Onboarding a Single GCP Project

To enable APIs needed by CloudGuard:

1. Log in to the Google Cloud management portal.

2. On the top left, select the project to onboard to CloudGuard

3. In the navigation tree, select APIs & Services > Enabled APIs & services.

4. Click the ENABLE APIS AND SERVICES button.

5. In the Search box, enter Compute Engine API and make sure the API is enabled.

   

6. In the Search box, enter Cloud Resource Manager API.

   Make sure it is enabled.

7. Use the Search box to find the APIs that CloudGuard needs and enable them.

   • Kubernetes API The application that serves Kubernetes functionality through a RESTful interface and stores the state of the cluster.[-] Kubernetes resources and "records of intent" are all stored as API objects, and modified via RESTful calls to the API. The API allows configuration to be managed in a declarative way. Users can interact with the Kubernetes API directly, or via tools like kubectl.

   • KMS AWS Key Management Service (AWS KMS) - A managed service that simplifies the creation and control of encryption keys that are used to encrypt data. API

   • IAM Identity and Access Management (IAM) - A web service that customers can use to manage users and user permissions within their organizations. API

   • App Engine Admin API

   • BigQuery API

   • Admin SDK API

   • Cloud Functions API

   • Cloud SQL Admin API

   • Cloud BigTable Admin API

   • Cloud Pub/Sub API

   • Cloud Memorystore Redis

   • Service Usage API

   • Cloud Filestore API

   • API Keys API

   • Cloud Logging API

   • Cloud DNS API

   • Cloud Asset API

8. Click NEXT.

A service account is a special type of Google Cloud Platform account that represents a non-human user (in this case CloudGuard). The CloudGuard service account is authenticated and authorized to access data in Google APIs and run API requests. The CloudGuard service account is granted IAM roles to access your GCP resources and make authorized API calls.

To create a service account in GCP for CloudGuard:

In GCP

1. In the navigation tree, select APIs & Services > Credentials.

2. Click CREATE CREDENTIALS and select Service account.

   The Create service account page opens.

3. Enter CloudGuard-Connect for the Service account name and click CREATE AND CONTINUE.

4. Select these roles from the list:

   • From Project, select Viewer

   • From IAM, select Security Reviewer

   • From Cloud Asset, select Cloud Asset Viewer

5. Click Done.

6. Click the new service account.

7. Go to the KEYS tab.

8. Click ADD KEY > Create new key.

9. Select JSON as the Key type and click CREATE.

   The key automatically downloads to your default location.

10. Click Close.

In CloudGuard

1. In the CloudGuard wizard, enter a name for your environment (as shown in CloudGuard):

2. Click Choose File to upload the downloaded private key.

   

   CloudGuard shows a confirmation icon for a successful upload.

3. Click NEXT.

If you use Google Workspace (formerly G Suite), it is recommended to onboard the Workspace to CloudGuard to run compliance checks on GCP users in groups and to retrieve two-factor authentication information.

Enable domain delegation

1. In the navigation tree of your GCP Project, click on IAM & Admin > Service accounts.

2. Click the CloudGuard-Connect service account you created in the previous step.

3. Click Advanced Settings to expand the content.

4. Below Domain-wide Delegation, click the icon to copy the Client ID.

Create an admin read-only user

Authorize a new API client

1. Open the Google Admin console.

2. Select Security > Access and data control > API controls.

3. Click Manage Domain Wide Delegation.

4. In API clients, click Add new.

5. In the Client ID field, paste the Service account Client ID you copied.

6. In the OAuth scopes (comma-delimited) fields, enter these API URLs:

   https://www.googleapis.com/auth/admin.directory.group.readonly,

   https://www.googleapis.com/auth/admin.directory.user.readonly

7. Click Authorize.

Assign role to the new user

1. In the navigation tree, select Directory > Users.

2. Click Add new user to create a read-only user that can read the data from Google Workspace and send it to CloudGuard.

   • Enter a first and last name for the new user, for example CloudGuard-Connect.

   • In the Primary email address field enter CloudGuard-connect as a username. The email domain is entered automatically.

3. Click ADD NEW USER.

4. In the navigation tree, select Account > Admin roles.

5. Click Create new role.

6. Enter a name for the role (for example CloudGuard-Privileges)

7. On the Privileges tab, find Admin API Privileges.

8. Select these privileges:

   • Users: Read

   • Group: Read

9. Click Continue.

10. Click CREATE ROLE.

    The page that opens shows all users to whom the role is assigned.

11. Click Assign users.

12. Search for the user you created in step 10 and click ASSIGN ROLE.

Enter the email and domain name

1. In CloudGuard, enter the email and domain name of the API user that you created.

   

2. In CloudGuard, click NEXT.

1. Select an Organizational Unit to associate with the environment.

   Note - Optional step. Use the Organizational Units page in Assets to create and change associations.

2. Click Finish.

   Onboarding starts.