Introduction

As part of the GCP account preparation required before onboarding cloud accounts into CoreStack, you will need to create least privilege policies— individual policies that must be attached to your cross-account role that allow the platform to access the GCP data it needs in order to create its reports.

📘
Pre-configured automation templates for allowing access
You can refer to the paths below to access templates provided based on the type of access you wish to provide for the platform after cloning a GitHub repo (https://github.com/corestacklabs/Onboarding_Templates.git):

FinOps: Onboarding_Templates/GCP/Assesment-module-proj/finops/

SecOps: Onboarding_Templates/GCP/Assesment-module-proj/secops/

CloudOps: Onboarding_Templates/GCP/Assesment-module-proj/cloudops/

Least Privilege Polices by Product (Read-Only)

Each least privilege policy provides the necessary permissions to enable core functions in the platform. The policies for enabling Read-Only access to the platform are listed below organized by product and platform capability:

❗️
Note:
Some permissions listed in this guide are not applicable when creating a project-level custom role. Those permissions can be assigned to a custom role only when creating a custom role at the organization-level.
Choosing to skip the below permissions may result in the following effects:

billing.budgets.create: The platform won't be able to create a cloud-native budget through the main portal, whereas platform-native budget alerts can still be configured.

billing.budgets.get/list: The platform won't be able to list a cloud-native budget through portal.

billing.budgets.update: The platform won't be able to update cloud-native budgets through the main portal.

resourcemanager.folders.get/list: The platform won't be able to pull the folders listed as part of an organization.

securitycenter.subscription.get: The platform won't be able to identify the Security Command Center subscription details. This is needed for access validation to configure threats.

role/billing.viewer: This is mandatory permission to list the Cloud Native Budgets

FinOps

Capability	Description	Least Privilege Permissions
Billing Account	These permissions are required for onboarding a GCP Billing Account. Once onboarded, users can proceed with Linked Project onboarding by segregating as per the needs of the bundles listed here.	`storage.buckets.get` `storage.buckets.list` `storage.objects.get` `storage.objects.list` `compute.regions.get` `compute.regions.list` `compute.zones.get` `compute.zones.list` `resourcemanager.projects.get
Cost Visibility and Usage	Allow the platform to pull cost data from your GCP cloud account and displaying them as part of cost posturing.	`storage.buckets.get` `storage.buckets.list` `storage.objects.get` `storage.objects.list`
Cost Optimization Dashboard	Allow the platform to monitoring the utilization of your cloud resources in order to provide cost optimization recommendations through FinOps policies, retrieve native recommendations from GCP, and offer remediation actions. Note:* Cost optimization recommendations provided here cannot be remediated unless the necessary write permissions are given.	`monitoring.alertPolicies.get` `monitoring.alertPolicies.list` `monitoring.metricDescriptors.get` `monitoring.metricDescriptors.list` `monitoring.monitoredResourceDescriptors.get` `monitoring.publicWidgets.get` `monitoring.publicWidgets.list` `monitoring.services.get` `monitoring.services.list` `monitoring.slos.get` `monitoring.slos.list` `monitoring.snoozes.get` `monitoring.snoozes.list` `monitoring.timeSeries.list` `monitoring.dashboards.get` `monitoring.dashboards.list` `recommender.cloudsqlIdleInstanceRecommendations.get` `recommender.cloudsqlIdleInstanceRecommendations.list` `recommender.cloudsqlOverprovisionedInstanceRecommendations.get` `recommender.cloudsqlOverprovisionedInstanceRecommendations.list` `recommender.cloudsqlUnderProvisionedInstanceRecommendations.get` `recommender.cloudsqlUnderProvisionedInstanceRecommendations.list` `recommender.computeAddressIdleResourceRecommendations.get` `recommender.computeAddressIdleResourceRecommendations.list` `recommender.computeDiskIdleResourceRecommendations.get` `recommender.computeDiskIdleResourceRecommendations.list` `recommender.computeImageIdleResourceRecommendations.get` `recommender.computeImageIdleResourceRecommendations.list` `recommender.computeInstanceIdleResourceRecommendations.get` `recommender.computeInstanceIdleResourceRecommendations.list` `recommender.computeInstanceMachineTypeRecommendations.get` `recommender.computeInstanceMachineTypeRecommendations.list` `recommender.spendBasedCommitmentRecommendations.get` `recommender.spendBasedCommitmentRecommendations.list` `recommender.usageCommitmentRecommendations.get` `recommender.usageCommitmentRecommendations.list`
Resource Inventory	Allow the platform to provide pull resource data from GCP in order to provide cost recommendations through FinOps cost policies. Note: * Write permissions are also required for the platform to perform the following actions: • Associate Volume • Attach Load Balancer • De-provision •DetachLoadBalancer •DisassociateVolume • Extend Volume • Modify Security Group • Manage_Tags • Remove Labels • Resize • Restart • SetLabels • Start • Stop • Update Labels	`bigquery.datasets.get` `bigquery.jobs.get` `bigquery.jobs.list` `bigquery.reservations.get` `bigquery.reservations.list` `bigtable.tables.get` `bigtable.tables.list` `cloudsql.databases.get` `cloudsql.databases.list` `cloudsql.instances.get` `cloudsql.instances.list` `compute.addresses.get` `compute.addresses.list` `compute.commitments.get` `compute.commitments.list` `compute.disks.get` `compute.diskTypes.get` `compute.diskTypes.list` `compute.images.list` `compute.instances.get` `compute.instances.list` `compute.regions.get` `compute.regions.list` `compute.reservations.get` `compute.reservations.list` `compute.zones.get` `compute.zones.list`
Cost Budget	Allow the platform to display cloud-native budgets from the platform. Note:The`billing.budget` API should be enabled in the billing project* for budgets to be synced along with the Viewer permissions.	`billing.budgets.get` `billing.budgets.list` `serviceusage.services.get` `serviceusage.services.list`

