Install IAM assessment on Google Cloud

Install the P0 IAM assessment integration on Google Cloud to collect IAM data. Required to use Access Inventory and Posture for your GCP projects.

Install the IAM assessment integration to let P0 collect and analyze the IAM configuration of your Google Cloud projects.

You must install the IAM assessment integration to use Access Inventory or Posture. P0 builds the identity graph and evaluates posture findings from the data this integration collects. Without it, Inventory and Posture have no data to display.

Prerequisites

• Existing P0 account at p0.app.

• Existing Google project(s) where you want to install P0.

• Permissions to create GCP roles and add IAM bindings to your Google project(s):

  • iam.roleAdmin (Role Admin)

  • iam.securityAdmin (Security Admin)

You may need to work with your organization's administrator to obtain these permissions.

Install the integration

1. Go to p0.app, navigate to Integrations, and select Google Cloud.

2. If you have not connected an organization yet, enter your organization ID and click Next. To find your organization ID, run gcloud organizations list in the Google Cloud Console Shell, or go to IAM & Admin > Manage Resources.

3. Choose the IAM assessment component.

4. Click Add project, enter the Project identifier of the GCP project you want to assess, and click Next.

5. Review the generated commands. P0 creates a custom role named P0 IAM Auditor (p0IamAuditor) with the read-only permissions required to collect IAM data, then grants it to the P0 service account.

Provision access

Provision access using the Google Cloud Console Shell or Terraform. To use the Cloud Shell:

1. Go to your Google Cloud project and select the project you entered in the previous step.

2. Open Cloud Shell Editor, then click Open Terminal.

3. If you use multiple Google accounts, run gcloud config set account [e-mail] and replace the email with your account email.

4. Copy the Shell commands from the P0 configuration page, paste them into the terminal, and press Return. If an authorization window appears, click Authorize.

5. Return to the P0 configuration page and click Next to begin installation.

Verify the installation

When the commands finish, click Next on the P0 configuration page. P0 validates that it can read your IAM data. When validation succeeds, the project appears as installed under the IAM assessment component.

Next steps

• Create an environment and run your first scan. See Creating an environment.

• View your results in Access Inventory and Posture.