As part of the GCP account preparation required before onboarding cloud accounts into CoreStack, you will need to create least privilege policies— individual policies that must be attached to your cross-account role that allow CoreStack to access the GCP data it needs in order to create its reports.
You can refer to the paths below with template provided based on the type of access you wish to provide for CoreStack after cloning a GitHub repo (https://github.com/corestacklabs/Onboarding_Templates.git):
- FinOps: Onboarding_Templates/GCP/Assesment-module-proj/finops/
- SecOps: Onboarding_Templates/GCP/Assesment-module-proj/secops/
- CloudOps: Onboarding_Templates/GCP/Assesment-module-proj/cloudops/
Each least privilege policy provides the necessary permissions to enable core functions in the CoreStack application, and are listed below organized by product bundle:
FinOps
Capability | Description | Least Privilege Permissions |
---|---|---|
Billing Account | These permissions are required for onboarding a GCP Billing Account. Once onboarded, users can proceed with Linked Project onboarding by segregating as per the needs of the bundles listed here. | storage.buckets.get storage.buckets.list storage.objects.get storage.objects.list compute.regions.get compute.regions.list compute.zones.get compute.zones.list resourcemanager.projects.get |
Cost Visibility and Usage | Allow CoreStack to pull cost data from your GCP cloud account and displaying them as part of cost posturing. | storage.buckets.get storage.buckets.list storage.objects.get storage.objects.list |
Cost Optimization Dashboard | Allow CoreStack to monitoring the utilization of your cloud resources in order to provide cost optimization recommendations through FinOps policies, retrieve native recommendations from GCP, and offer remediation actions. Note: Cost optimization recommendations provided here cannot be remediated unless the necessary write permissions are given. | monitoring.alertPolicies.get monitoring.alertPolicies.list monitoring.metricDescriptors.get monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.get monitoring.publicWidgets.get monitoring.publicWidgets.list monitoring.services.get monitoring.services.list monitoring.slos.get monitoring.slos.list monitoring.snoozes.get monitoring.snoozes.list monitoring.timeSeries.list monitoring.dashboards.get monitoring.dashboards.list recommender.cloudsqlIdleInstanceRecommendations.get recommender.cloudsqlIdleInstanceRecommendations.list recommender.cloudsqlOverprovisionedInstanceRecommendations.get recommender.cloudsqlOverprovisionedInstanceRecommendations.list recommender.cloudsqlUnderProvisionedInstanceRecommendations.get recommender.cloudsqlUnderProvisionedInstanceRecommendations.list recommender.computeAddressIdleResourceRecommendations.get recommender.computeAddressIdleResourceRecommendations.list recommender.computeDiskIdleResourceRecommendations.get recommender.computeDiskIdleResourceRecommendations.list recommender.computeImageIdleResourceRecommendations.get recommender.computeImageIdleResourceRecommendations.list recommender.computeInstanceIdleResourceRecommendations.get recommender.computeInstanceIdleResourceRecommendations.list recommender.computeInstanceMachineTypeRecommendations.get recommender.computeInstanceMachineTypeRecommendations.list recommender.spendBasedCommitmentRecommendations.get recommender.spendBasedCommitmentRecommendations.list recommender.usageCommitmentRecommendations.get recommender.usageCommitmentRecommendations.list |
Resource Inventory | Allow CoreStack to provide pull resource data from GCP in order to provide cost recommendations through FinOps cost policies. Note: Write permissions are also required for CoreStack to perform the following actions: • Associate Volume • Attach Load Balancer • De-provision •DetachLoadBalancer •DisassociateVolume • Extend Volume • Modify Security Group • Manage_Tags • Remove Labels • Resize • Restart • SetLabels • Start • Stop • Update Labels | bigquery.datasets.get bigquery.jobs.get bigquery.jobs.list bigquery.reservations.get bigquery.reservations.list bigtable.tables.get bigtable.tables.list cloudsql.databases.get cloudsql.databases.list cloudsql.instances.get cloudsql.instances.list compute.addresses.get compute.addresses.list compute.commitments.get compute.commitments.list compute.disks.get compute.diskTypes.get compute.diskTypes.list compute.images.list compute.instances.get compute.instances.list compute.regions.get compute.regions.list compute.reservations.get compute.reservations.list compute.zones.get compute.zones.list |
