Introduction

As part of the GCP account preparation required before onboarding cloud accounts into the platform, you will need to create least privilege policies— individual policies that must be attached to your cross-account role that allow the platform to access the GCP data it needs in order to create its reports.

📘

Pre-configured automation templates for allowing access

You can refer to the paths below to access templates provided based on the type of access you wish to provide for the platform after cloning a GitHub repo (https://github.com/corestacklabs/Onboarding_Templates.git):

• FinOps: GCP/Assesment+gov-module-proj/finops/
• SecOps: GCP/Assesment+gov-module-proj/secops/
• CloudOps: GCP/Assesment+gov-module-proj/cloudops/

Least Privilege Polices by Product (Read-Write)

Each least privilege policy provides the necessary permissions to enable core functions in the platform. The policies for enabling Read-Write access to the platform are listed below organized by product and platform capability:

❗️

Note:

Some permissions listed in this guide are not applicable when creating a project-level custom role. Those permissions can be assigned to a custom role only when creating a custom role at the organization-level.

Choosing to skip the below permissions may result in the following effects:

• billing.budgets.create: The platform won't be able to create a cloud-native budget through the main portal, whereas platform-native budget alerts can still be configured.
• billing.budgets.get/list: The platform won't be able to list a cloud-native budget through portal.
• billing.budgets.update: The platform won't be able to update cloud-native budgets through the main portal.
• resourcemanager.folders.get/list: The platform won't be able to pull the folders listed as part of an organization.
• securitycenter.subscription.get: The platform won't be able to identify the Security Command Center subscription details. This is needed for access validation to configure threats.

FinOps

SecOps

CloudOps