> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-outposts/google-cloud-platform-gcp.md).

# Google Cloud Platform (GCP)

The following table lists the static resources deployed on outposts in Google Cloud Platform (GCP).

<table><thead><tr><th width="74.39996337890625">Scope</th><th width="137.4000244140625">IaC Resource Type</th><th width="91.09991455078125">Technical Resource Name</th><th width="82.5001220703125">Required for These Modules</th><th>Purpose</th></tr></thead><tbody><tr><td>Global</td><td><code>google_compute_firewall</code></td><td><code>outpost_ingress_default</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource defines a default ingress firewall rule that blocks all inbound traffic to the outpost VPC. Cortex utilizes this during the onboarding phase to ensure the outpost network is isolated and protected from unauthorized external access.</td></tr><tr><td>Global</td><td><code>google_compute_firewall</code></td><td><code>permit_egress_from_dspm_to_cloudsql</code></td><td>DSPM</td><td>This resource defines a firewall rule that permits outbound traffic from virtual machines using the DSPM Service Account to reach CloudSQL Private Services Access ranges. Cortex utilizes this during the DSPM scanning phase to allow scanning engines to securely connect to and audit CloudSQL databases.</td></tr><tr><td>Global</td><td><code>google_compute_firewall</code></td><td><code>permit_egress_from_dspm_to_proxy</code></td><td>DSPM</td><td>This resource defines a firewall rule that allows outbound traffic from DSPM scanner instances to the Proxy VM. Cortex utilizes this during the scanning phase to ensure that all data discovery results are securely routed through the proxy to the management plane.</td></tr><tr><td>Global</td><td><code>google_compute_firewall</code></td><td><code>permit_egress_from_scanner_of_serverless_to_proxy</code></td><td>Serverless</td><td>This resource defines a firewall rule that allows outbound traffic from serverless scanner instances to the Proxy VM. Cortex utilizes this during the serverless scanning phase to route function analysis results through the secure proxy tunnel.</td></tr><tr><td>Global</td><td><code>google_compute_firewall</code></td><td><code>permit_egress_to_pga</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource defines a firewall rule that allows outbound traffic from the compute network to Private Google Access (PGA) endpoints for Google APIs over HTTPS. Cortex utilizes this during the scanning and discovery stages to enable scanner instances to communicate with Google Cloud services without using public IP addresses.</td></tr><tr><td>Global</td><td><code>google_compute_firewall</code></td><td><code>permit_proxy_egress_to_world</code></td><td>Serverless, Registry, DSPM</td><td>This resource defines a firewall rule that allows the Proxy VM instances to initiate outbound connections to external endpoints. Cortex utilizes this during the operation phase to ensure the Proxy VM can communicate with the Cortex platform and external security registries to perform discovery tasks.</td></tr><tr><td>Global</td><td><code>google_compute_firewall</code></td><td><code>permit_proxy_ingress_from_dspm_vms</code></td><td>DSPM</td><td>This resource defines a firewall rule that allows inbound traffic from DSPM scanner instances to the Proxy VM. Cortex utilizes this during the scanning phase to provide a secure path for discovery metadata to reach the outbound proxy.</td></tr><tr><td>Global</td><td><code>google_compute_firewall</code></td><td><code>permit_proxy_ingress_from_registry_vms</code></td><td>Registry</td><td>This resource defines a firewall rule that allows inbound traffic from registry scanner instances to the Proxy VM. Cortex utilizes this during the scanning phase to allow container assessment data to be collected and forwarded to the management plane.</td></tr><tr><td>Global</td><td><code>google_compute_firewall</code></td><td><code>permit_proxy_ingress_from_scanner_of_serverless</code></td><td>Serverless</td><td>This resource defines a firewall rule that allows inbound traffic from serverless scanner instances to the Proxy VM. Cortex utilizes this during the serverless scanning phase to facilitate the secure collection of function discovery data.</td></tr><tr><td>Global</td><td><code>google_compute_firewall</code></td><td><code>permit_ssh_ingress_from_iap</code></td><td></td><td>This resource provisions a VPC firewall rule that permits inbound SSH (TCP/22) from the well-known GCP Identity-Aware Proxy (IAP) range 35.235.240.0/20. Cortex utilizes this rule on operator opt-in to enable a secure, audited debug path into scanner VMs without exposing SSH to the public internet.