Skip to main content

Connecting GCP

To scan your Google Cloud environment, you need to provide Service Account credentials with read-only access to the projects you want to monitor.

Prerequisites​

  • A GCP account with permission to create Service Accounts
  • At least one GCP project you want to scan
  • The following ready:
    • A Service Account with the Viewer role
    • The Service Account's JSON key file or credentials

Step 1: Create a Service Account​

If you don't already have a dedicated Service Account:

  1. Go to Google Cloud Console → IAM & Admin → Service Accounts
  2. Click Create Service Account
  3. Name it (e.g., "amnify-scanner")
  4. Click Create and Continue

Step 2: Assign the Viewer Role​

  1. In the Grant this service account access step, add the Viewer role
  2. Click Continue and then Done
tip

The Viewer role provides the read-only access needed for security scanning. Amnify does not require write access to your GCP resources.

Step 3: Create a Key​

  1. Open the Service Account you just created
  2. Go to the Keys tab
  3. Click Add Key → Create new key
  4. Select JSON format
  5. Click Create — the key file downloads automatically

Step 4: Add the Integration in Amnify​

  1. Navigate to Integrations and click Create integration
  2. Select GCP as the provider
  3. Fill in the credentials from your Service Account key
  4. Optionally set a Display Name
  5. Click Next
  6. Amnify discovers your projects — toggle on the ones you want to scan
  7. Click Finish

What Happens Next​

Once connected, you can:

Troubleshooting​

IssueCauseSolution
No projects discoveredService Account lacks Viewer accessAssign Viewer role on target projects
Authentication failedInvalid or expired keyCreate a new JSON key for the Service Account
Partial scan resultsViewer role missing on some projectsEnsure the Service Account has Viewer access on all target projects