> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-folder-scope/prerequisites.md). # Prerequisites Before you begin to onboard your Google Cloud Platform (GCP) environment to Cortex, ensure that: 1. Ensure you have the necessary permissions: * In Cortex, you must have a Cortex role with Data Sources - View & Edit permissions (to add/configure cloud accounts in Cortex). This role is included in the following built-in roles: Instance Administrator, Security Admin, and IT Admin. * In GCP, you must have an admin user with the required GCP permissions. 2. Enable the necessary APIs in the GCP project you are onboarding. 3. You identify and set your target project. 4. Decide on your resource naming convention. Throughout this manual onboarding process, you will need to choose your own names for service accounts, custom roles, and Pub/Sub topics. Use the Configuration values reference to keep track of the names as you will need to refer to them throughout the process. ### P.1 Grant required admin GCP permissions for Cortex onboarding Save the following template as a JSON file and use it to create a custom role with the permissions required for onboarding GCP to Cortex: ```json { "title": "CortexCloudOnboarding", "description": "Custom role with permissions required for onboarding Cortex Cloud", "stage": "GA", "includedPermissions": [ "iam.roles.create", "iam.roles.delete", "iam.roles.get", "iam.roles.list", "iam.roles.update", "iam.serviceAccounts.create", "iam.serviceAccounts.delete", "iam.serviceAccounts.get", "iam.serviceAccounts.getIamPolicy", "iam.serviceAccounts.list", "iam.serviceAccounts.setIamPolicy", "iam.serviceAccounts.update", "logging.sinks.create", "logging.sinks.delete", "logging.sinks.get", "logging.sinks.update", "pubsub.subscriptions.create", "pubsub.subscriptions.delete", "pubsub.subscriptions.getIamPolicy", "pubsub.subscriptions.setIamPolicy", "pubsub.subscriptions.update", "pubsub.topics.create", "pubsub.topics.delete", "pubsub.topics.getIamPolicy", "pubsub.topics.setIamPolicy", "pubsub.topics.update", "resourcemanager.folders.get", "resourcemanager.folders.getIamPolicy", "resourcemanager.folders.list", "resourcemanager.folders.setIamPolicy", "resourcemanager.projects.get", "resourcemanager.projects.getIamPolicy", "resourcemanager.projects.list", "resourcemanager.projects.setIamPolicy" ] } ``` To create a custom role with these permissions in the GCP host project, run the following in Cloud Shell: ```bash gcloud iam roles create --project= --file= ``` Where: * `` is your chosen name for the role * `` is the GCP host project ID where service accounts are created * `` is the file path and file name of the JSON file containing the permissions template To grant the custom role to the user performing the onboarding, run the following in Cloud Shell: ```bash gcloud projects add-iam-policy-binding --member="user: " \ --role="" ``` Where: * `` is the ID of the GCP project you are onboarding to Cortex * `` is the email address of the user who will be performing the onboarding * `` is your chosen name for the role ### P.2 Enable necessary APIs in GCP Ensure that the following APIs are enabled in the GCP project you are onboarding. You can enable them using the gcloud CLI. | API name | Service name (for CLI) | Required? | | ---------------------------------------- | ----------------------------------- | --------------------------------------------------------------------------- | | Cloud Resource Manager API | cloudresourcemanager.googleapis.com | Required | | Identity and Access Management (IAM) API | iam.googleapis.com | Required | | Cloud Pub/Sub API | pubsub.googleapis.com | Required if audit log collection will be enabled | | Kubernetes Engine API | container.googleapis.com | Required if automation will be enabled as an additional security capability | | Compute Engine API | compute.googleapis.com | Required if automation will be enabled as an additional security capability | | Service Usage API | serviceusage.googleapis.com | Required if automation will be enabled as an additional security capability | | Cloud Storage API | storage-api.googleapis.com | Required if automation will be enabled as an additional security capability | #### P.2.1 Enable APIs using Cloud Shell To enable an API, run the following command in your terminal: ```bash gcloud services enable ``` Where `` is the name of the service you want to enable. You can enable multiple services at once by passing all services names in a single command: ```bash gcloud services enable cloudresourcemanager.googleapis.com iam.googleapis.com pubsub.googleapis.com container.googleapis.com compute.googleapis.com serviceusage.googleapis.com storage-api.googleapis.com ``` ### P.3 Identify and set your host project 1. Identify your target scope and retain the ID numbers as they will be required throughout the onboarding process. * ``: The GCP host project ID (where service accounts are created) * ``: The numeric ID of the folder to onboard * ``: The numeric ID of the organization the folder belongs to 2. Set your host project. Your host project is where service accounts are created. In Google Cloud Shell or your local terminal, run: ```bash gcloud config set project ``` where `` is the GCP host project ID where service accounts are created. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-folder-scope/prerequisites.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.