> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-3-scanner-service-account.md).

# Phase 3: Scanner Service Account

This phase is only required if you enabled one or more of the following capabilities in the GCP onboarding wizard in Cortex:

* Registry Scanning
* Data Security Posture Management (DSPM)
* Serverless Scanning

Note: If these features were selected, any step marked as "Required" in the phase 3 substeps must be completed to ensure the corresponding scanner functions correctly. If none of these capabilities were enabled, you may skip to phase 4.

### 3.1 Create the Scanner Service Account (Required)

Module: OUTPOST\_SCANNER

```shell
gcloud iam service-accounts create <SCANNER_SA_NAME> \
    --display-name="Cortex Platform Outpost Scanner Service Account"
```

Where `<SCANNER_SA_NAME>` is your chosen service account ID (e.g., cortex-scanner).

### 3.2 Grant the Viewer role to the Scanner Service Account (Required)

Module: OUTPOST\_SCANNER

```shell
gcloud projects add-iam-policy-binding <PROJECT_ID> \
    --member="serviceAccount:<SCANNER_SA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com" \
    --role="roles/viewer"
```

Where:

* `<SCANNER_SA_NAME>` is your chosen service account ID (e.g., cortex-scanner)
* `<PROJECT_ID>` is the ID of the GCP project you are onboarding to Cortex

### 3.3 DSPM: Scanner Service Account (Optional)

Module: DSPM

Execute the steps in this section if you enabled Data Security Posture Management (DSPM) in the GCP onboarding wizard in Cortex.

#### 3.3.1 Create the DSPM Outpost role

{% code overflow="wrap" %}

```shell
gcloud iam roles create <DSPM_OUTPOST_ROLE_ID> \
    --project=<PROJECT_ID> \
    --title="DSPM Outpost Role" \
    --permissions="\
bigquery.bireservations.get,bigquery.capacityCommitments.get,bigquery.capacityCommitments.list,\
bigquery.config.get,bigquery.datasets.get,bigquery.datasets.getIamPolicy,\
bigquery.models.getData,bigquery.models.getMetadata,bigquery.models.list,\
bigquery.routines.get,bigquery.routines.list,\
bigquery.tables.export,bigquery.tables.get,bigquery.tables.getData,\
bigquery.tables.getIamPolicy,bigquery.tables.list,\
cloudsql.backupRuns.get,\
bigtable.backups.get,bigtable.backups.list,bigtable.tables.list,bigtable.backups.restore"
```

{% endcode %}

Where:

* `<DSPM_OUTPOST_ROLE_ID>` is your chosen name for the role (e.g. CortexDspmOutpost)
* `<PROJECT_ID>` is the ID of the GCP project you are onboarding to Cortex

#### 3.3.2 Grant the DSPM Outpost role to the Outpost Service Account

```shell
gcloud projects add-iam-policy-binding <PROJECT_ID> \
    --member="serviceAccount:<OUTPOST_SERVICE_ACCOUNT_EMAIL>" \
    --role="projects/<PROJECT_ID>/roles/<DSPM_OUTPOST_ROLE_ID>"
```

Where:

* `<PROJECT_ID>` is the ID of the GCP project you are onboarding to Cortex
* `<OUTPOST_SERVICE_ACCOUNT_EMAIL>` is the value listed in the identifiers JSON file
* `<DSPM_OUTPOST_ROLE_ID>` is your chosen name for the role (e.g. CortexDspmOutpost)

#### 3.3.3 Create the DSPM Scanner Connector role

{% code overflow="wrap" %}

```shell
gcloud iam roles create <DSPM_SCANNER_CONNECTOR_ROLE_ID> \
    --project=<PROJECT_ID> \
    --title="Outpost DSPM Scanner Connector Role" \
    --permissions="\
cloudsql.backupRuns.create,cloudsql.backupRuns.delete,cloudsql.backupRuns.get,cloudsql.backupRuns.list,\
bigtable.backups.create,bigtable.backups.delete,bigtable.backups.get,bigtable.backups.list,\
bigtable.clusters.get,bigtable.clusters.list,\
bigtable.instances.get,bigtable.instances.list,\
bigtable.tables.get,bigtable.tables.list"
```

{% endcode %}

Where:

* `<DSPM_SCANNER_CONNECTOR_ROLE_ID>` is your chosen name for the role (e.g. CortexDspmScanner)
* `<PROJECT_ID>` is the ID of the GCP project you are onboarding to Cortex

#### 3.3.4 Grant the DSPM Scanner Connector role to the Scanner Service Account

```shell
gcloud projects add-iam-policy-binding <PROJECT_ID> \
    --member="serviceAccount:<SCANNER_SA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com" \
    --role="projects/<PROJECT_ID>/roles/<DSPM_SCANNER_CONNECTOR_ROLE_ID>"
```

Where:

* `<PROJECT_ID>` is the ID of the GCP project you are onboarding to Cortex
* `<SCANNER_SA_NAME>` is your chosen service account ID (e.g., cortex-scanner)
* `<DSPM_SCANNER_CONNECTOR_ROLE_ID>` is your chosen name for the role (e.g. CortexDspmScanner)

#### 3.3.5 Grant the Storage Object Viewer role to the Scanner Service Account

```shell
gcloud projects add-iam-policy-binding <PROJECT_ID> \
    --member="serviceAccount:<SCANNER_SA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com" \
    --role="roles/storage.objectViewer"
```

