> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-organization-scope/phase-3-scanner-service-account.md).

# Phase 3: Scanner Service Account

This phase is only required if you enabled one or more of the following capabilities in the GCP onboarding wizard in Cortex:

* Registry Scanning
* Data Security Posture Management (DSPM)
* Serverless Scanning

Note: If these features were selected, any step marked as "Required" in the phase 3 substeps must be completed to ensure the corresponding scanner functions correctly. If none of these capabilities were enabled, you may skip to phase 4.

### 3.1 Create the Scanner Service Account (Required)

Module: OUTPOST\_SCANNER

{% code overflow="wrap" %}

```bash
gcloud iam service-accounts create <SCANNER_SA_NAME> \
  --display-name="Cortex Platform Outpost Scanner Service Account" \
  --project=<HOST_PROJECT_ID>
```

{% endcode %}

Where:

* `<SCANNER_SA_NAME>` is your chosen service account ID (e.g., cortex-scanner)
* `<HOST_PROJECT_ID>` is the GCP host project ID where service accounts are created

### 3.2 Grant the Viewer role to the Scanner Service Account (Required)

Module: OUTPOST\_SCANNER

Bind at the organization level:

```bash
gcloud organizations add-iam-policy-binding <ORG_ID> \
  --member="serviceAccount:<SCANNER_SA_NAME>@<HOST_PROJECT_ID>.iam.gserviceaccount.com" \
  --role="roles/viewer"
```

Where:

* `<SCANNER_SA_NAME>` is your chosen service account ID (e.g., cortex-scanner)
* `<HOST_PROJECT_ID>` is the GCP host project ID where service accounts are created
* `<ORG_ID>` is the numeric ID of the organization to onboard

### 3.3 DSPM: Scanner Service Account (Optional)

Module: DSPM

Execute the steps in this section if you enabled Data Security Posture Management (DSPM) in the GCP onboarding wizard in Cortex.

#### 3.3.1 Create the DSPM Outpost role

Create at the organization level:

```bash
gcloud iam roles create <DSPM_OUTPOST_ROLE_ID> \
  --organization=<ORG_ID> \
  --title="DSPM Outpost Role" \
  --permissions="bigquery.bireservations.get,bigquery.capacityCommitments.get,bigquery.capacityCommitments.list,bigquery.config.get,bigquery.datasets.get,bigquery.datasets.getIamPolicy,bigquery.models.getData,bigquery.models.getMetadata,bigquery.models.list,bigquery.routines.get,bigquery.routines.list,bigquery.tables.export,bigquery.tables.get,bigquery.tables.getData,bigquery.tables.getIamPolicy,bigquery.tables.list,cloudsql.backupRuns.get,bigtable.backups.get,bigtable.backups.list,bigtable.tables.list,bigtable.backups.restore"
```

Where:

* `<DSPM_OUTPOST_ROLE_ID>` is your chosen name for the role (e.g. CortexDspmOutpost)
* `<ORG_ID>` is the numeric ID of the organization to onboard

#### 3.3.2 Grant the DSPM Outpost role to the Outpost Service Account

Bind at the organization level:

{% code overflow="wrap" %}

```bash
gcloud organizations add-iam-policy-binding <ORG_ID> \
  --member="serviceAccount:<OUTPOST_SERVICE_ACCOUNT_EMAIL>" \
  --role="organizations/<ORG_ID>/roles/<DSPM_OUTPOST_ROLE_ID>"
```

{% endcode %}

Where:

* `<ORG_ID>` is the numeric ID of the organization to onboard
* `<OUTPOST_SERVICE_ACCOUNT_EMAIL>` is the value listed in the identifiers JSON file
* `<DSPM_OUTPOST_ROLE_ID>` is your chosen name for the role (e.g. CortexDspmOutpost)

