> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/prerequisites.md). # Prerequisites Before you begin onboarding your Google Cloud Platform (GCP) environment to Cortex, complete these prerequisites: 1. **Ensure you have the necessary permissions.** * In Cortex, you need a role with **Data Sources - View & Edit** permissions. This permission lets you add and configure cloud accounts. It is included with the Instance Administrator, Security Admin, and IT Admin roles. * In GCP, use an administrator account with the required GCP permissions. 2. Enable the necessary APIs in the GCP project you are onboarding. 3. Identify and set your target project. 4. Decide on a resource naming convention. You will name service accounts, custom roles, and Pub/Sub topics. Use the [Configuration values reference](/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/configuration-values-reference.md) to record these values. ### P.1 Grant required admin GCP permissions for Cortex onboarding Save the following template as a JSON file and use it to create a custom role with the permissions required for onboarding GCP to Cortex: ```json { "title": "CortexCloudOnboarding", "description": "Custom role with permissions required for onboarding Cortex Cloud", "stage": "GA", "includedPermissions": [ "iam.roles.create", "iam.roles.delete", "iam.roles.get", "iam.roles.list", "iam.roles.update", "iam.serviceAccounts.create", "iam.serviceAccounts.delete", "iam.serviceAccounts.get", "iam.serviceAccounts.getIamPolicy", "iam.serviceAccounts.list", "iam.serviceAccounts.setIamPolicy", "iam.serviceAccounts.update", "logging.sinks.create", "logging.sinks.delete", "logging.sinks.get", "logging.sinks.update", "pubsub.subscriptions.create", "pubsub.subscriptions.delete", "pubsub.subscriptions.getIamPolicy", "pubsub.subscriptions.setIamPolicy", "pubsub.subscriptions.update", "pubsub.topics.create", "pubsub.topics.delete", "pubsub.topics.getIamPolicy", "pubsub.topics.setIamPolicy", "pubsub.topics.update", "resourcemanager.projects.get", "resourcemanager.projects.getIamPolicy", "resourcemanager.projects.setIamPolicy" ] } ``` To create a custom role with these permissions, run the following in Cloud Shell: ```shell gcloud iam roles create --project= \ --file= ``` Where: * `` is your chosen name for the role * `` is the ID of the GCP project you are onboarding to Cortex * `` is the file path and file name of the JSON file containing the permissions template To grant the custom role to the user performing the onboarding, run the following in Cloud Shell: ```shell gcloud projects add-iam-policy-binding \ --member="user:" \ --role="" ``` Where: * `` is the ID of the GCP project you are onboarding to Cortex * `` is the email address of the user who will be performing the onboarding * `` is your chosen name for the role ### P.2 Enable necessary APIs in GCP Ensure that the following APIs are enabled in the GCP project you are onboarding. You can enable them using the gcloud CLI. | API name | Service name (for CLI) | Required? | | ---------------------------------------- | ----------------------------------- | --------------------------------------------------------------------------- | | Cloud Resource Manager API | cloudresourcemanager.googleapis.com | Required | | Identity and Access Management (IAM) API | iam.googleapis.com | Required | | Cloud Pub/Sub API | pubsub.googleapis.com | Required if audit log collection will be enabled | | Kubernetes Engine API | container.googleapis.com | Required if automation will be enabled as an additional security capability | | Compute Engine API | compute.googleapis.com | Required if automation will be enabled as an additional security capability | | Service Usage API | serviceusage.googleapis.com | Required if automation will be enabled as an additional security capability | | Cloud Storage API | storage-api.googleapis.com | Required if automation will be enabled as an additional security capability | #### P.2.1 Enable APIs using Cloud Shell To enable an API, run the following command in your terminal: ```shell gcloud services enable ``` Where `` is the name of the service you want to enable. You can enable multiple services at once by passing all services names in a single command: {% code overflow="wrap" %} ```shell gcloud services enable cloudresourcemanager.googleapis.com iam.googleapis.com pubsub.googleapis.com container.googleapis.com compute.googleapis.com serviceusage.googleapis.com storage-api.googleapis.com ``` {% endcode %} ### P.3 Identify and set your target project 1. Identify your target project and retain the ID numbers as they will be required throughout the onboarding process. * ``: The ID of the GCP project you are onboarding. 2. Set your target project. Your target project is the host project where service accounts are created. In Google Cloud Shell or your local terminal, run: ```shell gcloud config set project ``` Where `` is the ID of the GCP project you are onboarding to Cortex. *** --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/google-cloud-platform-manual-onboarding/gcp-manual-onboarding/gcp-manual-onboarding-guide-project-scope/prerequisites.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.