Where:

* `<PROJECT_ID>` is the ID of the GCP project you are onboarding to Cortex
* `<SCANNER_SA_NAME>` is your chosen service account ID (e.g., cortex-scanner)

#### 3.3.6 Grant the Service Account Token Creator role to the DSPM Scanner Service Account

Allow the DSPM Scanner Service Account (provided by Cortex) to impersonate the Scanner Service Account:

```shell
gcloud iam service-accounts add-iam-policy-binding \
    <SCANNER_SA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com \
    --member="serviceAccount:<DSPM_SCANNER_SERVICE_ACCOUNT_EMAIL>" \
    --role="roles/iam.serviceAccountTokenCreator"
```

Where:

* `<SCANNER_SA_NAME>` is your chosen service account ID (e.g., cortex-scanner)
* `<PROJECT_ID>` is the ID of the GCP project you are onboarding to Cortex
* `<DSPM_SCANNER_SERVICE_ACCOUNT_EMAIL>` is the value listed in the identifiers JSON file

### 3.4 Registry Scanning (Optional)

Module: REGISTRY

Execute the steps in this section if you enabled Registry Scanning in the GCP onboarding wizard in Cortex.

#### 3.4.1 Create the Registry Scanner role

```shell
gcloud iam roles create <REGISTRY_SCANNER_ROLE_ID> \
    --project=<PROJECT_ID> \
    --title="Outpost Registry Scanner Connector Role" \
    --permissions="artifactregistry.repositories.downloadArtifacts"
```

Where:

* `<REGISTRY_SCANNER_ROLE_ID>` is your chosen name for the role (e.g. CortexRegistryScanner)
* `<PROJECT_ID>` is the ID of the GCP project you are onboarding to Cortex

#### 3.4.2 Grant the Registry Scanner role to the Scanner Service Account

```shell
gcloud projects add-iam-policy-binding <PROJECT_ID> \
    --member="serviceAccount:<SCANNER_SA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com" \
    --role="projects/<PROJECT_ID>/roles/<REGISTRY_SCANNER_ROLE_ID>"
```

Where:

* `<PROJECT_ID>` is the ID of the GCP project you are onboarding to Cortex
* `<SCANNER_SA_NAME>` is your chosen service account ID (e.g., cortex-scanner)
* `<REGISTRY_SCANNER_ROLE_ID>` is your chosen name for the role (e.g. CortexRegistryScanner)

#### 3.4.3 Grant the Service Account Token Creator role to the Registry Scanner Service Account

```shell
gcloud iam service-accounts add-iam-policy-binding \
    <SCANNER_SA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com \
    --member="serviceAccount:<REGISTRY_SCANNER_SERVICE_ACCOUNT_EMAIL>" \
    --role="roles/iam.serviceAccountTokenCreator"
```

Where:

* `<SCANNER_SA_NAME>` is your chosen service account ID (e.g., cortex-scanner)
* `<PROJECT_ID>` is the ID of the GCP project you are onboarding to Cortex
* `<REGISTRY_SCANNER_SERVICE_ACCOUNT_EMAIL>` is the value listed in the identifiers JSON file

### 3.5 Serverless Scanning (Optional)

Module: SERVERLESS

Execute the steps in this section if you enabled Serverless Scanning in the GCP onboarding wizard in Cortex.

#### 3.5.1 Create the Serverless Scanner role

```shell
gcloud iam roles create <SERVERLESS_SCANNER_ROLE_ID> \
    --project=<PROJECT_ID> \
    --title="Outpost Serverless Scanner Connector Role" \
    --permissions="\
cloudfunctions.functions.get,\
cloudfunctions.functions.sourceCodeGet,\
storage.objects.get"
```

Where:

* `<SERVERLESS_SCANNER_ROLE_ID>` is your chosen name for the role (e.g. CortexServerlessScanner)
* `<PROJECT_ID>` is the ID of the GCP project you are onboarding to Cortex

#### 3.5.2 Grant the Serverless Scanner role to the Scanner Service Account

```shell
gcloud projects add-iam-policy-binding <PROJECT_ID> \
    --member="serviceAccount:<SCANNER_SA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com" \
    --role="projects/<PROJECT_ID>/roles/<SERVERLESS_SCANNER_ROLE_ID>"
```

Where:

* `<PROJECT_ID>` is the ID of the GCP project you are onboarding to Cortex
* `<SCANNER_SA_NAME>` is your chosen service account ID (e.g., cortex-scanner)
* `<SERVERLESS_SCANNER_ROLE_ID>` is your chosen name for the role (e.g. CortexServerlessScanner)

#### 3.5.3 Grant the Service Account Token Creator role to the Serverless Scanner Service Account

```shell
gcloud iam service-accounts add-iam-policy-binding \
    <SCANNER_SA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com \
    --member="serviceAccount:<SERVERLESS_SCANNER_SERVICE_ACCOUNT_EMAIL>" \
    --role="roles/iam.serviceAccountTokenCreator"
```

Where:

* `<SCANNER_SA_NAME>` is your chosen service account ID (e.g., cortex-scanner)
* `<PROJECT_ID>` is the ID of the GCP project you are onboarding to Cortex
* `<SERVERLESS_SCANNER_SERVICE_ACCOUNT_EMAIL>` is the value listed in the identifiers JSON file


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/phase-3-scanner-service-account.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.