Phase 3: Scanner Service Account
This phase is only required if you enabled one or more of the following capabilities in the GCP onboarding wizard in Cortex:
Registry Scanning
Data Security Posture Management (DSPM)
Serverless Scanning
Note: If these features were selected, any step marked as "Required" in the phase 3 substeps must be completed to ensure the corresponding scanner functions correctly. If none of these capabilities were enabled, you may skip to phase 4.
3.1 Create the Scanner Service Account (Required)
Module: OUTPOST_SCANNER
gcloud iam service-accounts create <SCANNER_SA_NAME> \
--display-name="Cortex Platform Outpost Scanner Service Account" \
--project=<HOST_PROJECT_ID>Where:
<SCANNER_SA_NAME>is your chosen service account ID (e.g., cortex-scanner)<HOST_PROJECT_ID>is the GCP host project ID where service accounts are created
3.2 Grant the Viewer role to the Scanner Service Account (Required)
Module: OUTPOST_SCANNER
Bind at the organization level:
Where:
<SCANNER_SA_NAME>is your chosen service account ID (e.g., cortex-scanner)<HOST_PROJECT_ID>is the GCP host project ID where service accounts are created<ORG_ID>is the numeric ID of the organization to onboard
3.3 DSPM: Scanner Service Account (Optional)
Module: DSPM
Execute the steps in this section if you enabled Data Security Posture Management (DSPM) in the GCP onboarding wizard in Cortex.
3.3.1 Create the DSPM Outpost role
Create at the organization level:
Where:
<DSPM_OUTPOST_ROLE_ID>is your chosen name for the role (e.g. CortexDspmOutpost)<ORG_ID>is the numeric ID of the organization to onboard
3.3.2 Grant the DSPM Outpost role to the Outpost Service Account
Bind at the organization level:
Where:
<ORG_ID>is the numeric ID of the organization to onboard<OUTPOST_SERVICE_ACCOUNT_EMAIL>is the value listed in the identifiers JSON file<DSPM_OUTPOST_ROLE_ID>is your chosen name for the role (e.g. CortexDspmOutpost)
3.3.3 Create the DSPM Scanner Connector role
Create at the organization level:
Where:
<DSPM_SCANNER_CONNECTOR_ROLE_ID>is your chosen name for the role (e.g. CortexDspmScanner)<ORG_ID>is the numeric ID of the organization to onboard
3.3.4 Grant the DSPM Scanner Connector role to the Scanner Service Account
Bind at the organization level:
Where:
<ORG_ID>is the numeric ID of the organization to onboard<SCANNER_SA_NAME>is your chosen service account ID (e.g., cortex-scanner)<HOST_PROJECT_ID>is the GCP host project ID where service accounts are created<DSPM_SCANNER_CONNECTOR_ROLE_ID>is your chosen name for the role (e.g. CortexDspmScanner)
3.3.5 Grant the Storage Object Viewer role to the Scanner Service Account
Bind at the organization level:
Where:
<ORG_ID>is the numeric ID of the organization to onboard<SCANNER_SA_NAME>is your chosen service account ID (e.g., cortex-scanner)<HOST_PROJECT_ID>is the GCP host project ID where service accounts are created
3.3.6 Grant the Service Account Token Creator role to the DSPM Scanner Service Account
Allow the DSPM Scanner Service Account (provided by Cortex) to impersonate the Scanner Service Account:
Where:
<SCANNER_SA_NAME>is your chosen service account ID (e.g., cortex-scanner)<HOST_PROJECT_ID>is the GCP host project ID where service accounts are created<DSPM_SCANNER_SERVICE_ACCOUNT_EMAIL>is the value listed in the identifiers JSON file
3.4 Registry Scanning (Optional)
Module: REGISTRY
Execute the steps in this section if you enabled Registry Scanning in the GCP onboarding wizard in Cortex.
3.4.1 Create the Registry Scanner role
Create at the organization level:
Where:
<REGISTRY_SCANNER_ROLE_ID>is your chosen name for the role (e.g. CortexRegistryScanner)<ORG_ID>is the numeric ID of the organization to onboard
3.4.2 Grant the Registry Scanner role to the Scanner Service Account
Bind at the organization level:
Where:
<ORG_ID>is the numeric ID of the organization to onboard<SCANNER_SA_NAME>is your chosen service account ID (e.g., cortex-scanner)<HOST_PROJECT_ID>is the GCP host project ID where service accounts are created<REGISTRY_SCANNER_ROLE_ID>is your chosen name for the role (e.g. CortexRegistryScanner)
3.4.3 Grant the Service Account Token Creator role to the Registry Scanner Service Account
Where:
<SCANNER_SA_NAME>is your chosen service account ID (e.g., cortex-scanner)<HOST_PROJECT_ID>is the GCP host project ID where service accounts are created<REGISTRY_SCANNER_SERVICE_ACCOUNT_EMAIL>is the value listed in the identifiers JSON file
3.5 Serverless Scanning (Optional)
Module: SERVERLESS
Execute the steps in this section if you enabled Serverless Scanning in the GCP onboarding wizard in Cortex.
3.5.1 Create the Serverless Scanner role
Create at the organization level:
Where:
<SERVERLESS_SCANNER_ROLE_ID>is your chosen name for the role (e.g. CortexServerlessScanner)<ORG_ID>is the numeric ID of the organization to onboard
3.5.2 Grant the Serverless Scanner role to the Scanner Service Account
Bind at the organization level:
Where:
<ORG_ID>is the numeric ID of the organization to onboard<SCANNER_SA_NAME>is your chosen service account ID (e.g., cortex-scanner)<HOST_PROJECT_ID>is the GCP host project ID where service accounts are created<SERVERLESS_SCANNER_ROLE_ID>is your chosen name for the role (e.g. CortexServerlessScanner)
3.5.3 Grant the Service Account Token Creator role to the Serverless Scanner Service Account
Where:
<SCANNER_SA_NAME>is your chosen service account ID (e.g., cortex-scanner)<HOST_PROJECT_ID>is the GCP host project ID where service accounts are created<SERVERLESS_SCANNER_SERVICE_ACCOUNT_EMAIL>is the value listed in the identifiers JSON file
Last updated
Was this helpful?