SecOps

Capability	Description	Least Privilege Permissions
Governance Configuration > Vulnerability Assessments and Threats	Allow the platform to display vulnerabilities and threats from GCP Security Command Center.	`securitycenter.containerthreatdetectionsettings.get` `securitycenter.eventthreatdetectionsettings.calculate` `securitycenter.eventthreatdetectionsettings.get` `securitycenter.findings.group` `securitycenter.findings.list` `securitycenter.findings.listFindingPropertyNames` `securitycenter.rapidvulnerabilitydetectionsettings.get` `securitycenter.securitycentersettings.get` `securitycenter.securityhealthanalyticssettings.get` `securitycenter.sources.get` `securitycenter.sources.list` `securitycenter.subscription.get` `securitycenter.virtualmachinethreatdetectionsettings.get` `securitycenter.websecurityscannersettings.get`
Guardrails/Policies Compliance Standards - GCP CAF	Allow the platform to run security policies against your cloud resources in order to get violations and remediate some of the violated resources. Note:* The platform can pull resources and run them against the CoreStack policy engine, but remediation of impacted resources requires write permissions.	`compute.disks.list` `compute.instances.get` `compute.instances.list` `compute.networks.list` `compute.networks.get` `compute.projects.get` `compute.regions.get` `compute.regions.list` `compute.subnetworks.list` `compute.zones.get` `compute.zones.list` `container.clusters.get` `container.clusters.list` `cloudsql.databases.get` `cloudsql.databases.list` `cloudsql.instances.get` `cloudsql.instances.list`

