> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/environments/creating-an-environment/install-iam-assessment-google-cloud.md).

# Install IAM assessment on Google Cloud

Install the P0 IAM assessment integration on Google Cloud to collect IAM data. Required to use Access Inventory and Posture for your GCP projects.

Install the **IAM assessment** integration to let P0 collect and analyze the IAM configuration of your Google Cloud projects.

{% hint style="warning" %}
You must install the **IAM assessment** integration to use **Access Inventory** or **Posture**. P0 builds the identity graph and evaluates posture findings from the data this integration collects. Without it, Inventory and Posture have no data to display.
{% endhint %}

## What data P0 collects

The IAM assessment grants P0 a read-only custom role and uses it to collect the IAM configuration of your projects. P0 reads metadata and configuration only. It doesn't read the contents of your storage buckets, databases, or other application data.

P0 collects the following datasets:

| Dataset                          | What it includes                                                                                        | Google Cloud API                  |
| -------------------------------- | ------------------------------------------------------------------------------------------------------- | --------------------------------- |
| IAM policy bindings              | Role grants on organizations, folders, projects, and resources, including inherited (ancestor) bindings | Cloud Asset API                   |
| Resource inventory               | Resources in scope, such as Compute instances, storage buckets, service accounts, and BigQuery datasets | Cloud Asset API                   |
| Roles                            | Predefined and custom role definitions and their permissions                                            | IAM API                           |
| Service accounts                 | Service accounts and their metadata                                                                     | IAM API                           |
| Service account keys             | Key metadata, such as creation date and key type (P0 does not read private key material)                | IAM API                           |
| Service account activity         | Authentication-event counts used to detect unused identities and keys                                   | Cloud Monitoring API              |
| IAM recommendations              | Google's IAM policy insights, such as over-privileged or unused grants                                  | Recommender API                   |
| Policy analysis                  | Effective access derived from `analyzeIamPolicy`                                                        | Cloud Asset API                   |
| Compute and Cloud Run identities | Service identities attached to Compute instances and Cloud Run services and jobs                        | Compute Engine API, Cloud Run API |
| Essential contacts               | Project technical contacts                                                                              | Essential Contacts API            |

P0 collects this data when you first install the integration and refreshes it on each scan.

## Required Google Cloud APIs

Enable the following APIs on each project you assess. The custom role's permissions depend on these services, so the assessment fails to read data if an API is disabled.

| API                                      | Service name                          | Used for                                                    |
| ---------------------------------------- | ------------------------------------- | ----------------------------------------------------------- |
| Cloud Asset API                          | `cloudasset.googleapis.com`           | IAM policy bindings, resource inventory, policy analysis    |
| Cloud Resource Manager API               | `cloudresourcemanager.googleapis.com` | Project, folder, and organization metadata and IAM policies |
| Identity and Access Management (IAM) API | `iam.googleapis.com`                  | Roles, service accounts, and key metadata                   |
| Cloud Monitoring API                     | `monitoring.googleapis.com`           | Service account and key activity                            |
| Recommender API                          | `recommender.googleapis.com`          | IAM policy insights and recommendations                     |
| Compute Engine API                       | `compute.googleapis.com`              | Compute instance and service-identity data                  |
| Cloud Run Admin API                      | `run.googleapis.com`                  | Cloud Run service and job identities                        |
| Essential Contacts API                   | `essentialcontacts.googleapis.com`    | Project technical contacts                                  |

{% hint style="info" %}
The commands P0 generates during installation enable the required APIs and create the custom role for you. Enable the APIs manually only if your organization restricts API enablement or uses a separate provisioning process.
{% endhint %}

## Project-level vs organization-level configuration

You can install the IAM assessment on individual projects or across an entire organization. The data P0 collects is the same; the scope of the role binding and the permissions differ.

