Required GCP permissions

Mon, 01 Jan 0001 00:00:00 +0000

The credential finds your projects and resources and creates CMP’s service account when you import a project, so it needs permission to create service accounts and modify project IAM policies. Create the credential as described in Create credentials in Google Cloud, then grant it the roles below on each CMP-managed project.

How CMP uses each identity

Identity	What CMP uses it for
Your credential: the service account key you add to the handler, or, with an OAuth client ID, the Google account you authorize with.	Listing projects and verifying the handler’s connection; creating CMP’s service account and its key when you import a project; syncing servers, networks, images, and disk types; applying labels; reading utilization; and provisioning onto Shared VPC subnets or from another project’s images.
CMP’s service account: `cb-service-account-<handler ID>`, created in each imported project.	All other provisioning, power actions, disk changes, deleting servers and their firewall rules, resetting Windows passwords, and verifying a project’s connection.

When CMP imports a project, it grants its service account the Compute Admin and Service Account User roles in that project. Servers provisioned by this account run as the project’s Compute Engine default service account, so that account must exist and be enabled.

Google Cloud Platform (GCP) on CloudBolt Documentation

Required GCP permissions

How CMP uses each identity