GCP Monitors for ‘Accounts with privileged access’ can show a connection error stating the role must be deployed to the organization level.
To resolve this error and get IAM Privileged Account data:
Create a new custom role at the organization level and grant the service accounts access to it.
How to grant organization-level permissions (to a service account created at the project-level)
Create a new role at the organization level.
Select your organization from the dropdown menu at the top of the screen.
Select Roles in the left-hand navigation menu.
Create Role.
Type in a Name & ID.
2. Add permissions to the new role (we require all of the following permissions):
(Click arrow to view the list)
(Click arrow to view the list)
cloudbuild.builds.get
cloudbuild.builds.list
cloudkms.keyRings.list
cloudkms.cryptoKeys.list
cloudsql.backupRuns.list
cloudsql.instances.get
cloudsql.instances.list
compute.autoscalers.list
compute.disks.list
compute.firewalls.list
compute.images.list
compute.instanceGroups.list
compute.instances.list
compute.projects.get
container.clusters.list
iam.roles.get
iam.roles.list
iam.serviceAccounts.get
iam.serviceAccounts.getIamPolicy
iam.serviceAccounts.list
logging.buckets.list
monitoring.alertPolicies.list
monitoring.notificationChannels.get
monitoring.notificationChannels.list
recommender.cloudsqlIdleInstanceRecommendations.get
resourcemanager.organizations.get
resourcemanager.projects.get
resourcemanager.projects.getIamPolicy
resourcemanager.folders.getIamPolicy (Only at organization level)
resourcemanager.organizations.getIamPolicy (Only at organization level)
serviceusage.services.get
serviceusage.services.list
storage.buckets.list
3. Find the Service Account(s).
a. Go back to your Project.
b. Select Service Accounts from the left-hand navigation menu.
c. Find the Service Account(s) used for integrating your projects.
d. Copy the service account email address.
4. Assign service account email at Org level in IAM.
a. Select your organization from the dropdown menu at the top of the screen.
b. Select IAM from the left-hand navigation menu.
c. Select Grant Access.
d. Paste in the service account email address (from Step 2).
e. Select the new role that was just created.
f. Once completed you should see the service account in the list at the bottom,
(showing it’s new permissions).
Once org-level permissions have been granted, refreshing the monitor should clear the connection error and showing privileged access accounts.