Required GCP permissions

A GCP resource handler uses two identities: the credential you give it, and a service account that Cloud Management Platform (CMP) creates in each imported project

  3 minute read  

The credential finds your projects and resources and creates CMP’s service account when you import a project, so it needs permission to create service accounts and modify project IAM policies. Create the credential as described in Create credentials in Google Cloud, then grant it the roles below on each CMP-managed project.

How CMP uses each identity

Identity What CMP uses it for
Your credential: the service account key you add to the handler, or, with an OAuth client ID, the Google account you authorize with. Listing projects and verifying the handler’s connection; creating CMP’s service account and its key when you import a project; syncing servers, networks, images, and disk types; applying labels; reading utilization; and provisioning onto Shared VPC subnets or from another project’s images.
CMP’s service account: cb-service-account-<handler ID>, created in each imported project. All other provisioning, power actions, disk changes, deleting servers and their firewall rules, resetting Windows passwords, and verifying a project’s connection.

When CMP imports a project, it grants its service account the Compute Admin and Service Account User roles in that project. Servers provisioned by this account run as the project’s Compute Engine default service account, so that account must exist and be enabled.

Roles for your credential

In Google Cloud, go to IAM & Admin > IAM and grant these roles to your credential on each CMP-managed project.

Role What it lets CMP do
Compute Admin (roles/compute.admin) List projects, sync servers and networks, apply labels, and provision onto Shared VPC subnets or from another project’s images.
Service Account Admin (roles/iam.serviceAccountAdmin) Create CMP’s service account when you import a project.
Service Account Key Admin (roles/iam.serviceAccountKeyAdmin) Create the key CMP stores for its service account, and delete keys it created earlier.
Project IAM Admin (roles/resourcemanager.projectIamAdmin) Grant CMP’s service account its roles when you import a project.
Monitoring Viewer (roles/monitoring.viewer) Read CPU, disk, and network utilization. Needed only if you collect utilization.

Import fails without Service Account Admin, Service Account Key Admin, and Project IAM Admin.

CMP’s service account holds the Compute Admin role in each imported project, regardless of the roles your credential has.

Some features need roles in other projects:

  • Images from another project: grant Compute Image User in the project that holds the image. See Required roles for images.
  • Shared VPC: grant Compute Network User and Compute Viewer on the host project.