</td></tr><tr><td>Regional</td><td><code>google_compute_global_address</code></td><td><code>google_private_services_access</code></td><td>DSPM</td><td>This resource provides the infrastructure and configuration necessary for the outpost to perform its functions. Cortex utilizes this during the scanning and discovery phases to maintain a secure and functional environment for cloud security assessments. Specifically, it reserves the IP range used by the Service Networking Connection for private services such as CloudSQL access.</td></tr><tr><td>Global</td><td><code>google_compute_network</code></td><td><code>cwp_agentless</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource defines the isolated VPC (Virtual Private Cloud) network that provides the foundational environment for the outpost. Cortex utilizes this network during the onboarding and scanning phases to host all scanner infrastructure and logically separate discovery activities from the customer's production traffic.</td></tr><tr><td>Global</td><td><code>google_compute_network_peering_routes_config</code></td><td><code>google_private_services_access</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource configures custom route propagation for the VPC network peering used by Private Service Access. Cortex utilizes this during the onboarding phase to ensure that scanner instances can correctly route traffic to managed Google services, such as CloudSQL, over private connections.</td></tr><tr><td>Global</td><td><code>google_compute_route</code></td><td><code>private_google_access</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource defines a specific routing rule within the outpost VPC network to direct traffic toward Private Google Access endpoints. Cortex utilizes this route during the scanning and discovery phases to enable secure, internal communication with Google Cloud APIs.</td></tr><tr><td>Regional</td><td><code>google_compute_subnetwork</code></td><td><code>region_default_subnetwork</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource defines a specific range of IP addresses within the VPC used to host outpost infrastructure. Cortex utilizes this subnetwork during the onboarding and scanning phases to deploy virtual machines and logically isolate outpost traffic from other cloud resources.</td></tr><tr><td>Global</td><td><code>google_project_iam_binding</code></td><td><code>service_networking_service_agent</code></td><td>DSPM</td><td>This resource configures the IAM binding for the service networking agent to enable Private Service Access. Cortex utilizes this during the outpost onboarding stage to establish private network connectivity between scanning components and managed Google services.</td></tr><tr><td>Global</td><td><code>google_project_iam_custom_role</code></td><td><code>dspm_big_query</code></td><td>DSPM</td><td>This resource defines a custom IAM role that grants permissions for creating and managing BigQuery jobs. Cortex utilizes this role during the DSPM discovery phase to allow scanner instances to execute analysis queries on BigQuery datasets for security auditing.</td></tr><tr><td>Global</td><td><code>google_project_iam_custom_role</code></td><td><code>dspm_cloud_kms</code></td><td>DSPM</td><td>This resource defines a custom IAM role that authorizes Cloud KMS operations, such as decryption and key management. Cortex utilizes this role during the DSPM scanning phase to access and inspect encrypted data stores that require cryptographic operations for thorough analysis.</td></tr><tr><td>Global</td><td><code>google_project_iam_custom_role</code></td><td><code>dspm_cloud_sql</code></td><td>DSPM</td><td>This resource defines a custom IAM role that provides the permissions necessary to interact with and audit CloudSQL instances. Cortex utilizes this role during the DSPM scanning phase to evaluate the security configuration and data exposure of managed SQL databases.</td></tr><tr><td>Global</td><td><code>google_project_iam_custom_role</code></td><td><code>dspm_customer_data_storage</code></td><td>DSPM</td><td>This resource defines a custom IAM role that allows the DSPM module to interact with Cloud Storage buckets used by managed services. Cortex utilizes this role during the DSPM scanning phase to assess data security and posture within the project's storage resources.