Cost Budget | Allow CoreStack to display cloud-native budgets from the CoreStack portal. | billing.budgets.get billing.budgets.list |
SecOps
Capability | Description | Least Privilege Permissions |
---|---|---|
Governance Configuration > Vulnerability Assessments and Threats | Allow CoreStack to display vulnerabilities and threats from GCP Security Command Center. | securitycenter.containerthreatdetectionsettings.get securitycenter.eventthreatdetectionsettings.calculate securitycenter.eventthreatdetectionsettings.get securitycenter.findings.group securitycenter.findings.list securitycenter.findings.listFindingPropertyNames securitycenter.rapidvulnerabilitydetectionsettings.get securitycenter.securitycentersettings.get securitycenter.securityhealthanalyticssettings.get securitycenter.sources.get securitycenter.sources.list securitycenter.subscription.get securitycenter.virtualmachinethreatdetectionsettings.get securitycenter.websecurityscannersettings.get |
Guardrails/Policies Compliance Standards - GCP CAF | Allow CoreStack to run security policies against your cloud resources in order to get violations and remediate some of the violated resources. Note: CoreStack can pull resources and run them against the CoreStack policy engine, but remediation of impacted resources requires write permissions. | compute.disks.list compute.instances.get compute.instances.list compute.networks.list compute.networks.get compute.projects.get compute.regions.get compute.regions.list compute.subnetworks.list compute.zones.get compute.zones.list container.clusters.get container.clusters.list cloudsql.databases.get cloudsql.databases.list cloudsql.instances.get cloudsql.instances.list |
CloudOps
Capability | Description | Least Privilege Permissions |
---|---|---|
Activity and Alerts - Governance Configuration > Operations > Activity Log | Allow CoreStack to configure activity logs and alerts via read and write permissions. Note: CoreStack can't configure activity logs and alerts with only read permissions. | logging.sinks.get logging.sinks.list logging.views.list pubsub.subscriptions.get pubsub.subscriptions.getIamPolicy pubsub.subscriptions.list pubsub.topics.get pubsub.topics.getIamPolicy pubsub.topics.list pubsub.topics.publish |
Activity and Alerts - Governance Configuration > Operations > Alerts | Allow CoreStack to configure monitoring alerts with a specific template. Note: CoreStack can't configure monitoring templates with read permissions only. | monitoring.alertPolicies.get monitoring.alertPolicies.list monitoring.metricDescriptors.get monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.get monitoring.publicWidgets.get monitoring.publicWidgets.list monitoring.services.get monitoring.services.list monitoring.slos.get monitoring.slos.list monitoring.snoozes.get monitoring.snoozes.list monitoring.timeSeries.list monitoring.alertPolicies.get monitoring.alertPolicies.list monitoring.metricDescriptors.get monitoring.metricDescriptors.list monitoring.monitoredResourceDescriptors.get monitoring.publicWidgets.get monitoring.publicWidgets.list monitoring.services.get monitoring.services.list monitoring.slos.get monitoring.slos.list monitoring.snoozes.get monitoring.snoozes.list monitoring.timeSeries.list monitoring.dashboards.get monitoring.dashboards.list monitoring.alertPolicies.create monitoring.alertPolicies.delete monitoring.alertPolicies.get monitoring.alertPolicies.list monitoring.alertPolicies.update |
