> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/monitor-gcp-resources-inside-service-perimeters.md).

# Monitor GCP resources inside service perimeters

A service perimeter can provide an additional layer of security for your GCP projects. It serves as a fortified boundary around your Google Cloud resources. While resources inside the perimeter can communicate freely, the perimeter is designed to prevent unauthorized communication to Google Cloud services beyond its confines.

To enable Cortex Cloud to scan assets and resources within your GCP perimeter, you must authorize Cortex Cloud's identities to access the perimeter from within GCP. If you have a perimeter set up in your GCP project and you have not authorized Cortex Cloud's identities to scan the perimeter, you will receive the following error:

```varname
Request is prohibited by organization's policy. vpcServiceControlsUniqueIdentifier: {{<GCP-perimeter-ID>}}
```

{% hint style="info" %}

#### **Note**

Each GCP cloud instance is assigned a scope within GCP. If the scope, whether it be organization, folder, or project, includes any projects with a service perimeter, this procedure must be performed for that cloud instance to authorize Cortex Cloud to scan the resources in the perimeter.
{% endhint %}

### Obtain Cortex Cloud identity details

1. In your Cortex Cloud tenant, select **Settings → Data Sources & Integrations**.
2. Hover over the Google Cloud Platform (GCP) row and select **View Details**.
3. In the Cloud Instances page, identify the GCP instance with the perimeter, right-click it and select **Details**.
4. In the details pane, click the **more options** icon and select **Authorization Details**.
5. The authorization values that you need to add as approved identities in GCP are listed in the **Authorization Details** dialog box.

### Add Cortex Cloud authorization values to GCP perimeter

1. Log into [Google Cloud Platform Console](https://console.cloud.google.com/).
2. Navigate to VPC Service Controls.
3. In the list of perimeters, select the perimeter to which you want to grant access to Cortex Cloud.
4. In the **Service perimeter details** screen, click **Edit**.
5. In the **Edit service perimeter** screen, select **Ingress policy**.
6. In the **Ingress rules** pane, click **Add an ingress rule**.
7. Enter a **Title** for the ingress rule.
8. In the **From** section, under **Identities**, select **Select identities & groups**.
9. Click **Add identities**. In the **Add identities** pane, under **Search identities**, paste Cortex discovery role from Cortex Cloud's **Authorization Details** dialog box. If there are more authorized values, paste each of them under **Search identities**. Click **Add identities**.
10. In the **To section**, under **Resources**, select **Select projects**.
11. Click **Add projects**. In the **Add projects** pane, select the relevant projects.
12. Under **Operations or IAM roles**, select **All operations**.
13. Click **Next** to add an egress rule.
14. In the **Egress rules** pane, click **Add an egress rule**.
15. Enter a **Title** for the egress rule.
16. In the **From** section, under **Identities**, select **Select identities & groups**.
17. Click **Add identities**. In the **Add identities** pane, under **Search identities**, paste Cortex discovery role from Cortex Cloud's **Authorization Details** dialog box. If there are more authorized values, paste each of them under **Search identities**. Click **Add identities**.
18. In the **To** section, under **Resources**, select **Select projects**.
19. Click **Add projects**. In the **Add projects** pane, select the relevant projects.
20. Click **Save**. Confirm the changes and click **Confirm**.

The Cortex Cloud authorization values have been added as approved identities in GCP.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/monitor-gcp-resources-inside-service-perimeters.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.