> For the complete documentation index, see [llms.txt](https://docs.cortex.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cortex.io/ingesting-data-into-cortex/integrations/google.md). # Google Cloud Platform {% hint style="info" %} Cortex connects to many third-party vendors whose system interfaces frequently change. As a result, integration behavior or configuration steps may shift without notice. If you encounter unexpected issues, check with your system administrator or refer to the vendor's documentation for the most current information. Additionally, integration sync times vary and are subject to scheduling overrides and timing variance. {% endhint %} ## Why use the integration for Google Cloud Platform Google Cloud Platform (GCP) is Google's suite of cloud computing services, including compute, storage, data, and AI/ML products. Integrating Cortex with GCP gives you automatic visibility into your cloud infrastructure and how it connects to the rest of your catalog. This integration works alongside Cortex's broader Google integration, which also connects to Google Workspace to sync ownership from Google Groups. Together, they help Cortex build a live picture of your cloud footprint and who owns it. With the GCP integration, Cortex can: * Automatically discover GCP entities, like Cloud Run services, BigQuery datasets, and Kubernetes Engine clusters, and add them to your catalog. * Link those entities to the services that depend on them, using tags Cortex matches automatically or dependencies you define explicitly. * Pull in Service Level Objectives (SLOs) from Google Cloud Observability and surface them on entity pages. * Power Scorecards and CQL queries that check GCP configuration, SLO health, and ownership across your catalog. Cortex connects to GCP through a service account with read-only permissions scoped to the entity types you want to sync. Cortex only reads from GCP; it doesn't make changes to your cloud resources. {% hint style="info" %} For information on configuring Google SSO for logging in to Cortex, see the [Google SSO documentation](/configure/settings/managing-users/configuring-sso.md). {% endhint %} ## Supported Google Cloud entity types Cortex supports importing the following entity types from Google Cloud:
Supported Google Cloud entity types * Google Cloud Vertex AI Batch Prediction Job * Google Cloud Vertex AI Dataset * Google Cloud Vertex AI Endpoint * Google Cloud Vertex AI Featurestore * Google Cloud Vertex AI Index * Google Cloud Vertex AI Model * Google Cloud Vertex AI Model Deployment Monitoring Job * Google Cloud Vertex AI Notebooks Instance * Google Cloud Vertex AI Pipeline Job * Google Cloud Vertex AI Platform Index Endpoint * Google Cloud Vertex AI Specialist Pool * Google Cloud Vertex AI Study * Google Cloud Vertex AI Tensorboard * Google Cloud Vertex AI Training Pipeline * Google Cloud Vertex AI Vision Application * Google Cloud Vertex AI Vision Cluster * Google Cloud Vertex AI Vision Index Point * Google Cloud Vertex AI Vision Operator * Google Cloud Vertex AI Vision Processor * Google Cloud Apigee Api * Google Cloud Apigee Instance * Google Cloud App Engine Service * Google Cloud Artifact Registry Repository * Google Cloud BigQuery Connection * Google Cloud BigQuery * Google Cloud Composer Environment * Google Cloud Functions * Google Cloud Kubernetes Engine Clusters * Google Cloud Kubernetes Engine Operations * Google Cloud IAM Service Account * Google Cloud Instance Group * Google Cloud HTTP(S) Load Balancing * Google Cloud Memorystore Memcached * Google Cloud Memorystore Redis * Google Cloud Project * Google Cloud Run Job * Google Cloud Run Service * Google Cloud Spanner Instance * Google Cloud Spanner Instance Config * Google Cloud SQL * Google Cloud Storage * Google Cloud Pub/Sub Topics * Google Cloud VM Instances * Google Cloud VPC Serverless Connector
## Configuring Google Cloud Platform ### Prerequisites 1. Users with the `Configure Integrations` permission can configure GCP. 2. A [Google service account](https://docs.cloud.google.com/iam/docs/service-account-overview) and its client ID. * In the Advanced settings, enable **Domain-wide Delegation**. * Under Domain-wide Delegation, copy the client ID and store it in a secure location. Do not skip this step! You'll need the client ID to complete setup. * The service account must include permissions for each project to enable Google Cloud resources. See [Google service account permissions](#google-service-account-permissions) below. 3. The [Google Admin SDK API](https://console.developers.google.com/apis/api/admin.googleapis.com/overview) is configured and enabled. 