Resource Inventory | Allow CoreStack to pull resources from GCP in order to populate the resource inventory in the portal UI. Note: To show your resources in the CoreStack resource inventory, the below actions must be performed: • Associate Volume • Attach Load Balancer • Deprovision • DetachLoadBalancer • DisassociateVolume • Extend Volume • Modify Security Group • Manage_Tags • Remove Labels • Resize • Restart • SetLabels • Start • Stop • Update Labels CoreStack will require a few more governance permissions to accomplish this. | appengine.applications.get appengine.instances.get appengine.instances.list appengine.services.get appengine.services.list appengine.versions.get appengine.versions.list bigquery.datasets.get bigquery.jobs.get bigquery.reservations.get bigquery.reservations.list bigquery.transfers.get bigtable.tables.get bigtable.tables.getIamPolicy bigtable.tables.list cloudfunctions.functions.get cloudfunctions.functions.list cloudiot.registries.get cloudiot.registries.list cloudscheduler.jobs.list cloudsecurityscanner.scans.list cloudsql.databases.get cloudsql.databases.list cloudsql.instances.get cloudsql.instances.list cloudtasks.queues.list composer.environments.list compute.addresses.get compute.addresses.list compute.autoscalers.get compute.autoscalers.list compute.backendBuckets.get compute.backendBuckets.getIamPolicy compute.backendBuckets.list compute.backendServices.get compute.backendServices.getIamPolicy compute.backendServices.list compute.commitments.get compute.commitments.list compute.disks.get compute.disks.getIamPolicy compute.disks.list compute.disks.setLabels compute.diskTypes.get compute.diskTypes.list compute.externalVpnGateways.list compute.firewalls.get compute.firewalls.list compute.images.get compute.images.list compute.images.setLabels compute.instances.get compute.instanceGroups.list compute.instances.get compute.instances.list compute.instances.setLabels compute.instanceTemplates.get compute.interconnects.get compute.networkEndpointGroups.get compute.networks.get compute.networks.list compute.regions.get compute.regions.list compute.routers.list compute.routes.get compute.securityPolicies.get compute.snapshots.get compute.snapshots.setLabels compute.sslPolicies.list compute.targetHttpProxies.get compute.targetPools.get compute.vpnGateways.list compute.zones.get compute.zones.list container.clusters.get container.clusters.list dataflow.jobs.list dns.managedZones.get dns.managedZones.list file.backups.list file.instances.list file.locations.list iam.roles.list iam.serviceAccounts.get logging.sinks.create logging.sinks.delete logging.sinks.get logging.sinks.list logging.sinks.update logging.views.list monitoring.alertPolicies.get monitoring.alertPolicies.list monitoring.notificationChannels.get monitoring.notificationChannels.list pubsub.subscriptions.get pubsub.subscriptions.getIamPolicy pubsub.subscriptions.list pubsub.topics.attachSubscription pubsub.topics.detachSubscription pubsub.topics.get pubsub.topics.getIamPolicy pubsub.topics.list pubsub.topics.publish resourcemanager.folders.get resourcemanager.folders.list resourcemanager.projects.get resourcemanager.projects.list run.services.list spanner.databases.list spanner.instances.list storage.buckets.get storage.buckets.list storage.objects.get storage.objects.list |
Note:
Some permissions listed in this guide are not applicable when creating a project-level custom role. Those permissions can be assigned to a custom role only when creating a custom role at the organization-level.
Choosing to skip the below permissions may result in the following effects:
- billing.budgets.create: CoreStack won't be able to create a cloud-native budget through the main portal, whereas CoreStack budget alerts can still be configured.
- billing.budgets.get/list: CoreStack won't be able to list a cloud-native budget through portal.
- billing.budgets.update: CoreStack won't be able to update cloud-native budgets through the main portal.
- resourcemanager.folders.get/list: CoreStack won't be able to pull the folders listed as part of an organization.
- securitycenter.subscription.get: CoreStack won't be able to identify the Security Command Center subscription details. This is needed for access validation to configure threats.
Updated 7 months ago