</td></tr><tr><td>Global</td><td><code>google_project_iam_custom_role</code></td><td><code>dspm_delete_customer_data_storage</code></td><td>DSPM</td><td>This resource defines a custom IAM role that permits the deletion of specific objects within customer-data buckets in the outpost project. Cortex utilizes this role during the DSPM scanning phase to manage storage and clean up temporary scan artifacts after the analysis is complete.</td></tr><tr><td>Global</td><td><code>google_project_iam_custom_role</code></td><td><code>dspm_list_customer_data_storage</code></td><td>DSPM</td><td>This resource defines a custom IAM role that enables the listing of objects within customer-data buckets associated with managed services. Cortex utilizes this role during the DSPM discovery stage to inventory available data repositories for subsequent security audits.</td></tr><tr><td>Global</td><td><code>google_project_iam_custom_role</code></td><td><code>dspm_secret_manager</code></td><td>DSPM</td><td>This resource defines a custom IAM role that provides permissions for accessing and managing secrets within Secret Manager. Cortex utilizes this role during the DSPM scanning phase to securely retrieve credentials required to connect to and audit scan targets.</td></tr><tr><td>Global</td><td><code>google_project_iam_custom_role</code></td><td><code>scan_runner_bucket_role</code></td><td>ADS,DSPM,Registry,Serverless</td><td>This resource defines the custom IAM role bundling the precise GCS object permissions (get, create, delete, list) that scanner workloads need to read inputs and write outputs against the per-Outpost communication bucket. Cortex utilizes this role during the scanning phase as the least-privilege identity attached to every scanner service account that participates in the bucket-based communication channel.</td></tr><tr><td>Global</td><td><code>google_project_iam_custom_role</code></td><td><code>scan_runner_self_destroy</code></td><td>ADS,DSPM,Registry,Serverless</td><td>This resource defines a single-permission custom role (compute.instances.delete) used to allow scanner VMs to delete themselves when their scan completes. Cortex utilizes this role at the end of each scanning workflow to avoid Persistent Disk costs during the idle window between job completion and the scheduled cleanup pass.</td></tr><tr><td>Global</td><td><code>google_project_iam_member</code></td><td><code>scanner_of_serverless_self_destroy</code></td><td>Serverless</td><td>This resource binds the scan_runner_self_destroy custom role to the scanner-of-serverless service account, scoped by a condition that limits the permission to compute instances whose names begin with cortex-workload-. Cortex utilizes this binding at the end of each Serverless scan so the serverless-scan VM can delete itself immediately without acquiring broader project-level delete privileges.</td></tr><tr><td>Global</td><td><code>google_project_iam_member</code></td><td><code>cortex_engine_bigtable_restore_process</code></td><td>DSPM</td><td>This resource grants Bigtable permissions to the service agent used during the restore process. Cortex utilizes this during the DSPM scanning phase to enable the secure analysis of Bigtable instances through the restore workflow.</td></tr><tr><td>Global</td><td><code>google_project_iam_member</code></td><td><code>cortex_engine_cloudkms</code></td><td>DSPM</td><td>This resource binds the custom Cloud KMS role to the Cortex Engine Service Account. Cortex utilizes this during the DSPM scanning phase to authorize the cryptographic operations needed to inspect encrypted customer data.</td></tr><tr><td>Global</td><td><code>google_project_iam_member</code></td><td><code>cortex_engine_compute_admin</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource grants the permissions necessary to manage VM instances, disks, and snapshots within the project. Cortex utilizes this throughout the scanning lifecycle to provision scanner instances and attach target resources for security assessment.</td></tr><tr><td>Global</td><td><code>google_project_iam_member</code></td><td><code>cortex_engine_dspm_big_query</code></td><td>DSPM</td><td>This resource binds the custom BigQuery role to the Cortex Engine Service Account. Cortex utilizes this during the DSPM discovery stage to enable the execution of security audit jobs against BigQuery datasets.</td></tr><tr><td>Global</td><td><code>google_project_iam_member</code></td><td><code>cortex_engine_dspm_cloud_sql</code></td><td>DSPM</td><td>This resource binds the custom CloudSQL role to the DSPM Service Account. Cortex utilizes this during the DSPM scanning phase to allow scanner engines to evaluate the security configuration of SQL databases.