#### 3.3.3 Create the DSPM Scanner Connector role

Create at the organization level:

```bash
gcloud iam roles create <DSPM_SCANNER_CONNECTOR_ROLE_ID> \
  --organization=<ORG_ID> \
  --title="Outpost DSPM Scanner Connector Role" \
  --permissions="cloudsql.backupRuns.create,cloudsql.backupRuns.delete,cloudsql.backupRuns.get,cloudsql.backupRuns.list,bigtable.backups.create,bigtable.backups.delete,bigtable.backups.get,bigtable.backups.list,bigtable.clusters.get,bigtable.clusters.list,bigtable.instances.get,bigtable.instances.list,bigtable.tables.get,bigtable.tables.list"
```

Where:

* `<DSPM_SCANNER_CONNECTOR_ROLE_ID>` is your chosen name for the role (e.g. CortexDspmScanner)
* `<ORG_ID>` is the numeric ID of the organization to onboard

#### 3.3.4 Grant the DSPM Scanner Connector role to the Scanner Service Account

Bind at the organization level:

```bash
gcloud organizations add-iam-policy-binding <ORG_ID> \
  --member="serviceAccount:<SCANNER_SA_NAME>@<HOST_PROJECT_ID>.iam.gserviceaccount.com" \
  --role="organizations/<ORG_ID>/roles/<DSPM_SCANNER_CONNECTOR_ROLE_ID>"
```

Where:

* `<ORG_ID>` is the numeric ID of the organization to onboard
* `<SCANNER_SA_NAME>` is your chosen service account ID (e.g., cortex-scanner)
* `<HOST_PROJECT_ID>` is the GCP host project ID where service accounts are created
* `<DSPM_SCANNER_CONNECTOR_ROLE_ID>` is your chosen name for the role (e.g. CortexDspmScanner)

#### 3.3.5 Grant the Storage Object Viewer role to the Scanner Service Account

Bind at the organization level:

```bash
gcloud organizations add-iam-policy-binding <ORG_ID> \
  --member="serviceAccount:<SCANNER_SA_NAME>@<HOST_PROJECT_ID>.iam.gserviceaccount.com" \
  --role="roles/storage.objectViewer"
```

Where:

* `<ORG_ID>` is the numeric ID of the organization to onboard
* `<SCANNER_SA_NAME>` is your chosen service account ID (e.g., cortex-scanner)
* `<HOST_PROJECT_ID>` is the GCP host project ID where service accounts are created

#### 3.3.6 Grant the Service Account Token Creator role to the DSPM Scanner Service Account

Allow the DSPM Scanner Service Account (provided by Cortex) to impersonate the Scanner Service Account:

```bash
gcloud iam service-accounts add-iam-policy-binding <SCANNER_SA_NAME>@<HOST_PROJECT_ID>.iam.gserviceaccount.com \
  --member="serviceAccount:<DSPM_SCANNER_SERVICE_ACCOUNT_EMAIL>" \
  --role="roles/iam.serviceAccountTokenCreator"
```

Where:

* `<SCANNER_SA_NAME>` is your chosen service account ID (e.g., cortex-scanner)
* `<HOST_PROJECT_ID>` is the GCP host project ID where service accounts are created
* `<DSPM_SCANNER_SERVICE_ACCOUNT_EMAIL>` is the value listed in the identifiers JSON file

### 3.4 Registry Scanning (Optional)

Module: REGISTRY

Execute the steps in this section if you enabled Registry Scanning in the GCP onboarding wizard in Cortex.

#### 3.4.1 Create the Registry Scanner role

Create at the organization level:

{% code overflow="wrap" %}

```bash
gcloud iam roles create <REGISTRY_SCANNER_ROLE_ID> \
  --organization=<ORG_ID> \
  --title="Outpost Registry Scanner Connector Role" \
  --permissions="artifactregistry.repositories.downloadArtifacts"
```

{% endcode %}

Where:

* `<REGISTRY_SCANNER_ROLE_ID>` is your chosen name for the role (e.g. CortexRegistryScanner)
* `<ORG_ID>` is the numeric ID of the organization to onboard