CloudOps

Capability	Description	Least Privilege Permissions
Activity and Alerts - Governance Configuration > Operations > Activity Log	Allow the platform to configure activity logs and alerts via read and write permissions. Note:* The platform can't configure activity logs and alerts with only read permissions.	`logging.sinks.get` `logging.sinks.list` `logging.views.list` `pubsub.subscriptions.get` `pubsub.subscriptions.getIamPolicy` `pubsub.subscriptions.list` `pubsub.topics.get` `pubsub.topics.getIamPolicy` `pubsub.topics.list` `pubsub.topics.publish`
Activity and Alerts - Governance Configuration > Operations > Alerts	Allow the platform to configure monitoring alerts with a specific template. Note:* The platform can't configure monitoring templates with read permissions only.	`monitoring.alertPolicies.get` `monitoring.alertPolicies.list` `monitoring.metricDescriptors.get` `monitoring.metricDescriptors.list` `monitoring.monitoredResourceDescriptors.get` `monitoring.publicWidgets.get` `monitoring.publicWidgets.list` `monitoring.services.get` `monitoring.services.list` `monitoring.slos.get` `monitoring.slos.list` `monitoring.snoozes.get` `monitoring.snoozes.list` `monitoring.timeSeries.list` `monitoring.alertPolicies.get` `monitoring.alertPolicies.list` `monitoring.metricDescriptors.get` `monitoring.metricDescriptors.list` `monitoring.monitoredResourceDescriptors.get` `monitoring.publicWidgets.get` `monitoring.publicWidgets.list` `monitoring.services.get` `monitoring.services.list` `monitoring.slos.get` `monitoring.slos.list` `monitoring.snoozes.get` `monitoring.snoozes.list` `monitoring.timeSeries.list` `monitoring.dashboards.get` `monitoring.dashboards.list` `monitoring.alertPolicies.create` `monitoring.alertPolicies.delete` `monitoring.alertPolicies.get` `monitoring.alertPolicies.list` `monitoring.alertPolicies.update`
Resource Inventory	Allow the platform to pull resources from GCP in order to populate the resource inventory in the UI. Note:* To show your resources in the platform's resource inventory, the below actions must be performed: • Associate Volume • Attach Load Balancer • Deprovision • DetachLoadBalancer • DisassociateVolume • Extend Volume • Modify Security Group • Manage_Tags • Remove Labels • Resize • Restart • SetLabels • Start • Stop • Update Labels\ The platform will require a few more governance permissions to accomplish this.	`appengine.applications.get` `appengine.instances.get` `appengine.instances.list` `appengine.services.get` `appengine.services.list` `appengine.versions.get` `appengine.versions.list` `bigquery.datasets.get` `bigquery.jobs.get` `bigquery.reservations.get` `bigquery.reservations.list` `bigquery.transfers.get` `bigtable.tables.get` `bigtable.tables.getIamPolicy` `bigtable.tables.list` `cloudfunctions.functions.get` `cloudfunctions.functions.list` `cloudiot.registries.get` `cloudiot.registries.list` `cloudscheduler.jobs.list` `cloudsecurityscanner.scans.list` `cloudsql.databases.get` `cloudsql.databases.list` `cloudsql.instances.get` `cloudsql.instances.list` `cloudtasks.queues.list` `composer.environments.list` `compute.addresses.get` `compute.addresses.list` `compute.autoscalers.get` `compute.autoscalers.list` `compute.backendBuckets.get` `compute.backendBuckets.getIamPolicy` `compute.backendBuckets.list` `compute.backendServices.get` `compute.backendServices.getIamPolicy` `compute.backendServices.list` `compute.commitments.get` `compute.commitments.list` `compute.disks.get` `compute.disks.getIamPolicy` `compute.disks.list` `compute.disks.setLabels` `compute.diskTypes.get` `compute.diskTypes.list` `compute.externalVpnGateways.list` `compute.firewalls.get` `compute.firewalls.list` `compute.images.get` `compute.images.list` `compute.images.setLabels` `compute.instances.get` `compute.instanceGroups.list` `compute.instances.get` `compute.instances.list` `compute.instances.setLabels` `compute.instanceTemplates.get` `compute.interconnects.get` `compute.networkEndpointGroups.get` `compute.networks.get` `compute.networks.list` `compute.regions.get` `compute.regions.list` `compute.routers.list` `compute.routes.get` `compute.securityPolicies.get` `compute.snapshots.get` `compute.snapshots.setLabels` `compute.sslPolicies.list` `compute.targetHttpProxies.get` `compute.targetPools.get` `compute.vpnGateways.list` `compute.zones.get` `compute.zones.list` `container.clusters.get` `container.clusters.list` `dataflow.jobs.list` `dns.managedZones.get` `dns.managedZones.list` `file.backups.list` `file.instances.list` `file.locations.list` `iam.roles.list` `iam.serviceAccounts.get` `logging.sinks.create` `logging.sinks.delete` `logging.sinks.get` `logging.sinks.list` `logging.sinks.update` `logging.views.list` `monitoring.alertPolicies.get` `monitoring.alertPolicies.list` `monitoring.notificationChannels.get` `monitoring.notificationChannels.list` `pubsub.subscriptions.get` `pubsub.subscriptions.getIamPolicy` `pubsub.subscriptions.list` `pubsub.topics.attachSubscription` `pubsub.topics.detachSubscription` `pubsub.topics.get` `pubsub.topics.getIamPolicy` `pubsub.topics.list` `pubsub.topics.publish` `resourcemanager.folders.get` `resourcemanager.folders.list` `resourcemanager.projects.get` `resourcemanager.projects.list` `run.services.list` `spanner.databases.list` `spanner.instances.list` `storage.buckets.get` `storage.buckets.list` `storage.objects.get` `storage.objects.list`