### Project-level install

Install on one or more specific projects. For each project, P0:

* Creates the **P0 IAM Auditor** (`p0IamAuditor`) custom role at the project level.
* Grants the role to the P0 service account on that project.
* Enables the [required APIs](#required-google-cloud-apis) on that project.

A project-level install assesses only the projects you add.

### Organization-level install

Install once at the organization to assess every project in the hierarchy. P0:

* Creates the custom role at the organization level and grants it to the P0 service account on the organization. The grant is inherited by all folders and projects, so you don't bind the role to each project individually.
* Adds the following organization- and folder-level permissions to the role, on top of the project-level permissions, so P0 can read the resource hierarchy and enumerate projects:
  * `resourcemanager.organizations.get`
  * `resourcemanager.organizations.getIamPolicy`
  * `resourcemanager.folders.get`
  * `resourcemanager.folders.list`
  * `resourcemanager.folders.getIamPolicy`
  * `resourcemanager.projects.list`

{% hint style="info" %}
Enable the [required APIs](#required-google-cloud-apis) on each project you want to assess, even with an organization-level install. The custom role binding is inherited across the hierarchy, but API enablement is per project.
{% endhint %}

The permissions the custom role grants at the project level are:

* `cloudasset.assets.analyzeIamPolicy`
* `cloudasset.assets.searchAllIamPolicies`
* `cloudasset.assets.searchAllResources`
* `compute.instances.list`
* `compute.projects.get`
* `compute.zones.list`
* `essentialcontacts.contacts.list`
* `iam.roles.get`
* `iam.roles.list`
* `iam.serviceAccountKeys.list`
* `iam.serviceAccounts.get`
* `monitoring.timeSeries.list`
* `recommender.iamPolicyInsights.list`
* `resourcemanager.projects.get`
* `resourcemanager.projects.getIamPolicy`
* `run.jobs.list`
* `run.revisions.list`

## Prerequisites

* Existing P0 account at [p0.app](https://p0.app/).
* Existing Google project(s) where you want to install P0.
* Permissions to create GCP roles and add IAM bindings to your Google project(s):
  * `iam.roleAdmin` (Role Admin)
  * `iam.securityAdmin` (Security Admin)

{% hint style="info" %}
You may need to work with your organization's administrator to obtain these permissions.
{% endhint %}

## Install the integration

1. Go to [p0.app](https://p0.app/), navigate to **Integrations**, and select **Google Cloud**.
2. If you have not connected an organization yet, enter your organization ID and click **Next**. To find your organization ID, run `gcloud organizations list` in the [Google Cloud Console Shell](https://console.cloud.google.com), or go to **IAM & Admin** > **Manage Resources**.
3. Choose the **IAM assessment** component.
4. Click **Add project**, enter the **Project identifier** of the GCP project you want to assess, and click **Next**.
5. Review the generated commands. P0 creates a custom role named **P0 IAM Auditor** (`p0IamAuditor`) with the read-only permissions required to collect IAM data, then grants it to the P0 service account.

## Provision access

Provision access using the [Google Cloud Console Shell](https://console.cloud.google.com) or Terraform. To use the Cloud Shell:

1. Go to your [Google Cloud project](https://console.cloud.google.com/) and select the project you entered in the previous step.
2. Open **Cloud Shell Editor**, then click **Open Terminal**.
3. If you use multiple Google accounts, run `gcloud config set account email@email.com` and replace the email with your account email.
4. Copy the **Shell** commands from the P0 configuration page, paste them into the terminal, and press `Return`. If an authorization window appears, click **Authorize**.
5. Return to the P0 configuration page and click **Next** to begin installation.

## Verify the installation

When the commands finish, click **Next** on the P0 configuration page. P0 validates that it can read your IAM data. When validation succeeds, the project appears as installed under the **IAM assessment** component.

## Next steps

* Create an environment and run your first scan. See [Creating an environment](/environments/creating-an-environment.md).
* View your results in [Access Inventory](/inventory/access-inventory.md) and [Posture](/posture/posture-overview.md).