Google Cloud Platform

Set up Google Cloud Platform for automated tests with TrustCloud!

Purpose

Once you set up your compliance program, TrustCloud TrustOps works to ensure that your systems remain compliant with your adopted controls. To do so, TrustCloud runs automated tests against systems in your product and business stack and verifies that they are properly configured.

This document outlines the steps you can take to grant TrustCloud access to only read metadata about the configuration settings for your GCP account so that TrustOps can validate and generate evidence for your compliance program.

Instructions to grant TrustCloud limited access to GCP metadata

1. Go to Google Cloud Platform https://console.cloud.google.com/ and select a project to create your service account.
2. In the console, navigate to IAM and click on ‘Service accounts’.
3. Click on “Create Service Account”.
4. Enter a Service account name to display in the console and click on the “Create” button.
5. Grant access to the following read-only roles. Each role is independent, skipping one only disables the corresponding tests; the rest of the integration continues to work.
   

   Role	Required for
   Browser	Project and folder enumeration. Required for any test to run.
   Security Reviewer	IAM-policy tests (MFA, inactive-user, root-account-used-recently, bucket public-access).
   Organization Viewer (optional)	Org-scoped IAM-policy tests only.
   Organization Policy Viewer (optional)	Org-scoped IAM-policy tests only.
   Compute Viewer	VPC firewall, persistent-disk, and load-balancer tests.
   Cloud SQL Viewer	Cloud SQL tests.
   Cloud Datastore Viewer	Firestore encryption test (database metadata only; no data read).
   Storage Legacy Bucket Reader	Cloud Storage tests (bucket metadata only; no object read).
   Service Usage Viewer	Tests that check whether a given API is enabled.
   Billing Account Viewer (conditional)	Required only when no explicit project list is supplied at integration setup.

   Grant these at the organization, folder, or project level depending on the scope you want TrustCloud to evaluate.

6. After adding roles, click on the “Continue” button.
7. Click on the “Create Key” button.
8. Select the key type as JSON, and click on the “Create” button.
9. Save the private key.
   
10. Click on the “Done” button to finish creating the service account.
11. Go to your IAM roles for the service account user. Confirm that the Viewer and Security Reviewer roles are enabled. Add the Organization Policy Viewer role. For each project in your GCP account, the service account should be assigned the role of Viewer.
12. Optional: To run IAM tests, you need to add a custom user to your Google Workspace Domain that has a User Management Admin role. 💡 This account is used to delegate access to read specific metadata only. You need to explicitly grant this access below in step 5. This account delegation is required because accessing users requires the Google Admin API, which is only available via account delegation. If you do not want to run IAM tests, you can skip this step.
13. Navigate to your Google Workspace admin console. From the console, navigate to Security and click on ‘API Controls’.  Click on ‘Domain-wide Delegation’. (Or click on this link: https://admin.google.com/u/4/ac/owl/domainwidedelegation).
14. Click on the “Add New” button.
15. Set Client ID to the client ID of your service account.
16. Under Scopes, add the following:
    1. https://www.googleapis.com/auth/admin.directory.user.readonly
    2. https://www.googleapis.com/auth/cloud-platform.read-only
    3. https://www.googleapis.com/auth/compute.readonly
    4. https://www.googleapis.com/auth/sqlservice.admin
    5. https://www.googleapis.com/auth/datastore
    6. https://www.googleapis.com/auth/cloud-billing.readonly
    7. https://www.googleapis.com/auth/devstorage.read_only
       💡 Every API call TrustCloud makes is read-only, list and get operations on GCP resource metadata (projects, IAM policies, bucket configurations, SQL instance settings, etc.). We do not read object data inside your storage buckets, query your databases, read your logs, or modify any GCP resource. Each role and scope above is listed with the test family it unlocks; every one is independently droppable; skipping one only disables the corresponding tests.
       Note on sqlservice.admin: Despite the .admin in the name, this is the only OAuth scope Google ships for the SQL Admin API (there is no .readonly variant). The only call we make under it is sqladmin.instances.list, and the IAM permission that gates it is cloudsql.instances.list (read-only). The OAuth scope is the door; IAM controls which rooms are unlocked behind it, so the effective privilege stays read-only as long as the service account only has the Cloud SQL Viewer role.
17. Click on the “Authorize” button.
18. Enable the required APIs for each project separately. Click on the following links to navigate to the respective URLs –
    1. Cloud Resource Manager API
    2. Service Usage API
    3. Cloud Billing API
    4. Compute Engine API
    5. SQL Admin API
    6. Cloud Firestore API
    7. Cloud Storage API
    8. Admin SDK API
19. Enter your private key, the email address for your account delegate, and the names of all GCP projects you want to test.