Docs / Onboarding / GCP

Onboard Google Cloud

Grant org-level Cloud Asset and related viewer roles to a CloudPulse service account, set up Workload Identity Federation for production, then register the organization in CloudPulse.

Prerequisites

• Organization Admin (or equivalent) to bind IAM on the org and host project.
• Organization ID, host project ID, and project number.
• Optional: Cloud Billing account ID and a BigQuery dataset for billing export.

Steps

1. Accounts → Add GCP. Enter display name, organization ID, host project ID, and project number.
2. Download the customer setup script (cloudpulse-gcp-customer-setup.ps1. Run it with org + host project parameters. It creates or reuses the CloudPulse service account, enables required APIs on the host project, and binds org IAM (Cloud Asset Viewer and additional viewers CloudPulse needs). Re-runs are idempotent (get-then-add).
3. Workload Identity Federation (production). The setup script configures a WIF pool/provider so CloudPulse’s Azure managed identity can impersonate that service account. No service-account JSON key is stored in production.
4. Optional — billing export. In Google Cloud Console Billing, keep Standard usage cost export enabled to BigQuery (required for Cost Explorer, CUD analysis, and credits). Grant the CloudPulse SA roles/bigquery.dataViewer on the export dataset only, and roles/billing.viewer on the billing account when prompted by the script.
5. Optional — Security Command Center. If you want SCC Findings in CloudPulse, enable the findings viewer role (Wave2 flag on the setup script) and the Security Center API on the host project.
6. Save the account in CloudPulse (federated / WIF — no private key paste in production). When data is ready, open GCP Insights (projects, networking, CUDs, exposure, and so on).

You vs CloudPulse support

API

GET /v1/accounts/gcp-setup-script?organization_id=…&host_project_id=…
GET /v1/accounts/{account_id}/gcp-setup-script