> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/monitor-gcp-resources-inside-service-perimeters.md).

# Monitor GCP resources inside service perimeters

Learn how to grant authorization to Cortex XDR to scan within your GCP service perimeter.

A service perimeter can provide an additional layer of security for your GCP projects. It serves as a fortified boundary around your Google Cloud resources. While resources inside the perimeter can communicate freely, the perimeter is designed to prevent unauthorized communication to Google Cloud services beyond its confines.

To enable Cortex XDR to scan assets and resources within your GCP perimeter, you must authorize Cortex XDR's identities to access the perimeter from within GCP. If you have a perimeter set up in your GCP project and you have not authorized Cortex XDR's identities to scan the perimeter, you will receive the following error:

```varname
Request is prohibited by organization's policy. vpcServiceControlsUniqueIdentifier: {{<GCP-perimeter-ID>}}
```

{% hint style="info" %}
**Note:** Each GCP cloud instance is assigned a scope within GCP. If the scope, whether it be organization, folder, or project, includes any projects with a service perimeter, this procedure must be performed for that cloud instance to authorize Cortex XDR to scan the resources in the perimeter.
{% endhint %}

### Projects to include in the service perimeter <a href="#projects-to-include-in-the-service-perimeter" id="projects-to-include-in-the-service-perimeter"></a>

Enterprise GCP environments using VPC Service Controls must include all GCP projects that communicate with Cortex XDR in the service perimeter. Depending on your scan mode and enabled security capabilities, this includes more than one project.

#### Customer-owned projects <a href="#customer-owned-projects" id="customer-owned-projects"></a>

Include the following projects that you own:

| Project                       | Description                                                                                                                                                                                                              |
| ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Your monitored GCP project(s) | Every GCP project that Cortex XDR is configured to monitor. If your cloud instance scope is an organization or folder, this includes all projects within that scope.                                                     |
| Your outpost project          | If you are using **Scan with Outpost** mode, include the dedicated GCP project where the Cortex Outpost infrastructure is deployed. You can find this project ID in the Cortex XDR **Authorization Details** dialog box. |

#### Cortex XDR-owned projects <a href="#cortex-owned-projects" id="cortex-owned-projects"></a>

Include the following Cortex XDR-managed GCP projects. The exact project numbers for your tenant are listed in the **Authorization Details** dialog box in Cortex XDR (see [Obtain Cortex XDR identity details](#obtain-cortex-cloud-identity-details) below).

| Project                 | Description                                                                                                                                               | Scan mode                   |
| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------- |
| Cortex Platform project | The Cortex XDR platform project that hosts the `cts-pod` service account. This is the primary Cortex XDR identity that initiates all scanning operations. | Cloud Scan and Outpost Scan |
| Cortex Outpost project  | The Cortex XDR-managed GCP project that hosts the scanning infrastructure (Compute Engine VMs, Pub/Sub, Cloud Storage).                                   | Cloud Scan mode only        |
|                         |                                                                                                                                                           |                             |

{% hint style="info" %}
**Identify the Cortex XDR-owned projects.** Each Cortex XDR service account email contains the project it belongs to: the portion between `@` and `.iam.gserviceaccount.com`. For example, a CTS service account of `cts-pod@xdr-eu-<tenant-id>.iam.gserviceaccount.com` identifies the Cortex Platform project as `xdr-eu-<tenant-id>`. All platform service accounts share this project, and all scanning service accounts share the Cortex Outpost project, identified the same way from the Cortex Engine service account email.
{% endhint %}

### Service accounts to authorize <a href="#service-accounts-to-authorize" id="service-accounts-to-authorize"></a>

The service accounts that require authorization depend on your scan mode and the security capabilities you have enabled. All service account emails for your specific tenant are listed in the **Authorization Details** dialog box.

#### Platform service account (all configurations) <a href="#platform-service-account-all-configurations" id="platform-service-account-all-configurations"></a>

| Service account     | Format                                                      | Direction          | Purpose                                                                                                |
| ------------------- | ----------------------------------------------------------- | ------------------ | ------------------------------------------------------------------------------------------------------ |
| CTS service account | `cts-pod@<cortex-platform-project>.iam.gserviceaccount.com` | Ingress and Egress | Cortex XDR platform identity that impersonates the Cortex Engine service account to initiate scanning. |

#### Outpost service accounts (Scan with Outpost mode) <a href="#outpost-service-accounts-scan-with-outpost-mode" id="outpost-service-accounts-scan-with-outpost-mode"></a>

