Phase 2: Platform service accounts
Phase 2: Platform service accounts
This phase creates the main service account used by Cortex to monitor your GCP resources.
Note: All GCP resources that support labels must include the following labels: managed_by=paloaltonetworks Any additional labels you configured in the GCP onboarding wizard in Cortex.
To add a label to a GCP resource, use the label flag:
--labels managed_by=paloaltonetworks,<your_key>=<your_value>2.1 Create the Platform Service Account (Required)
Create a service account in the host project that Cortex will use as the primary identity for accessing your resources.
gcloud iam service-accounts create <PLATFORM_SA_NAME> \
--display-name="Cortex Platform Service Account" \
--project=<HOST_PROJECT_ID>Where:
<PLATFORM_SA_NAME>is your chosen service account ID (e.g., cortex-platform)<HOST_PROJECT_ID>is the GCP host project ID where service accounts are created
2.2 Grant predefined managed roles to the Platform Service Account (Required)
Module: Assets Discovery
Bind the following predefined roles to the platform service account at the organization level:
Where:
<PLATFORM_SA_NAME>is the Platform Service Account name<HOST_PROJECT_ID>is the GCP host project ID where service accounts are created<ORG_ID>is the numeric ID of the organization to onboard
After running the last command, the following prompt is displayed:
Choose "None" by entering 2.
2.3 Create the Custom Role and grant it to the Platform Service Account (Required)
Module: Assets Discovery
Create a custom role at the organization level with granular permissions not covered by the built-in roles.
2.3.1 Create the Custom Role
Where <CLOUD_VIEWER_ROLE_ID> is your chosen role ID (e.g., CortexCloudViewer).
2.3.2 Grant the Custom Role to the Platform Service Account
Bind at the organization level:
Where:
<ORG_ID>is the numeric ID of the organization to onboard<PLATFORM_SA_NAME>is the Platform Service Account name<HOST_PROJECT_ID>is the GCP host project ID where service accounts are created<CLOUD_VIEWER_ROLE_ID>is your chosen role ID (e.g., CortexCloudViewer)
2.4 Grant the Service Account Token Creator role to the Outpost Service Account (Required)
Allow the Outpost Service Account (provided by Cortex) to impersonate the Platform Service Account:
Where:
<PLATFORM_SA_NAME>is the Platform Service Account name<HOST_PROJECT_ID>is the GCP host project ID where service accounts are created<OUTPOST_SERVICE_ACCOUNT_EMAIL>is the value listed in the identifiers JSON file
2.5 Agentless Disk Scanning (ADS) (Optional)
Module: ADS
Execute the steps in this section if you enabled Agentless Disk Scanning in the GCP onboarding wizard in Cortex.
2.5.1 Create the ADS Connector Role
Create at the organization level:
Where:
<ADS_CONNECTOR_ROLE_ID>is your chosen role ID (e.g., CortexAdsConnector)<ORG_ID>is the numeric ID of the organization to onboard
2.5.2 Grant the ADS Connector role to the Platform Service Account
Grant the ADS Connector role to the Platform Service Account at the organization level and apply an IAM condition to restrict permissions to resources prefixed with cortex-scan-*:
Where:
<ORG_ID>is the numeric ID of the organization to onboard<PLATFORM_SA_NAME>is the Platform Service Account name<HOST_PROJECT_ID>is the GCP host project ID where service accounts are created<ADS_CONNECTOR_ROLE_ID>is your chosen role ID (e.g., CortexAdsConnector)
2.5.3 Create the ADS Outpost role
Create at the organization level:
Where:
<ADS_OUTPOST_ROLE_ID>is your chosen role ID (e.g., CortexAdsOutpost)<ORG_ID>is the numeric ID of the organization to onboard
2.5.4 Grant the ADS Outpost role to the Outpost Service Account
Grant the ADS Outpost role to the Outpost Service Account at the organization level and apply an IAM condition to restrict permissions to resources prefixed with cortex-scan-*:
Where:
<ORG_ID>is the numeric ID of the organization to onboard<OUTPOST_SERVICE_ACCOUNT_EMAIL>is the value listed in the identifiers JSON file<ADS_OUTPOST_ROLE_ID>is your chosen role ID (e.g., CortexAdsOutpost)
2.6 Automation (Optional)
Module: AUTOMATION
Execute the steps in this section if you enabled Automation in the GCP onboarding wizard in Cortex.
2.6.1 Create the Automation role
Create at the organization level:
Where:
<AUTOMATION_ROLE_ID>is your chosen name for the role (e.g. CortexAutomation)<ORG_ID>is the numeric ID of the organization to onboard
2.6.2 Grant the Automation role to the Platform Service Account
Bind at the organization level:
Where:
<ORG_ID>is the numeric ID of the organization to onboard<PLATFORM_SA_NAME>is the Platform Service Account name<HOST_PROJECT_ID>is the GCP host project ID where service accounts are created<AUTOMATION_ROLE_ID>is your chosen name for the role (e.g. CortexAutomation)
2.7 DSPM: Platform Service Account (Optional)
Module: DSPM
Execute the steps in this section if you enabled Data Security Posture Management (DSPM) in the GCP onboarding wizard in Cortex.
2.7.1 Create the DSPM Connector role
Create at the organization level:
Where:
<DSPM_CONNECTOR_ROLE_ID>is your chosen name for the role (e.g. CortexDspmConnector)<ORG_ID>is the numeric ID of the organization to onboard
2.7.2 Grant the DSPM Connector role to the Platform Service Account
Bind at the organization level:
Where:
<ORG_ID>is the numeric ID of the organization to onboard<PLATFORM_SA_NAME>is the Platform Service Account name<HOST_PROJECT_ID>is the GCP host project ID where service accounts are created<DSPM_CONNECTOR_ROLE_ID>is your chosen name for the role (e.g. CortexDspmConnector)
Last updated
Was this helpful?