</td></tr><tr><td>Global</td><td><code>google_project_iam_member</code></td><td><code>cortex_engine_dspm_secret_manager</code></td><td>DSPM</td><td>This resource grants the DSPM Service Account access to credentials stored in Secret Manager. Cortex utilizes this during the scanning phase to securely fetch the secrets required to authenticate with protected scan targets.</td></tr><tr><td>Global</td><td><code>google_project_iam_member</code></td><td><code>dspm_scanner_bigtable_restore_process</code></td><td>DSPM</td><td>This resource grants Bigtable permissions to the service agent used during the restore process. Cortex utilizes this during the DSPM scanning phase to enable the secure analysis of Bigtable instances through the restore workflow.</td></tr><tr><td>Global</td><td><code>google_project_iam_member</code></td><td><code>dspm_scanner_cloudkms_encrypter</code></td><td>DSPM</td><td>This resource binds the custom Cloud KMS role to the Cortex Engine Service Account. Cortex utilizes this during the DSPM scanning phase to authorize the cryptographic operations needed to inspect encrypted customer data.</td></tr><tr><td>Global</td><td><code>google_project_iam_member</code></td><td><code>dspm_scanner_cloudkms_viewer</code></td><td>DSPM</td><td>This resource binds the custom Cloud KMS role to the Cortex Engine Service Account. Cortex utilizes this during the DSPM scanning phase to authorize the cryptographic operations needed to inspect encrypted customer data.</td></tr><tr><td>Global</td><td><code>google_project_iam_member</code></td><td><code>dspm_scanner_vm_cloudsql</code></td><td>DSPM</td><td>This resource provides grant permissions to Cortex Engine Service Account (scanner VM) to list, get and connect to CloudSQL instances to be scanned. Cortex utilizes this during the outpost scanning and discovery stage to facilitate secure infrastructure operations.</td></tr><tr><td>Global</td><td><code>google_project_iam_member</code></td><td><code>dspm_scanner_vm_secret_manager</code></td><td>DSPM</td><td>This resource grants the DSPM Service Account access to credentials stored in Secret Manager. Cortex utilizes this during the scanning phase to securely fetch the secrets required to authenticate with protected scan targets.</td></tr><tr><td>Global</td><td><code>google_project_iam_member</code></td><td><code>registry_scan_runner_secret_manager</code></td><td>Registry</td><td>This resource grants the DSPM Service Account access to credentials stored in Secret Manager. Cortex utilizes this during the scanning phase to securely fetch the secrets required to authenticate with protected scan targets.</td></tr><tr><td>Global</td><td><code>google_project_iam_member</code></td><td><code>scan_runner_self_destroy</code></td><td>ADS</td><td>This resource binds the scan_runner_self_destroy custom role to the generic scan-runner service account, scoped by a condition that limits the permission to compute instances whose names begin with cortex-workload-. Cortex utilizes this binding at the end of each ADS scan so the scanner VM can delete itself immediately without acquiring broader project-level delete privileges.</td></tr><tr><td>Global</td><td><code>google_project_service_identity</code></td><td><code>servicenetworking</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource retrieves the identity of a Google-managed service to facilitate IAM bindings. Cortex utilizes this during the outpost onboarding stage to properly configure permissions for service-to-service communication, such as service networking.</td></tr><tr><td>Global</td><td><code>google_pubsub_subscription</code></td><td><code>bucket_communication_cortex_engine</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource establishes a Pub/Sub subscription that allows the Cortex management plane to be notified of new data uploads. Cortex utilizes this during the scanning phase to trigger automated processing whenever a scanner VM saves new findings to the communication bucket.</td></tr><tr><td>Global</td><td><code>google_pubsub_subscription_iam_member</code></td><td><code>bucket_communication_cortex_engine_cortex_engine</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource grants specific IAM permissions to the Cortex engine for managing Pub/Sub subscriptions. Cortex utilizes this during the scanning phase to ensure it can correctly receive and acknowledge notifications regarding new scan results in the communication bucket.</td></tr><tr><td>Global</td><td><code>google_pubsub_topic</code></td><td><code>bucket_communication</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource defines a Pub/Sub topic used to broadcast notifications about object creation in storage buckets. Cortex utilizes this throughout the scanning lifecycle to provide a reliable messaging channel for coordinating data analysis workflows.