Google Cloud Platform

Prerequisites

Before you configure the Google Cloud Platform connector, ensure the following requirements are met.

Google Cloud access

You have organization-level administrator access to the Google Cloud Console.
You can create projects, service accounts, and enable APIs within your GCP organization.
You can assign IAM roles at the organization scope.
(Optional) If using Google Workspace: You have Super Admin access to the Google Admin Console to configure domain-wide delegation.

Identity Security Insights access

Administrator access to Identity Security Insights.
Your Insights site is provisioned and active.

APIs to enable

Detailed steps follow

Cloud Asset API
Cloud Logging API
Cloud Resource Manager API
Cloud IAM API
Service Usage API
Secret Manager API
Cloud KMS API
API Keys API
Discovery Engine API
(Optional) Admin SDK API, Google Drive API, Google Drive Activity API, Drive Labels API (if using Google Workspace)
(Optional) Vertex AI API (if enabling Gemini AI)

🚧
Important
Third-party documentation is subject to change. Updates might not be reflected in BeyondTrust documentation. For the most up-to-date information, visit the Google Cloud website.

Configuration paths

Optional integrations

Integration	When to enable
Google Workspace	Your organization uses Google Workspace and you want to collect user, group, drive, and audit data
Gemini AI	You want to collect AI agent and model data from Gemini AI

Cloud environment (if applicable)

Environment	When to select
FedRAMP High	Your organization operates FedRAMP High assured workloads
FedRAMP Moderate	Your organization operates FedRAMP Moderate assured workloads only
Commercial	All other environments

⚠️
FedRAMP Compliance Notice
Insights Commercial is not FedRAMP-compliant. Using it in combination with the following cloud environments may result in data residency issues and loss of compliance:

FedRAMP High

FedRAMP Moderate

Step 1: Create the connector in Insights

From Insights Home, select ☰ → Connectors.
Click Create Connector beside Google Cloud Platform.

Enter a human-readable name for your connector.
Select your cloud environment (if applicable).

Step 2: Select Advanced Capabilities (Optional)

Make your selection for Advanced Capabilities (Optional)
- Gemini AI Agents
  - When selected, choose Yes under Allow access to agent model details to also collect agent model details (additional permission required).
- Use Google Workspace
  - When selected, enter an organization admin email in the Admin User Email field

Step 3: Retrieve your Organization ID

In the Google Cloud Console, click the project selector in the top navigation bar.
Select your organization.
Navigate to IAM & Admin > Settings.
Copy your Organization ID.

Paste your Organization ID in the Organization ID field in Identity Security Insights.

Step 4: Run the connector setup script

After you enter your Organization ID, a setup script appears for you to download and run.

python bt-gcp-connector-setup.py setup --org-id <organizationID>

⚠️
The setup script configures the Advanced capabilities you selected above. Confirm your selections before downloading and running the script. Re-running the script is required if you change the settings later.

Step 5: Generate a key for the service account

Copy the Project ID and Service Account ID from the script output, then substitute them for the placeholders in the command below.

In the top navigation toolbar, click the project selector and select your project.
Go to IAM & Admin > Service Accounts and select your service account.
Click the Keys tab.
Click Add Key > Create new key.
Select JSON as the key type.
Click Create. A new key downloads automatically.
Store the JSON key in a secure location.

Step 6: Set up Google Workspace permission (optional)

Complete this step only if your organization uses Google Workspace and you want to collect user, group, drive, and audit data.

Configure Domain-Wide Delegation

Navigate to Admin Console > Security > API Controls > Domain-wide Delegation.
Click Add new.
Enter the service account's Client ID (the 21-digit number from the client_id field in the key JSON file).
Add the following OAuth scopes (comma-separated):

https://www.googleapis.com/auth/admin.directory.user.readonly
https://www.googleapis.com/auth/admin.directory.group.readonly
https://www.googleapis.com/auth/admin.directory.orgunit.readonly
https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly
https://www.googleapis.com/auth/admin.directory.customer.readonly
https://www.googleapis.com/auth/admin.directory.user.security
https://www.googleapis.com/auth/admin.reports.audit.readonly
https://www.googleapis.com/auth/admin.reports.usage.readonly
https://www.googleapis.com/auth/apps.alerts
https://www.googleapis.com/auth/cloud-identity.groups.readonly
https://www.googleapis.com/auth/drive.readonly
https://www.googleapis.com/auth/drive.metadata.readonly
https://www.googleapis.com/auth/drive.activity.readonly
https://www.googleapis.com/auth/drive.labels.readonly
https://www.googleapis.com/auth/drive.admin.labels.readonly
https://apps-apis.google.com/a/feeds/domain/

Click Save.

Final step: Create the connector

In Identity Security Insights, paste the Service Account Key (the full JSON key from Step 5).
Click Create Connector.

Navigate to ☰ > Connectors > Configured to confirm connector creation was successful and review connector settings.