#### 3.4.2 Grant the Registry Scanner role to the Scanner Service Account

Bind at the organization level:

```bash
gcloud organizations add-iam-policy-binding <ORG_ID> \
  --member="serviceAccount:<SCANNER_SA_NAME>@<HOST_PROJECT_ID>.iam.gserviceaccount.com" \
  --role="organizations/<ORG_ID>/roles/<REGISTRY_SCANNER_ROLE_ID>"
```

Where:

* `<ORG_ID>` is the numeric ID of the organization to onboard
* `<SCANNER_SA_NAME>` is your chosen service account ID (e.g., cortex-scanner)
* `<HOST_PROJECT_ID>` is the GCP host project ID where service accounts are created
* `<REGISTRY_SCANNER_ROLE_ID>` is your chosen name for the role (e.g. CortexRegistryScanner)

#### 3.4.3 Grant the Service Account Token Creator role to the Registry Scanner Service Account

{% code overflow="wrap" %}

```bash
gcloud iam service-accounts add-iam-policy-binding <SCANNER_SA_NAME>@<HOST_PROJECT_ID>.iam.gserviceaccount.com \
  --member="serviceAccount:<REGISTRY_SCANNER_SERVICE_ACCOUNT_EMAIL>" \
  --role="roles/iam.serviceAccountTokenCreator"
```

{% endcode %}

Where:

* `<SCANNER_SA_NAME>` is your chosen service account ID (e.g., cortex-scanner)
* `<HOST_PROJECT_ID>` is the GCP host project ID where service accounts are created
* `<REGISTRY_SCANNER_SERVICE_ACCOUNT_EMAIL>` is the value listed in the identifiers JSON file

### 3.5 Serverless Scanning (Optional)

Module: SERVERLESS

Execute the steps in this section if you enabled Serverless Scanning in the GCP onboarding wizard in Cortex.

#### 3.5.1 Create the Serverless Scanner role

Create at the organization level:

```bash
gcloud iam roles create <SERVERLESS_SCANNER_ROLE_ID> \
  --organization=<ORG_ID> \
  --title="Outpost Serverless Scanner Connector Role" \
  --permissions="cloudfunctions.functions.get,cloudfunctions.functions.sourceCodeGet,storage.objects.get"
```

Where:

* `<SERVERLESS_SCANNER_ROLE_ID>` is your chosen name for the role (e.g. CortexServerlessScanner)
* `<ORG_ID>` is the numeric ID of the organization to onboard

#### 3.5.2 Grant the Serverless Scanner role to the Scanner Service Account

Bind at the organization level:

```bash
gcloud organizations add-iam-policy-binding <ORG_ID> \
  --member="serviceAccount:<SCANNER_SA_NAME>@<HOST_PROJECT_ID>.iam.gserviceaccount.com" \
  --role="organizations/<ORG_ID>/roles/<SERVERLESS_SCANNER_ROLE_ID>"
```

Where:

* `<ORG_ID>` is the numeric ID of the organization to onboard
* `<SCANNER_SA_NAME>` is your chosen service account ID (e.g., cortex-scanner)
* `<HOST_PROJECT_ID>` is the GCP host project ID where service accounts are created
* `<SERVERLESS_SCANNER_ROLE_ID>` is your chosen name for the role (e.g. CortexServerlessScanner)

#### 3.5.3 Grant the Service Account Token Creator role to the Serverless Scanner Service Account

```bash
gcloud iam service-accounts add-iam-policy-binding <SCANNER_SA_NAME>@<HOST_PROJECT_ID>.iam.gserviceaccount.com \
  --member="serviceAccount:<SERVERLESS_SCANNER_SERVICE_ACCOUNT_EMAIL>" \
  --role="roles/iam.serviceAccountTokenCreator"
```

Where:

* `<SCANNER_SA_NAME>` is your chosen service account ID (e.g., cortex-scanner)
* `<HOST_PROJECT_ID>` is the GCP host project ID where service accounts are created
* `<SERVERLESS_SCANNER_SERVICE_ACCOUNT_EMAIL>` is the value listed in the identifiers JSON file


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-organization-scope/phase-3-scanner-service-account.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.