> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/environments/creating-an-environment/install-iam-assessment-google-cloud.md).

# Install IAM assessment on Google Cloud

Install the **IAM assessment** integration to let P0 collect and analyze the IAM configuration of your Google Cloud projects.

{% hint style="warning" %}
You must install the **IAM assessment** integration to use **Access Inventory** or **Posture**. P0 builds the identity graph and evaluates posture findings from the data this integration collects. Without it, Inventory and Posture have no data to display.
{% endhint %}

## Prerequisites

* Existing P0 account at [p0.app](https://p0.app/).
* Existing Google project(s) where you want to install P0.
* Permissions to create GCP roles and add IAM bindings to your Google project(s):
  * `iam.roleAdmin` (Role Admin)
  * `iam.securityAdmin` (Security Admin)

{% hint style="info" %}
You may need to work with your organization's administrator to obtain these permissions.
{% endhint %}

## Install the integration

1. Go to [p0.app](https://p0.app/), navigate to **Integrations**, and select **Google Cloud**.
2. If you have not connected an organization yet, enter your organization ID and click **Next**. To find your organization ID, run `gcloud organizations list` in the [Google Cloud Console Shell](https://console.cloud.google.com), or go to **IAM & Admin** > **Manage Resources**.
3. Choose the **IAM assessment** component.
4. Click **Add project**, enter the **Project identifier** of the GCP project you want to assess, and click **Next**.
5. Review the generated commands. P0 creates a custom role named **P0 IAM Auditor** (`p0IamAuditor`) with the read-only permissions required to collect IAM data, then grants it to the P0 service account.

## Provision access

Provision access using the [Google Cloud Console Shell](https://console.cloud.google.com) or Terraform. To use the Cloud Shell:

1. Go to your [Google Cloud project](https://console.cloud.google.com/) and select the project you entered in the previous step.
2. Open **Cloud Shell Editor**, then click **Open Terminal**.
3. If you use multiple Google accounts, run `gcloud config set account email@email.com` and replace the email with your account email.
4. Copy the **Shell** commands from the P0 configuration page, paste them into the terminal, and press `Return`. If an authorization window appears, click **Authorize**.
5. Return to the P0 configuration page and click **Next** to begin installation.

## Verify the installation

When the commands finish, click **Next** on the P0 configuration page. P0 validates that it can read your IAM data. When validation succeeds, the project appears as installed under the **IAM assessment** component.

## Next steps

* Create an environment and run your first scan. See [Creating an environment](/environments/creating-an-environment.md).
* View your results in [Access Inventory](/inventory/access-inventory.md) and [Posture](/posture/posture-overview.md).