4. Google Cloud resource project permissions are enabled for each project. See [Google Cloud resource project permissions](#google-cloud-resource-project-permissions) below. #### Google service account permissions
Expand to view the list of Google service account permissions * AI Platform → AI Platform Viewer, Dataform Viewer, Cloud Storage for Firebase Viewer, Data Catalog Viewer, Vision AI Viewer, Notebooks Viewer, Dataflow Viewer * Apigee → Cloud Api Hub Viewer * App Engine → App Engine Viewer * Artifact Registry → Artifact Registry Reader * BigQuery → BigQuery Metadata Viewer * BigQuery Connection → BigQuery Connection User * Cloud Asset → Cloud Asset Viewer * Cloud Asset → ListResource * Note: This permission is necessary to run services and jobs. * Cloud Functions → Cloud Functions Viewer * Cloud Pub/Sub → Pub/Sub Viewer * Cloud Resource Manager → Browser * Cloud Run → Cloud Run Viewer * Cloud SQL → Cloud SQL Viewer * Cloud Storage → Storage Admin * Composer → Composer User * Compute Engine, VM Instances → Compute Viewer * Kubernetes Engine → Kubernetes Engine Viewer * Memorystore Memcached → Cloud Memorystore Memcached Viewer * Memorystore Redis → Cloud Memorystore Redis Viewer * Monitoring → Monitoring Viewer * Service Accounts → View Service Accounts * Spanner → Cloud Spanner Viewer * VM Instances Vulnerabilities → OS VulnerabilityReport Viewer * VPC Serverless Connector → Serverless VPC Access Viewer
To create a custom role with only the minimum required permissions, add the following:
Expand to view the list of custom role minimum permissions ``` aiplatform.datasets.get aiplatform.datasets.list aiplatform.endpoints.get aiplatform.endpoints.list aiplatform.featurestores.get aiplatform.featurestores.list aiplatform.indexEndpoints.get aiplatform.indexEndpoints.list aiplatform.batchPredictionJobs.get aiplatform.batchPredictionJobs.list aiplatform.modelDeploymentMonitoringJobs.get aiplatform.modelDeploymentMonitoringJobs.list aiplatform.trainingPipelines.get aiplatform.trainingPipelines.list aiplatform.pipelineJobs.get aiplatform.pipelineJobs.list aiplatform.specialistPools.get aiplatform.specialistPools.list aiplatform.tensorboardExperiments.get aiplatform.tensorboardExperiments.list aiplatform.studies.get aiplatform.studies.list aiplatform.apps.get aiplatform.apps.list aiplatform.indexes.get aiplatform.indexes.list aiplatform.models.get aiplatform.models.list aiplatform.tensorboards.get aiplatform.tensorboards.list iam.serviceAccounts.get apihub.apiHubInstances.get apihub.apis.get apihub.apis.list appengine.services.get appengine.services.list artifactregistry.repositories.get artifactregistry.repositories.list bigquery.connections.get bigquery.connections.list bigquery.datasets.get bigquery.routines.get bigquery.routines.list cloudasset.assets.listResource cloudfunctions.functions.get cloudfunctions.functions.list cloudsql.instances.get cloudsql.instances.list composer.environments.get composer.environments.list compute.urlMaps.list compute.urlMaps.get compute.instances.list compute.instances.get compute.instanceGroups.list compute.instanceGroups.get container.clusters.get container.clusters.list container.operations.get container.operations.list iam.serviceAccounts.get iam.serviceAccounts.list memcache.instances.list memcache.instances.get monitoring.services.get monitoring.services.list monitoring.slos.get monitoring.slos.list monitoring.timeSeries.list notebooks.instances.get notebooks.instances.list osconfig.vulnerabilityReports.get pubsub.topics.get pubsub.topics.list redis.instances.list redis.instances.get resourcemanager.projects.get resourcemanager.projects.list run.jobs.list run.jobs.get run.services.list run.services.get spanner.instances.get spanner.instances.list spanner.instanceConfigs.get spanner.instanceConfigs.list storage.buckets.get storage.buckets.list visionai.applications.get visionai.applications.list visionai.processors.get visionai.processors.list visionai.operators.get visionai.operators.list visionai.clusters.get visionai.clusters.list vpcaccess.connectors.get vpcaccess.connectors.list ```