If you are using **Scan with Outpost** mode, the following additional service accounts in the Outpost project must be authorized:

| Service account      | Format                                                                 | Direction | Purpose                                                                                                                                                                |
| -------------------- | ---------------------------------------------------------------------- | --------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Cortex Engine        | `cortex-engine@<outpost-project>.iam.gserviceaccount.com`              | Egress    | Unified service account for all Outpost operations. The CTS service account impersonates this identity.                                                                |
| Collector            | `collector-<project-number>@<outpost-project>.iam.gserviceaccount.com` | Egress    | Collects data from monitored GCP resources.                                                                                                                            |
| DSPM Scan Runner     | `dspm-scan-runner@<outpost-project>.iam.gserviceaccount.com`           | Egress    | Runs Data Security Posture Management (DSPM) scanning instances. Required if DSPM is enabled.                                                                          |
| Registry Scan Runner | `registry-scan-runner@<outpost-project>.iam.gserviceaccount.com`       | Egress    | Runs container registry scanning instances. Required if Registry Scanning is enabled.                                                                                  |
| Serverless Scanner   | `scanner-of-runner@<outpost-project>.iam.gserviceaccount.com`          | Egress    | Runs serverless function scanning instances. Required if Serverless Scanning is enabled. Note: Serverless scanning is uncommon in environments using Google Cloud Run. |

#### Audit log service account (if audit log collection is enabled) <a href="#audit-log-service-account-if-audit-log-collection-is-enabled" id="audit-log-service-account-if-audit-log-collection-is-enabled"></a>

| Service account            | Format                                                    | Direction | Purpose                                                           |
| -------------------------- | --------------------------------------------------------- | --------- | ----------------------------------------------------------------- |
| Audit Logs Service Account | `crtx-al-<suffix>@<your-project>.iam.gserviceaccount.com` | Ingress   | Subscribes to the Pub/Sub subscription to collect GCP audit logs. |

### Obtain Cortex XDR identity details

1. In your Cortex XDR tenant, select **Settings → Data Sources & Integrations**.
2. Hover over the Google Cloud Platform (GCP) row and select **View Details**.
3. In the Cloud Instances page, identify the GCP instance with the perimeter, right-click it and select **Details**.
4. In the details pane, click the **more options** icon and select **Authorization Details**.
5. The **Authorization Details** dialog box lists all service account emails and project numbers you need to add as approved identities in GCP.

### Add Cortex XDR authorization values to GCP perimeter

1. Log into [Google Cloud Platform Console](https://console.cloud.google.com/).
2. Navigate to VPC Service Controls.
3. In the list of perimeters, select the perimeter to which you want to grant access to Cortex XDR.
4. In the **Service perimeter details** screen, click **Edit**.
5. In the **Edit service perimeter** screen, select **Ingress policy**.
6. In the **Ingress rules** pane, click **Add an ingress rule**.
7. Enter a **Title** for the ingress rule.
8. In the **From** section, under **Identities**, select **Select identities & groups**.
9. Click **Add identities**. In the **Add identities** pane, under **Search identities**, paste Cortex discovery role from Cortex XDR's **Authorization Details** dialog box. If there are more authorized values, paste each of them under **Search identities**. Click **Add identities**.
10. In the **To section**, under **Resources**, select **Select projects**.
11. Click **Add projects**. In the **Add projects** pane, select the relevant projects.
12. Under **Operations or IAM roles**, select **All operations**.
13. Click **Next** to add an egress rule.
14. In the **Egress rules** pane, click **Add an egress rule**.
15. Enter a **Title** for the egress rule.
16. In the **From** section, under **Identities**, select **Select identities & groups**.
17. Click **Add identities**. In the **Add identities** pane, under **Search identities**, paste Cortex discovery role from Cortex XDR's **Authorization Details** dialog box. If there are more authorized values, paste each of them under **Search identities**. Click **Add identities**.
18. In the **To** section, under **Resources**, select **Select projects**.
19. Click **Add projects**. In the **Add projects** pane, select the relevant projects.
20. Click **Save**. Confirm the changes and click **Confirm**.

#### Add Cortex-owned projects to the perimeter <a href="#add-cortex-owned-projects-to-the-perimeter" id="add-cortex-owned-projects-to-the-perimeter"></a>

To allow Cortex XDR's scanning infrastructure to communicate with your protected resources, you must also add the Cortex-owned projects to the perimeter as allowed resources:

1. In the **Service perimeter details** screen, click **Edit**.
2. Under **Resources**, click **Add resources**.
3. Add the Cortex XDR Platform project and, if applicable, the Cortex XDR Outpost project using the numeric project numbers from the **Authorization Details** dialog box.
4. Click **Save** and confirm.

The Cortex XDR authorization values have been added as approved identities in GCP.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/monitor-gcp-resources-inside-service-perimeters.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.