Prerequisites for onboarding GCP

Before you begin onboarding GCP, you must review the following prerequisites.

Permissions

Before you begin to onboard GCP to Cortex Cloud, ensure that you have the necessary permissions:

• In Cortex Cloud, you must have a Cortex Cloud role with Data Sources - View & Edit permissions (to add/configure cloud accounts in Cortex Cloud). This role is included in the following built-in roles: Instance Administrator, Security Admin, and IT Admin.
• In GCP, you must have access to Google Cloud console and an admin user with the required GCP permissions.

Required APIs

Ensure you have enabled the required APIs in the GCP project you are onboarding.

Required admin GCP permissions for Cortex Cloud onboarding

Use the following template to create a dedicated role with the permissions required for onboarding GCP to Cortex Cloud:

{
  "title": "CortexCloudOnboarding",
  "description": "Custom role with permissions required for onboarding Cortex Cloud",
  "stage": "GA",
  "includedPermissions": [
    "iam.roles.create",
    "iam.roles.delete",
    "iam.roles.get",
    "iam.roles.list",
    "iam.roles.update",
    "iam.serviceAccounts.create",
    "iam.serviceAccounts.delete",
    "iam.serviceAccounts.get",
    "iam.serviceAccounts.getIamPolicy",
    "iam.serviceAccounts.list",
    "iam.serviceAccounts.setIamPolicy",
    "iam.serviceAccounts.update",
    "logging.sinks.create",
    "logging.sinks.delete",
    "logging.sinks.get",
    "logging.sinks.update",
    "pubsub.subscriptions.create",
    "pubsub.subscriptions.delete",
    "pubsub.subscriptions.getIamPolicy",
    "pubsub.subscriptions.setIamPolicy",
    "pubsub.subscriptions.update",
    "pubsub.topics.create",
    "pubsub.topics.delete",
    "pubsub.topics.getIamPolicy",
    "pubsub.topics.setIamPolicy",
    "pubsub.topics.update",
    "resourcemanager.folders.get",
    "resourcemanager.folders.getIamPolicy",
    "resourcemanager.folders.list",
    "resourcemanager.folders.setIamPolicy",
    "resourcemanager.organizations.get",
    "resourcemanager.organizations.getIamPolicy",
    "resourcemanager.organizations.setIamPolicy",
    "resourcemanager.projects.get",
    "resourcemanager.projects.getIamPolicy",
    "resourcemanager.projects.list",
    "resourcemanager.projects.setIamPolicy"
  ]
}