Prerequisites for onboarding GCP

Before you begin onboarding GCP, you must review the following prerequisites.

Permissions

Before you begin to onboard GCP to Cortex Cloud, ensure that you have the necessary permissions:

• In Cortex Cloud, you must have a Cortex Cloud role with Data Sources - View & Edit permissions (to add/configure cloud accounts in Cortex Cloud). This role is included in the following built-in roles: Instance Administrator, Security Admin, and IT Admin.
• In GCP, you must have access to Google Cloud console and an admin user with the required GCP permissions.

Required APIs

Ensure you have enabled the following APIs in the GCP project you are onboarding:

• Cloud Resource Manager API
• Identity and Access Management (IAM) API
• Cloud Pub/Sub API (if audit logs are enabled)

If you plan on enabling Automation as an additional security capability, enable the following APIs:

• Kubernetes Engine API
• Compute Engine API
• Service Usage API
• Cloud Storage API

Required admin GCP permissions for Cortex Cloud onboarding

Use the following template to create a dedicated role with the permissions required for onboarding GCP to Cortex Cloud:

{
  "title": "CortexCloudOnboarding",
  "description": "Custom role with permissions required for onboarding Cortex Cloud",
  "stage": "GA",
  "includedPermissions": [
    "iam.roles.create",
    "iam.roles.delete",
    "iam.roles.get",
    "iam.roles.list",
    "iam.roles.update",
    "iam.serviceAccounts.create",
    "iam.serviceAccounts.delete",
    "iam.serviceAccounts.get",
    "iam.serviceAccounts.getIamPolicy",
    "iam.serviceAccounts.list",
    "iam.serviceAccounts.setIamPolicy",
    "iam.serviceAccounts.update",
    "logging.sinks.create",
    "logging.sinks.delete",
    "logging.sinks.get",
    "logging.sinks.update",
    "pubsub.subscriptions.create",
    "pubsub.subscriptions.delete",
    "pubsub.subscriptions.getIamPolicy",
    "pubsub.subscriptions.setIamPolicy",
    "pubsub.subscriptions.update",
    "pubsub.topics.create",
    "pubsub.topics.delete",
    "pubsub.topics.getIamPolicy",
    "pubsub.topics.setIamPolicy",
    "pubsub.topics.update",
    "resourcemanager.folders.get",
    "resourcemanager.folders.getIamPolicy",
    "resourcemanager.folders.list",
    "resourcemanager.folders.setIamPolicy",
    "resourcemanager.organizations.get",
    "resourcemanager.organizations.getIamPolicy",
    "resourcemanager.organizations.setIamPolicy",
    "resourcemanager.projects.get",
    "resourcemanager.projects.getIamPolicy",
    "resourcemanager.projects.list",
    "resourcemanager.projects.setIamPolicy"
  ]
}