#### Google Cloud resource project permissions
Expand to view the list of Google Cloud resources project permissions * [App Engine Admin API](https://console.cloud.google.com/marketplace/product/google/appengine.googleapis.com) * [ArtifactRegistry API](https://console.cloud.google.com/marketplace/product/google/artifactregistry.googleapis.com) * [Apigee APIs](https://console.cloud.google.com/marketplace/product/google/apigee.googleapis.com) * [BigQuery API](https://console.cloud.google.com/marketplace/product/google/bigquery.googleapis.com) * [BigQuery Connection API](https://console.cloud.google.com/marketplace/product/google/bigqueryconnection.googleapis.com) * [Cloud Asset API](https://console.cloud.google.com/marketplace/product/google/cloudasset.googleapis.com) * [Cloud Composer API](https://console.cloud.google.com/marketplace/product/google/composer.googleapis.com) * [Cloud Functions](https://console.cloud.google.com/marketplace/product/google/cloudfunctions.googleapis.com) * [Cloud SQL Admin](https://console.cloud.google.com/marketplace/product/google/sqladmin.googleapis.com) * [Cloud Storage](https://console.cloud.google.com/marketplace/product/google/storage.googleapis.com) * [Compute Engine API](https://console.cloud.google.com/marketplace/product/google/compute.googleapis.com) * [Kubernetes Engine API](https://console.cloud.google.com/marketplace/product/google/container.googleapis.com) * [Memorystore for Memcached API](https://console.cloud.google.com/marketplace/product/google/memcached.googleapis.com) * [Memorystore for Redis API](https://console.cloud.google.com/marketplace/product/google/redis.googleapis.com) * [OS Config API](https://console.cloud.google.com/marketplace/product/google/osconfig.googleapis.com) * [Kubernetes Engine API](https://console.cloud.google.com/marketplace/product/google/container.googleapis.com) * [Resource Manager API](https://console.cloud.google.com/marketplace/product/google/cloudresourcemanager.googleapis.com) * [Spanner API](https://console.cloud.google.com/marketplace/product/google/spanner.googleapis.com) * [Serverless VPC Access API](https://console.cloud.google.com/marketplace/product/google/vpcaccess.googleapis.com)
For each project in Vertex AI, enable the following:
Expand to view the list of permissions needed for Vertex AI projects * [Cloud Storage API](https://console.cloud.google.com/marketplace/product/google/storage-component.googleapis.com) * [DataCatalog API](https://console.cloud.google.com/marketplace/product/google/datacatalog.googleapis.com) * [Dataflow AI API](https://console.cloud.google.com/marketplace/product/google/dataflow.googleapis.com) * [DataForm API](https://console.cloud.google.com/marketplace/product/google/dataform.googleapis.com) * [Notebooks AI API](https://console.cloud.google.com/marketplace/product/google/notebooks.googleapis.com) * [Vertex AI API](https://console.cloud.google.com/marketplace/product/google/aiplatform.googleapis.com) * [Vision AI API](https://console.cloud.google.com/marketplace/product/google/visionai.googleapis.com)
### Step 1: Configuring the integration in GCP 1. In the [G Suite admin console](https://admin.google.com/), navigate to **Security > API Controls > Manage Domain Wide Delegation**. Click **Add new**. 2. Click **Add new**. 3. Add the client ID and include the following scopes: * `https://www.googleapis.com/auth/admin.directory.group.readonly` * `https://www.googleapis.com/auth/admin.directory.group.member.readonly` 4. Go to the service account you created for this integration. 5. Click **Keys**, then generate a key in JSON format. 6. Navigate to **Admin Roles > Groups Reader** and expand the Admins panel. 7. Click **Assign service accounts** then enter the email of the service account you created for this integration. ### Step 2: Configuring the integration in Cortex 1. From the main sidebar, select **Integrations**. 2. Locate Google, then click **Install**. The Google side panel opens. 3. In the Google side panel, do the following: 1. From the **Category** dropdown, select at least one category that applies to the integration (required). 2. **Under Domain**, enter your organization's Google domain (required). 3. Under **Service account user (email)**, enter the email address for the service account (required). 4. Under **Credentials**, paste the service account JSON exactly as it is (required). 4. Click **Test connection**. A successful connection means your integration is configured correctly. 5. Click **Save**. By default, a service depends on any resource whose Google Cloud tag has key "service" and value matching the service's [Cortex tag](/ingesting-data-into-cortex/entities-overview/entities.md#cortex-tag). After saving the configuration, you can customize the key name or leave it blank to use "service". #### **Customizing the key name** Follow the steps below to customize the key name. 1. From the main sidebar, select **Integrations**. 2. Locate Google, then click **Settings**. 3. In the **Details** section, enter the key name under **Custom label key**. 4. Click **Save custom label key**. {% hint style="info" %} To modify an existing configuration, see [Modifying an integration configuration](https://docs.cortex.io/ingesting-data-into-cortex/integrations#modifying-an-integration-configuration). {% endhint %}