</td></tr><tr><td>Global</td><td><code>google_pubsub_topic_iam_member</code></td><td><code>google_storage_project_service_account_on_bucket_communication_pubsub_topic</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource grants permission to Google Storage service accounts to publish messages to the communication Pub/Sub topic. Cortex utilizes this during the scanning phase to enable automated notifications whenever a scanner instance creates or updates an object in the storage bucket.</td></tr><tr><td>Global</td><td><code>google_service_account</code></td><td><code>cortex_engine</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource establishes the Service Account that acts as the central orchestration identity for the Cortex engine within the GCP environment. Cortex utilizes this identity throughout the outpost lifecycle to manage resources and coordinate scanning tasks across different modules.</td></tr><tr><td>Global</td><td><code>google_service_account</code></td><td><code>dspm_scan_runner</code></td><td>DSPM</td><td>This resource establishes the Service Account that provides the security identity for DSPM scanning engines. Cortex utilizes this identity during the outpost scanning and discovery stage to authorize the inspection of cloud data stores for sensitive information and posture risks.</td></tr><tr><td>Global</td><td><code>google_service_account</code></td><td><code>proxy</code></td><td>Serverless, Registry, DSPM</td><td>This resource establishes the Service Account used by the Proxy VM to facilitate secure outbound network communication. Cortex utilizes this identity during the operation phase to allow the Proxy VM to route traffic between internal scanners and external security registries.</td></tr><tr><td>Global</td><td><code>google_service_account</code></td><td><code>registry_scan_runner</code></td><td>Registry</td><td>This resource establishes the Service Account that defines the permissions for virtual machines dedicated to container registry scanning. Cortex utilizes this identity during the scanning phase to allow scanners to authenticate with and retrieve images from container registries.</td></tr><tr><td>Global</td><td><code>google_service_account</code></td><td><code>scan_runner</code></td><td>ADS</td><td>This resource establishes the Service Account for core Agentless Data Security (ADS) scanner instances. Cortex utilizes this identity during the scanning phase to grant the necessary permissions for analyzing disk snapshots and reporting vulnerability findings.</td></tr><tr><td>Global</td><td><code>google_service_account</code></td><td><code>scanner_of_serverless</code></td><td>Serverless</td><td>This resource establishes the Service Account for scanning engines focused on serverless environment assessments. Cortex utilizes this identity during the serverless scanning stage to grant the authority needed to inspect function configurations and source code for potential risks.</td></tr><tr><td>Global</td><td><code>google_service_account_iam_member</code></td><td><code>cortex_engine</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource grants the necessary IAM permissions to the cortex engine Service Account. Cortex utilizes this binding during the scanning phase to ensure the identity has the authority required to perform its designated security functions.</td></tr><tr><td>Global</td><td><code>google_service_account_iam_member</code></td><td><code>cortex_engine_ads_user</code></td><td>ADS</td><td>This resource grants the necessary IAM permissions to the cortex engine Service Account. Cortex utilizes this binding during the scanning phase to ensure the identity has the authority required to perform its designated security functions, including the ability to impersonate the ADS scanner service account.</td></tr><tr><td>Global</td><td><code>google_service_account_iam_member</code></td><td><code>cortex_engine_dspm_user</code></td><td>DSPM</td><td>This resource grants the necessary IAM permissions to the cortex engine Service Account. Cortex utilizes this binding during the scanning phase to ensure the identity has the authority required to perform its designated security functions, including the ability to impersonate the DSPM scanner service account.</td></tr><tr><td>Global</td><td><code>google_service_account_iam_member</code></td><td><code>cortex_engine_proxy_user</code></td><td>Serverless, Registry, DSPM</td><td>This resource grants the necessary IAM permissions to the cortex engine Service Account. Cortex utilizes this binding during the scanning phase to ensure the identity has the authority required to perform its designated security functions, including the ability to impersonate the proxy service account.