About

The Google Cloud integration connects ControlMap to a Google Cloud project and runs automated security checks on its resources. The checks are called GCP CIS Benchmarks. Their results appear in Monitor, so your client's cloud setup is checked without manual work.

ControlMap makes short, read-only connections to the project's resources when it scans. It does this by acting as a service account that you create in the project. You don't sign in to Google, and you don't upload a key file.

To see what each check looks at and how to fix a failing one, read the article Rules scanned & Remediation steps for GCP.

Before you start

Have these ready on the Google Cloud side:

• Setting up integrations from the client portal is part of the Pro plan. For details, see the Free, Essentials and Pro plans article.
• The Google Cloud project you want ControlMap to scan, and its project ID.
• A service account in that project that has at least the Security Viewer and Viewer roles, and that ControlMap is allowed to impersonate.
• The email address of that service account.

When you open the setup page, a panel on the right headed Required Permissions explains these steps in Google Cloud, including where to find the project ID. Keep it open while you work.

Connect Google Cloud

1. Go to Monitor › Integrations and select Add Integration.
2. Search for Google Cloud and select the Google Cloud card. It is listed under Cloud Infrastructure.

3. On the Connection step, fill in all three fields. Each one is required:
   • Connection Name: a name for this connection.
   • Project Id: the ID of your Google Cloud project.
   • Service Account Email: the email of the service account you created for ControlMap.
4. Select Next: Checks. ControlMap checks the details with Google Cloud and saves the connection. If the details are wrong, the connection is not created.

5. Complete the remaining steps as described in the Connect an integration article: Checks, Watchers and Schedule.

What you'll see after connecting

When you finish, the new connection's page opens. The GCP CIS Benchmarks checks appear in Monitor › Compliance Checks. They show No Data until the first scan runs. Scans run weekly, or you can start one from the connection's page with Run Once.

To narrow the list to benchmark checks, use the check-type filter in Compliance Checks and choose CIS Benchmarks.

Disconnect or change settings

Go to Monitor › Integrations and select the connection's card to change its settings or its schedule. The steps are in the Connect an integration article.

To remove the connection, select the bin icon on its card. This also deletes its assets and their compliance status.