To onboard a GCP project account:

• 1. Create a Service Account
  1. In the GCP Cloud Console, go to IAM & Admin > Service Accounts.
  2. Click CREATE SERVICE ACCOUNT.
  3. Enter the Service account name and Service account description, then click CREATE.

  

  4. On the Service accounts permission screen, click CONTINUE.
  5. On the Grant user access page, click DONE to create the service account.
  6. Select the created service account, then click ADD KEY under Keys.
  7. Select JSON as the key type, then click CREATE. A JSON file will be created and downloaded. Keep the JSON file in a secure location. You will need it to finish onboarding your GCP project account in the ZCSPM Admin Portal.

  

  Zscaler recommends you to associate multiple projects you intend to onboard to a single service account.

  To associate a different GCP project with a single service account:

  1. Search for the created service account and copy the Email.
  2. In the left-pane menu, go to IAM & Admin > IAM.
  3. Click ADD.
  4. In the New members section, paste the service account email you copied earlier.
  5. From the Role drop-down menu, select Viewer.
  6. Click ADD ANOTHER ROLE.
  7. From the Role drop-down menu, select Cloud Asset Viewer.
  8. Click SAVE.

  Close
• 2. Enable APIs on all GCP Projects

  ZCSPM requires access to APIs across all your projects in the organization to collect configuration data for your GCP services.

  • See list of the GCP APIs

    You need to provide ZCSPM with the Viewer role for GCP APIs to onboard your GCP project and collect configuration metadata. List of GCP APIs required by ZCSPM:

    API Title

    Project to enable this API access

    Permissions used by ZCSPM

    BigQuery API

    Every project accessed by the service account

    bigquery.datasets.get

    Cloud Asset API

    Project hosting the service account

    cloudasset.assets.searchAllIamPolicies, cloudasset.assets.searchAllResources

    Cloud Bigtable Admin API

    Project hosting the service account

    bigtable.clusters.list, bigtable.instances.list, bigtable.table.list

    Cloud Data Fusion API

    Every project accessed by the service account

    datafusion.instances.list

    Cloud Dataproc API

    Every project accessed by the service account

    dataproc.clusters.list

    Cloud DNS API

    Every project accessed by the service account

    dns.managedZones.get, dns.managedZones.list

    Cloud Functions API

    Every project accessed by the service account

    cloudfunctions.functions.getIamPolicy, cloudfunctions.functions.functions.list

    Cloud Key Management Service

    • Project hosting the service account
    • Every project accessed by the service account

    cloudkms.cryptoKeys.list, cloudkms.keyRings.list

    Cloud Logging API

    Project hosting the service account

    logging.logMetrics.list, logging.sinks.get, logging.sinks.list

    Cloud Monitoring API

    Project hosting the service account

    monitoring.alertPolicies.get, monitoring.alertPolicies.list, monitoring.metricDescriptors.get

    1 to 10 of 18

    Page 1 of 2

    Close

  To enable the APIs on a GCP project:

  1. In the GCP Cloud Console, click the Active Cloud Shell icon.
  2. Enable the APIs by running the following command:

  gcloud services enable cloudresourcemanager.googleapis.com compute.googleapis.com sqladmin.googleapis.com storage.googleapis.com iam.googleapis.com logging.googleapis.com monitoring.googleapis.com bigquery.googleapis.com dns.googleapis.com cloudasset.googleapis.com cloudkms.googleapis.com serviceusage.googleapis.com

  3. In the left-pane menu, click APIs & Services and verify API access status.

  Close
• 3. Add GCP Project on ZCSPM
  1. Go to Configurations > Cloud Accounts.
  2. Click Add Cloud Account.

  

  3. From the License drop-down menu, select your license.
  4. Select GCP, then click Continue.
  5. From the Onboarding type drop-down menu, select Project.
  6. Upload a service account:
     • Select New, then click Upload Credentials to upload the service account credentials JSON file.
     • Select Existing. From the Service Account Name drop-down menu, select your service account.

  

  7. Click Next.
  8. Select all the projects you want to onboard with the organization, then click Next.
  9. Click Save.

  Close