Skip to main content

How To: GCP - Configuring Privileged Access Monitors.

How to configure GCP with permissions for Privileged Access monitors in Thoropass.

Stephen Gentile avatar
Written by Stephen Gentile
Updated over 8 months ago

GCP Monitors for ‘Accounts with privileged access’ can show a connection error stating the role must be deployed to the organization level.

To resolve this error and get IAM Privileged Account data:

  • Create a new custom role at the organization level and grant the service accounts access to it.

How to grant organization-level permissions (to a service account created at the project-level)

  1. Create a new role at the organization level.

    1. Select your organization from the dropdown menu at the top of the screen.

    2. Select Roles in the left-hand navigation menu.

    3. Create Role.

      1. Type in a Name & ID.

2. Add permissions to the new role (we require all of the following permissions):

(Click arrow to view the list)

  • cloudbuild.builds.get

  • cloudbuild.builds.list

  • cloudkms.keyRings.list

  • cloudkms.cryptoKeys.list

  • cloudsql.backupRuns.list

  • cloudsql.instances.get

  • cloudsql.instances.list

  • compute.autoscalers.list

  • compute.disks.list

  • compute.firewalls.list

  • compute.images.list

  • compute.instanceGroups.list

  • compute.instances.list

  • compute.projects.get

  • container.clusters.list

  • iam.roles.get

  • iam.roles.list

  • iam.serviceAccounts.get

  • iam.serviceAccounts.getIamPolicy

  • iam.serviceAccounts.list

  • logging.buckets.list

  • monitoring.alertPolicies.list

  • monitoring.notificationChannels.get

  • monitoring.notificationChannels.list

  • recommender.cloudsqlIdleInstanceRecommendations.get

  • resourcemanager.organizations.get

  • resourcemanager.projects.get

  • resourcemanager.projects.getIamPolicy

  • resourcemanager.folders.getIamPolicy (Only at organization level)

  • resourcemanager.organizations.getIamPolicy (Only at organization level)

  • serviceusage.services.get

  • serviceusage.services.list

  • storage.buckets.list

3. Find the Service Account(s).

a. Go back to your Project.

b. Select Service Accounts from the left-hand navigation menu.

c. Find the Service Account(s) used for integrating your projects.

d. Copy the service account email address.

4. Assign service account email at Org level in IAM.

a. Select your organization from the dropdown menu at the top of the screen.

b. Select IAM from the left-hand navigation menu.

c. Select Grant Access.

d. Paste in the service account email address (from Step 2).

e. Select the new role that was just created.

f. Once completed you should see the service account in the list at the bottom,

(showing it’s new permissions).

Once org-level permissions have been granted, refreshing the monitor should clear the connection error and showing privileged access accounts.

Did this answer your question?