GCP Setup

Cloudgeni supports two GCP connection methods:

Keyless impersonation
Service account key upload

Use impersonation unless you have a hard reason not to.

Keyless Impersonation

The impersonation flow uses this Cloudgeni platform service account: cloudgeni-platform-sa@cloudgeni-production.iam.gserviceaccount.com Minimal setup:

export PROJECT_ID="your-project-id"
export CLOUDGENI_SA="cloudgeni-access@$PROJECT_ID.iam.gserviceaccount.com"

gcloud iam service-accounts create cloudgeni-access \
  --display-name="CloudGeni Access" \
  --project=$PROJECT_ID

gcloud projects add-iam-policy-binding $PROJECT_ID \
  --member="serviceAccount:$CLOUDGENI_SA" \
  --role="roles/viewer"

gcloud projects add-iam-policy-binding $PROJECT_ID \
  --member="serviceAccount:$CLOUDGENI_SA" \
  --role="roles/serviceusage.serviceUsageConsumer"

gcloud iam service-accounts add-iam-policy-binding $CLOUDGENI_SA \
  --member="serviceAccount:cloudgeni-platform-sa@cloudgeni-production.iam.gserviceaccount.com" \
  --role="roles/iam.serviceAccountTokenCreator" \
  --project=$PROJECT_ID

Service Account Key

Cloudgeni also supports a service account key upload flow, but it uses a long-lived credential model. Use it only if the impersonation pattern is not viable in your environment.

After Connect

Once the project is connected:

Run a sync or scan from the integration page
Use Cloud Compliance if you want framework views
Use Cloud Resource Import if you want to start from live resources

Connect Cloud

Return to the shared cloud setup page.

Cloud Resource Import

Start turning discovered resources into repository changes.

Getting Started

Trust

Features

Integrations

CLI

Compliance

Troubleshooting

Support

GCP Setup

GCP Setup

Keyless Impersonation

Service Account Key

After Connect

Next

Connect Cloud

Cloud Resource Import

​GCP Setup

​Keyless Impersonation

​Service Account Key

​After Connect

​Next

Connect Cloud

Cloud Resource Import

GCP Setup

Keyless Impersonation

Service Account Key

After Connect

Next