</td></tr><tr><td>Global</td><td><code>google_service_account_iam_member</code></td><td><code>cortex_engine_registry_user</code></td><td>Registry</td><td>This resource grants the necessary IAM permissions to the cortex engine Service Account. Cortex utilizes this binding during the scanning phase to ensure the identity has the authority required to perform its designated security functions, including the ability to impersonate the registry scanner service account.</td></tr><tr><td>Global</td><td><code>google_service_account_iam_member</code></td><td><code>cortex_engine_scanner_of_serverless_user</code></td><td>Serverless</td><td>This resource grants the necessary IAM permissions to the cortex engine Service Account. Cortex utilizes this binding during the scanning phase to ensure the identity has the authority required to perform its designated security functions.</td></tr><tr><td>Global</td><td><code>google_service_account_iam_member</code></td><td><code>cortex_engine_self</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource grants the necessary IAM permissions to the cortex engine Service Account. Cortex utilizes this binding during the scanning phase to ensure the identity has the authority required to perform its designated security functions.</td></tr><tr><td>Global</td><td><code>google_service_networking_connection</code></td><td><code>default</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource establishes a private VPC connection to Google services for Private Service Access. Cortex utilizes this during the onboarding phase to enable scanner instances to communicate with managed services like CloudSQL over a secure, private network path.</td></tr><tr><td>Regional</td><td><code>google_storage_bucket</code></td><td><code>outpost_communication</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource defines the Cloud Storage bucket used for exchanging metadata and logs between the outpost and the management plane. Cortex utilizes this bucket throughout the outpost operation to maintain communication and synchronize findings without requiring direct network connectivity.</td></tr><tr><td>Regional</td><td><code>google_storage_bucket</code></td><td><code>outpost_customer_data</code></td><td>DSPM</td><td>This resource provides the infrastructure and configuration necessary for the outpost to perform its functions. Cortex utilizes this during the scanning and discovery phases to maintain a secure and functional environment for cloud security assessments. Specifically, it provides the bucket where DSPM data extracts are staged for scanning.</td></tr><tr><td>Regional</td><td><code>google_storage_bucket_iam_member</code></td><td><code>outpost_communication_cortex_engine</code></td><td></td><td>This resource grants the Cortex engine service account the bucket-scoped scan_runner_bucket_role on the per-Outpost communication GCS bucket. Cortex utilizes this binding during scan orchestration so the centrally-managed engine workload can submit work items and read back results through the bucket-based communication channel.</td></tr><tr><td>Regional</td><td><code>google_storage_bucket_iam_member</code></td><td><code>outpost_communication_dspm_scan_runner</code></td><td>DSPM</td><td>This resource grants specific permissions to the scanner role for accessing the communication Cloud Storage bucket. Cortex utilizes this access during the scanning phase to ensure that authorized components can securely view and upload results and manage scan metadata.</td></tr><tr><td>Regional</td><td><code>google_storage_bucket_iam_member</code></td><td><code>outpost_communication_dspm_scan_runner_creator</code></td><td>DSPM</td><td>REPLACED BY: outpost_communication_dspm_scan_runner_creator. This resource grants specific permissions to the scanner role for accessing the communication Cloud Storage bucket. Cortex utilizes this access during the scanning phase to ensure that authorized components can securely upload results and manage scan metadata.</td></tr><tr><td>Regional</td><td><code>google_storage_bucket_iam_member</code></td><td><code>outpost_communication_dspm_scan_runner_viewer</code></td><td>DSPM</td><td>REPLACED BY: outpost_communication_dspm_scan_runner_creator. This resource grants specific permissions to the scanner role for accessing the communication Cloud Storage bucket. Cortex utilizes this access during the scanning phase to ensure that authorized components can securely view findings and manage scan metadata.