> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudgeni.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# GCP Setup

> Prefer the keyless impersonation path for GCP, fall back to a service account key only when you have to, and verify inventory access before scanning.

# GCP Setup

GCP currently supports two connection methods in the app:

* Keyless impersonation
* Service account key upload

Use impersonation unless you have a hard reason not to.

## Recommended Path: Keyless Impersonation

The product’s impersonation flow uses this platform service account:

`cloudgeni-platform-sa@cloudgeni-production.iam.gserviceaccount.com`

Minimal setup:

```bash theme={null}
export PROJECT_ID="your-project-id"
export CLOUDGENI_SA="cloudgeni-access@$PROJECT_ID.iam.gserviceaccount.com"

gcloud iam service-accounts create cloudgeni-access \
  --display-name="CloudGeni Access" \
  --project=$PROJECT_ID

gcloud projects add-iam-policy-binding $PROJECT_ID \
  --member="serviceAccount:$CLOUDGENI_SA" \
  --role="roles/viewer"

gcloud projects add-iam-policy-binding $PROJECT_ID \
  --member="serviceAccount:$CLOUDGENI_SA" \
  --role="roles/serviceusage.serviceUsageConsumer"

gcloud iam service-accounts add-iam-policy-binding $CLOUDGENI_SA \
  --member="serviceAccount:cloudgeni-platform-sa@cloudgeni-production.iam.gserviceaccount.com" \
  --role="roles/iam.serviceAccountTokenCreator" \
  --project=$PROJECT_ID
```

## Fallback Path: Service Account Key

The app still supports a service account key upload flow, but it is a weaker long-lived credential
model. Use it only if the impersonation pattern is not viable in your environment.

## After Connect

Once the project is connected:

* Run a sync or scan from the integration page
* Use [Cloud Compliance](/features/cloud-compliance) if you want framework views
* Use [Cloud Resource Import](/features/cloud-resource-import) if you want to start from live resources

## Next

<CardGroup cols={2}>
  <Card title="Connect Cloud" icon="cloud" href="/getting-started/connect-cloud-accounts">
    Return to the shared cloud setup page.
  </Card>

  <Card title="Cloud Resource Import" icon="sitemap" href="/features/cloud-resource-import">
    Start turning discovered resources into repository changes.
  </Card>
</CardGroup>