Prerequisites

Before you begin onboarding your Google Cloud Platform (GCP) environment to Cortex, complete these prerequisites:

1. Ensure you have the necessary permissions.

   • In Cortex, you need a role with Data Sources - View & Edit permissions. This permission lets you add and configure cloud accounts. It is included with the Instance Administrator, Security Admin, and IT Admin roles.
   • In GCP, use an administrator account with the required GCP permissions.
2. Enable the necessary APIs in the GCP project you are onboarding.
3. Identify and set your target project.
4. Decide on a resource naming convention. You will name service accounts, custom roles, and Pub/Sub topics. Use the Configuration values reference to record these values.

P.1 Grant required admin GCP permissions for Cortex onboarding

Save the following template as a JSON file and use it to create a custom role with the permissions required for onboarding GCP to Cortex:

{
  "title": "CortexCloudOnboarding",
  "description": "Custom role with permissions required for onboarding Cortex Cloud",
  "stage": "GA",
  "includedPermissions": [
    "iam.roles.create",
    "iam.roles.delete",
    "iam.roles.get",
    "iam.roles.list",
    "iam.roles.update",
    "iam.serviceAccounts.create",
    "iam.serviceAccounts.delete",
    "iam.serviceAccounts.get",
    "iam.serviceAccounts.getIamPolicy",
    "iam.serviceAccounts.list",
    "iam.serviceAccounts.setIamPolicy",
    "iam.serviceAccounts.update",
    "logging.sinks.create",
    "logging.sinks.delete",
    "logging.sinks.get",
    "logging.sinks.update",
    "pubsub.subscriptions.create",
    "pubsub.subscriptions.delete",
    "pubsub.subscriptions.getIamPolicy",
    "pubsub.subscriptions.setIamPolicy",
    "pubsub.subscriptions.update",
    "pubsub.topics.create",
    "pubsub.topics.delete",
    "pubsub.topics.getIamPolicy",
    "pubsub.topics.setIamPolicy",
    "pubsub.topics.update",
    "resourcemanager.projects.get",
    "resourcemanager.projects.getIamPolicy",
    "resourcemanager.projects.setIamPolicy"
  ]
}

To create a custom role with these permissions, run the following in Cloud Shell:

gcloud iam roles create <ROLE_ID> --project=<PROJECT_ID> \
    --file=<JSON_FILE_PATH>

Where:

• <ROLE_ID> is your chosen name for the role
• <PROJECT_ID> is the ID of the GCP project you are onboarding to Cortex
• <JSON_FILE_PATH> is the file path and file name of the JSON file containing the permissions template

To grant the custom role to the user performing the onboarding, run the following in Cloud Shell:

gcloud projects add-iam-policy-binding <PROJECT_ID> \
    --member="user:<USER_EMAIL>" \
    --role="<ROLE_ID>"

Where:

• <PROJECT_ID> is the ID of the GCP project you are onboarding to Cortex
• <USER_EMAIL> is the email address of the user who will be performing the onboarding
• <ROLE_ID> is your chosen name for the role

P.2 Enable necessary APIs in GCP

Ensure that the following APIs are enabled in the GCP project you are onboarding. You can enable them using the gcloud CLI.

API name	Service name (for CLI)	Required?
Cloud Resource Manager API	cloudresourcemanager.googleapis.com	Required
Identity and Access Management (IAM) API	iam.googleapis.com	Required
Cloud Pub/Sub API	pubsub.googleapis.com	Required if audit log collection will be enabled
Kubernetes Engine API	container.googleapis.com	Required if automation will be enabled as an additional security capability
Compute Engine API	compute.googleapis.com	Required if automation will be enabled as an additional security capability
Service Usage API	serviceusage.googleapis.com	Required if automation will be enabled as an additional security capability
Cloud Storage API	storage-api.googleapis.com	Required if automation will be enabled as an additional security capability

P.2.1 Enable APIs using Cloud Shell

To enable an API, run the following command in your terminal:

gcloud services enable <SERVICE_NAME>

Where <SERVICE_NAME> is the name of the service you want to enable.

You can enable multiple services at once by passing all services names in a single command:

gcloud services enable cloudresourcemanager.googleapis.com iam.googleapis.com pubsub.googleapis.com container.googleapis.com compute.googleapis.com serviceusage.googleapis.com storage-api.googleapis.com

P.3 Identify and set your target project

1. Identify your target project and retain the ID numbers as they will be required throughout the onboarding process.

   • <PROJECT_ID>: The ID of the GCP project you are onboarding.
2. Set your target project. Your target project is the host project where service accounts are created. In Google Cloud Shell or your local terminal, run:

gcloud config set project <PROJECT_ID>

Where <PROJECT_ID> is the ID of the GCP project you are onboarding to Cortex.

---