</td></tr><tr><td>Regional</td><td><code>google_storage_bucket_iam_member</code></td><td><code>outpost_communication_proxy_creator</code></td><td>Serverless, Registry, DSPM</td><td>This resource grants specific permissions to the scanner role for accessing the communication Cloud Storage bucket. Cortex utilizes this access during the scanning phase to ensure that authorized components can securely upload results and manage scan metadata.</td></tr><tr><td>Regional</td><td><code>google_storage_bucket_iam_member</code></td><td><code>outpost_communication_registry_scan_runner</code></td><td>Registry</td><td>This resource grants specific permissions to the scanner role for accessing the communication Cloud Storage bucket. Cortex utilizes this access during the scanning phase to ensure that authorized components can securely view and upload results and manage scan metadata.</td></tr><tr><td>Regional</td><td><code>google_storage_bucket_iam_member</code></td><td><code>outpost_communication_registry_scan_runner_creator</code></td><td>Registry</td><td>REPLACED BY: outpost_communication_registry_scan_runner. This resource grants specific permissions to the scanner role for accessing the communication Cloud Storage bucket. Cortex utilizes this access during the scanning phase to ensure that authorized components can securely upload results and manage scan metadata.</td></tr><tr><td>Regional</td><td><code>google_storage_bucket_iam_member</code></td><td><code>outpost_communication_registry_scan_runner_viewer</code></td><td>Registry</td><td>REPLACED BY: outpost_communication_registry_scan_runner. This resource grants specific permissions to the scanner role for accessing the communication Cloud Storage bucket. Cortex utilizes this access during the scanning phase to ensure that authorized components can securely view findings and manage scan metadata.</td></tr><tr><td>Regional</td><td><code>google_storage_bucket_iam_member</code></td><td><code>outpost_communication_scan_runner</code></td><td>ADS</td><td>This resource grants specific permissions to the scanner role for accessing the communication Cloud Storage bucket. Cortex utilizes this access during the scanning phase to ensure that authorized components can securely view and upload results and manage scan metadata.</td></tr><tr><td>Regional</td><td><code>google_storage_bucket_iam_member</code></td><td><code>outpost_communication_scan_runner_creator</code></td><td>ADS</td><td>REPLACED BY: outpost_communication_scan_runner. This resource grants specific permissions to the scanner role for accessing the communication Cloud Storage bucket. Cortex utilizes this access during the scanning phase to ensure that authorized components can securely upload results and manage scan metadata.</td></tr><tr><td>Regional</td><td><code>google_storage_bucket_iam_member</code></td><td><code>outpost_communication_scan_runner_viewer</code></td><td>ADS</td><td>REPLACED BY: outpost_communication_scan_runner. This resource grants specific permissions to the scanner role for accessing the communication Cloud Storage bucket. Cortex utilizes this access during the scanning phase to ensure that authorized components can securely view findings and manage scan metadata.</td></tr><tr><td>Regional</td><td><code>google_storage_bucket_iam_member</code></td><td><code>outpost_communication_scanner_of_serverless_runner</code></td><td>Serverless</td><td>This resource grants specific permissions to the scanner role for accessing the communication Cloud Storage bucket. Cortex utilizes this access during the scanning phase to ensure that authorized components can securely view findings, upload results and manage scan metadata.</td></tr><tr><td>Regional</td><td><code>google_storage_bucket_iam_member</code></td><td><code>outpost_communication_scanner_of_serverless_runner_creator</code></td><td>Serverless</td><td>REPLACED BY: outpost_communication_scanner_of_serverless_runner. This resource grants specific permissions to the scanner role for accessing the communication Cloud Storage bucket. Cortex utilizes this access during the scanning phase to ensure that authorized components can securely upload results and manage scan metadata.</td></tr><tr><td>Regional</td><td><code>google_storage_bucket_iam_member</code></td><td><code>outpost_communication_scanner_of_serverless_runner_viewer</code></td><td>Serverless</td><td>REPLACED BY: outpost_communication_scanner_of_serverless_runner. This resource grants specific permissions to the scanner role for accessing the communication Cloud Storage bucket. Cortex utilizes this access during the scanning phase to ensure that authorized components can securely view findings and manage scan metadata.