Overview of the onboarding process

The following table lists every step in the procedure for manually onboarding Google Cloud Platform (GCP). Use it as a checklist to track your progress. Steps marked as Required must be completed for every onboarding. Optional steps depend on the Cortex security capabilities you choose to enable.

Step	Procedure	Required?	Required for capability	Platform
Prerequisites
P.1	Grant required admin GCP permissions for Cortex onboarding	Required		GCP
P.2	Enable necessary APIs in GCP	Required		GCP
P.3	Identify and set your host project	Required		GCP
Phase 1: Set GCP cloud instance in Cortex
1.1.	Start the GCP onboarding wizard	Required		Cortex
1.2	Download the customized identifiers file	Required		Cortex
Phase 2: Deploy platform service account
2.1	Create the Platform Service Account	Required		GCP
2.2	Grant predefined managed roles to the Platform Service Account	Required	Assets Discovery	GCP
2.3	Create the Custom role and grant it to the Platform Service Account	Required	Assets Discovery	GCP
2.4	Grant the Service Account Token Creator role to the Outpost Service Account	Required		GCP
2.5	Agentless Disk Scanning (ADS)	Optional	Agentless Disk Scanning	GCP
2.5.1	Create the ADS Connector Role	Optional	Agentless Disk Scanning	GCP
2.5.2	Grant the ADS Connector role to the Platform Service Account	Optional	Agentless Disk Scanning	GCP
2.5.3	Create the ADS Outpost role	Optional	Agentless Disk Scanning	GCP
2.5.4	Grant the ADS Outpost role to the Outpost Service Account	Optional	Agentless Disk Scanning	GCP
2.6	Automation	Optional	Automation	GCP
2.6.1	Create the Automation role	Optional	Automation	GCP
2.6.2	Grant the Automation role to the Platform Service Account	Optional	Automation	GCP
2.7	DSPM: Platform Service Account	Optional	DSPM	GCP
2.7.1	Create the DSPM Connector role	Optional	DSPM	GCP
2.7.2	Grant the DSPM Connector role to the Platform Service Account	Optional	DSPM	GCP
Phase 3: Deploy scanner service account
3.1	Create the Scanner Service Account	Required if any scanning capability is enabled	Registry Scanning, DSPM, Serverless Scanning	GCP
3.2	Grant the Viewer role to the Scanner Service Account	Required if any scanning capability is enabled	Registry Scanning, DSPM, Serverless Scanning	GCP
3.3	DSPM: Scanner Service Account	Optional	DSPM	GCP
3.3.1	Create the DSPM Outpost role	Optional	DSPM	GCP
3.3.2	Grant the DSPM Outpost role to the Outpost Service Account	Optional	DSPM	GCP
3.3.3	Create the DSPM Scanner Connector role	Optional	DSPM	GCP
3.3.4	Grant the DSPM Scanner Connector role to the Scanner Service Account	Optional	DSPM	GCP
3.3.5	Grant the Storage Object Viewer role to the Scanner Service Account	Optional	DSPM	GCP
3.3.6	Grant the Service Account Token Creator role to the DSPM Scanner Service Account	Optional	DSPM	GCP
3.4	Registry Scanning	Optional	Registry Scanning	GCP
3.4.1	Create the Registry Scanner role	Optional	Registry Scanning	GCP
3.4.2	Grant the Registry Scanner role to the Scanner Service Account	Optional	Registry Scanning	GCP
3.4.3	Grant the Service Account Token Creator role to the Registry Scanner Service Account	Optional	Registry Scanning	GCP
3.5	Serverless Scanning	Optional	Serverless Scanning	GCP
3.5.1	Create the Serverless Scanner role	Optional	Serverless Scanning	GCP
3.5.2	Grant the Serverless Scanner role to the Scanner Service Account	Optional	Serverless Scanning	GCP
3.5.3	Grant the Service Account Token Creator role to the Serverless Scanner Service Account	Optional	Serverless Scanning	GCP
Phase 4: Connect audit logs
4	Audit Logs	Optional	Audit Logs	GCP
4.1	Create a Pub/Sub Topic to collect and stream audit logs	Optional	Audit Logs	GCP
4.2	Create a Pub/Sub Subscription for the audit log topic	Optional	Audit Logs	GCP
4.3	Create a Logging Sink to export audit logs to your Pub/Sub topic	Optional	Audit Logs	GCP
4.3.1	Retrieve the Writer Identity (Service Account) generated for your new Logging Sink	Optional	Audit Logs	GCP
4.4	Grant the Pub/Sub Publisher role to the Writer Identity	Optional	Audit Logs	GCP
4.5	Create the Audit Logs Service Account	Optional	Audit Logs	GCP
4.6	Grant the Pub/Sub Subscriber role to the Audit Service Account	Optional	Audit Logs	GCP
4.7	Grant the Service Account Token Creator role to the SaaS Collector Service Account	Optional	Audit Logs	GCP
Phase 5: Complete the GCP onboarding wizard in Cortex
5.1	Enter the GCP scope details and service accounts in Cortex	Required		Cortex
5.2	Complete onboarding	Required		Cortex