Install IAM assessment on Google Cloud

Install the P0 IAM assessment integration on Google Cloud to collect IAM data. Required to use Access Inventory and Posture for your GCP projects.

Install the IAM assessment integration to let P0 collect and analyze the IAM configuration of your Google Cloud projects.

You must install the IAM assessment integration to use Access Inventory or Posture. P0 builds the identity graph and evaluates posture findings from the data this integration collects. Without it, Inventory and Posture have no data to display.

What data P0 collects

The IAM assessment grants P0 a read-only custom role and uses it to collect the IAM configuration of your projects. P0 reads metadata and configuration only. It doesn't read the contents of your storage buckets, databases, or other application data.

P0 collects the following datasets:

Dataset	What it includes	Google Cloud API
IAM policy bindings	Role grants on organizations, folders, projects, and resources, including inherited (ancestor) bindings	Cloud Asset API
Resource inventory	Resources in scope, such as Compute instances, storage buckets, service accounts, and BigQuery datasets	Cloud Asset API
Roles	Predefined and custom role definitions and their permissions	IAM API
Service accounts	Service accounts and their metadata	IAM API
Service account keys	Key metadata, such as creation date and key type (P0 does not read private key material)	IAM API
Service account activity	Authentication-event counts used to detect unused identities and keys	Cloud Monitoring API
IAM recommendations	Google's IAM policy insights, such as over-privileged or unused grants	Recommender API
Policy analysis	Effective access derived from analyzeIamPolicy	Cloud Asset API
Compute and Cloud Run identities	Service identities attached to Compute instances and Cloud Run services and jobs	Compute Engine API, Cloud Run API
Essential contacts	Project technical contacts	Essential Contacts API

P0 collects this data when you first install the integration and refreshes it on each scan.

Required Google Cloud APIs

Enable the following APIs on each project you assess. The custom role's permissions depend on these services, so the assessment fails to read data if an API is disabled.

API	Service name	Used for
Cloud Asset API	cloudasset.googleapis.com	IAM policy bindings, resource inventory, policy analysis
Cloud Resource Manager API	cloudresourcemanager.googleapis.com	Project, folder, and organization metadata and IAM policies
Identity and Access Management (IAM) API	iam.googleapis.com	Roles, service accounts, and key metadata
Cloud Monitoring API	monitoring.googleapis.com	Service account and key activity
Recommender API	recommender.googleapis.com	IAM policy insights and recommendations
Compute Engine API	compute.googleapis.com	Compute instance and service-identity data
Cloud Run Admin API	run.googleapis.com	Cloud Run service and job identities
Essential Contacts API	essentialcontacts.googleapis.com	Project technical contacts

The commands P0 generates during installation enable the required APIs and create the custom role for you. Enable the APIs manually only if your organization restricts API enablement or uses a separate provisioning process.

Project-level vs organization-level configuration

You can install the IAM assessment on individual projects or across an entire organization. The data P0 collects is the same; the scope of the role binding and the permissions differ.

Project-level install

Install on one or more specific projects. For each project, P0:

• Creates the P0 IAM Auditor (p0IamAuditor) custom role at the project level.

• Grants the role to the P0 service account on that project.

• Enables the required APIs on that project.

A project-level install assesses only the projects you add.

Organization-level install

Install once at the organization to assess every project in the hierarchy. P0:

• Creates the custom role at the organization level and grants it to the P0 service account on the organization. The grant is inherited by all folders and projects, so you don't bind the role to each project individually.

• Adds the following organization- and folder-level permissions to the role, on top of the project-level permissions, so P0 can read the resource hierarchy and enumerate projects:

  • resourcemanager.organizations.get

  • resourcemanager.organizations.getIamPolicy

  • resourcemanager.folders.get

  • resourcemanager.folders.list

  • resourcemanager.folders.getIamPolicy

  • resourcemanager.projects.list

Enable the required APIs on each project you want to assess, even with an organization-level install. The custom role binding is inherited across the hierarchy, but API enablement is per project.

The permissions the custom role grants at the project level are:

• cloudasset.assets.analyzeIamPolicy

• cloudasset.assets.searchAllIamPolicies

• cloudasset.assets.searchAllResources

• compute.instances.list

• compute.projects.get

• compute.zones.list

• essentialcontacts.contacts.list

• iam.roles.get

• iam.roles.list

• iam.serviceAccountKeys.list

• iam.serviceAccounts.get

• monitoring.timeSeries.list

• recommender.iamPolicyInsights.list

• resourcemanager.projects.get

• resourcemanager.projects.getIamPolicy

• run.jobs.list

• run.revisions.list

Prerequisites

• Existing P0 account at p0.app.

• Existing Google project(s) where you want to install P0.

• Permissions to create GCP roles and add IAM bindings to your Google project(s):

  • iam.roleAdmin (Role Admin)

  • iam.securityAdmin (Security Admin)

You may need to work with your organization's administrator to obtain these permissions.

Install the integration

1. Go to p0.app, navigate to Integrations, and select Google Cloud.

2. If you have not connected an organization yet, enter your organization ID and click Next. To find your organization ID, run gcloud organizations list in the Google Cloud Console Shell, or go to IAM & Admin > Manage Resources.

3. Choose the IAM assessment component.

4. Click Add project, enter the Project identifier of the GCP project you want to assess, and click Next.

5. Review the generated commands. P0 creates a custom role named P0 IAM Auditor (p0IamAuditor) with the read-only permissions required to collect IAM data, then grants it to the P0 service account.

Provision access

Provision access using the Google Cloud Console Shell or Terraform. To use the Cloud Shell:

1. Go to your Google Cloud project and select the project you entered in the previous step.

2. Open Cloud Shell Editor, then click Open Terminal.

3. If you use multiple Google accounts, run gcloud config set account [e-mail] and replace the email with your account email.

4. Copy the Shell commands from the P0 configuration page, paste them into the terminal, and press Return. If an authorization window appears, click Authorize.

5. Return to the P0 configuration page and click Next to begin installation.

Verify the installation

When the commands finish, click Next on the P0 configuration page. P0 validates that it can read your IAM data. When validation succeeds, the project appears as installed under the IAM assessment component.

Next steps

• Create an environment and run your first scan. See Creating an environment.

• View your results in Access Inventory and Posture.