</td></tr><tr><td>Regional</td><td><code>google_storage_bucket_iam_member</code></td><td><code>outpost_communication_st</code></td><td></td><td>REPLACED BY: outpost_communication_dspm_scan_runner. This resource grants specific permissions to the single-tenant role for accessing the communication Cloud Storage bucket. Cortex utilizes this access during the scanning phase to ensure that authorized components can securely view findings, upload results and manage scan metadata.</td></tr><tr><td>Regional</td><td><code>google_storage_bucket_iam_member</code></td><td><code>outpost_communication_st_creator</code></td><td>ADS, Serverless, Registry, DSPM</td><td>REPLACED BY: outpost_communication_dspm_scan_runner. This resource grants specific permissions to the single-tenant role for accessing the communication Cloud Storage bucket. Cortex utilizes this access during the scanning phase to ensure that authorized components can securely upload results and manage scan metadata.</td></tr><tr><td>Regional</td><td><code>google_storage_bucket_iam_member</code></td><td><code>outpost_communication_st_viewer</code></td><td>ADS, Serverless, Registry, DSPM</td><td>REPLACED BY: outpost_communication_dspm_scan_runner. This resource grants specific permissions to the single-tenant role for accessing the communication Cloud Storage bucket. Cortex utilizes this access during the scanning phase to ensure that authorized components can securely view findings and manage scan metadata.</td></tr><tr><td>Regional</td><td><code>google_storage_bucket_iam_member</code></td><td><code>outpost_customer_data_storage_engine_delete</code></td><td>DSPM</td><td>This resource grants specific permissions to the scanner role for accessing the artifact Cloud Storage bucket. Cortex utilizes this access during the scanning phase to ensure that authorized components can securely upload results and manage scan metadata.</td></tr><tr><td>Regional</td><td><code>google_storage_bucket_iam_member</code></td><td><code>outpost_customer_data_storage_engine_exports</code></td><td>DSPM</td><td>This resource grants specific permissions to the scanner role for accessing the artifact Cloud Storage bucket. Cortex utilizes this access during the scanning phase to ensure that authorized components can securely upload results and manage scan metadata.</td></tr><tr><td>Regional</td><td><code>google_storage_bucket_iam_member</code></td><td><code>outpost_customer_data_storage_engine_list</code></td><td>DSPM</td><td>This resource grants specific permissions to the scanner role for accessing the artifact Cloud Storage bucket. Cortex utilizes this access during the scanning phase to ensure that authorized components can securely upload results and manage scan metadata.</td></tr><tr><td>Regional</td><td><code>google_storage_bucket_iam_member</code></td><td><code>outpost_customer_data_storage_objectUser_role</code></td><td>DSPM</td><td>This resource grants specific permissions to the scanner role for accessing the artifact Cloud Storage bucket. Cortex utilizes this access during the scanning phase to ensure that authorized components can securely upload results and manage scan metadata.</td></tr><tr><td>Regional</td><td><code>google_storage_notification</code></td><td><code>bucket_communication</code></td><td>ADS, Serverless, Registry, DSPM</td><td>This resource configures Cloud Storage notifications to publish events to a Pub/Sub topic when objects are created. Cortex utilizes this during the scanning and discovery phases to enable real-time detection of new scan data. To configure, this resource creates a GCS-to-Pub/Sub notification on each communication storage bucket. It triggers a Pub/Sub message whenever objects with the `output/` prefix are created or updated, which is how Cortex learns that scanner VMs have uploaded scan results. Without this notification, Cortex cannot process scan outputs. Configuration requirements: - Bucket: The communication storage bucket - Topic: The Pub/Sub topic (e.g., `bucket-communication`) - Event types: OBJECT_FINALIZE, OBJECT_METADATA_UPDATE - Object name prefix filter: `output/` - Payload format: JSON_API_V1 Additionally, the GCS project service account must be granted `roles/pubsub.publisher` on the Pub/Sub topic. This is a GCP-internal service account (not one you create) that GCS uses to publish notifications.</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-outposts/google-cloud-platform-gcp.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.