☁️Google Cloud

Set up P0's integration for Google Cloud Platform. Configure IAM management, just-in-time access, and privilege governance for your GCP environment.

This topic describes how to set up P0's integration for Google Cloud Platform (GCP). It contains the following sections:

• Prerequisites

• Set up Google Cloud Integration

For fine-grained Kubernetes access in Google Kubernetes Engine (GKE), use the P0 Kubernetes integration.

Prerequisites

• Existing P0 account at p0.app.

• Existing Google project(s) where you want to install P0.

• Permissions to create GCP roles and add IAM bindings to your Google project(s).

  • iam.roleAdmin (Role Admin)

  • iam.securityAdmin (Security Admin)

  • orgpolicy.policyAdmin (Organization Policy Admin). This is optional but recommended, to ensure your P0 integration for GCP is as secure as possible

You may need to work with your organization's administrator for the relevant permissions.

Set up Google Cloud Integration

This setup takes about 10 minutes.

Google Cloud Integration requires these key setup steps:

1. Set up your Organization

2. Install a Component

3. Provision P0 Access

Set up your Organization

You must set up your organization prior to GCP provisioning. To set up p0 for your GCP organization:

1. Retrieve your organization ID from GCP using one of the following methods:

   • Run the command gcloud organizations list in the Google Cloud Console Shell.

   • Go to IAM & Admin > Manage Resources. You will find your organization ID listed under the ID field.

   
2. Go to p0.app in your browser, navigate to Integrations, and select Google Cloud.

   
3. Copy and paste your organization ID into the input field and click Next. This enables you to install components that fit your needs.

If a previous Google Cloud integration is present, the field is disabled and pre-populated with the organization ID, so proceed to the next step.

Install a Component

For this example, we’ll install an Identity and Access Management (IAM) component.

The steps are similar for other components except IAM management. You need to install cloud run based IAM management security perimeter component before installing IAM management. Contact P0 support to skip installing security perimeter.

Contact P0 support to use domain restricted sharing instead of cloud run based security perimeter.

To install an IAM component:

1. Choose the component you want to install (e.g. IAM management).

   
2. Click Add project to install a new project.

   
3. Enter your existing GCP project name into the Project identifier field and click Next.

   
4. The resulting page will display GCP and Terraform commands to complete the installation.

   

Provision P0 Access

You can provision P0 IAM management Access using Google Cloud Console Shell or Terraform. For this example, we’ll use the GCP console shell.

You must have access to your project for it to appear in your GCP account. Refer to the Prerequisites for more info.

To provision access using the GCP shell:

1. Go to your GCP account and select the project you want to provision.

   
2. Open Cloud Shell Editor from the left menu, or use the search bar.

   
3. Click Open Terminal. This is where you’ll enter your shell commands.

   
4. If your browser is logged into multiple Google accounts, enter the command gcloud config set account [e-mail], and replace [e-mail] with your account email.

5. Use the copy button to copy the entire Shell command set.

   
6. Paste the commands into the terminal window and press Return.

   

If an Authorize window appears, click Authorize to grant permission.

1. Return to the configuration page and click Next to begin the installation process.

   
2. When the installation completes, click Finish.

   

Congratulations! You're now set up with P0 on Google Cloud.

Install IAM management on each project

IAM management binds P0's custom role at the project level, so it covers only the projects you add. Projects you create later aren't covered until you install the component on them, even though you gave P0 an organization ID during setup.

Repeat Install a Component and Provision P0 Access for every project you want P0 to manage. If you add projects regularly, make the install part of the process that provisions the project.

Organization-level binding is available for IAM assessment, which inherits its grant across all folders and projects. IAM management does not offer this.

Troubleshooting

"Permission 'resourcemanager.projects.getIamPolicy' denied"

P0 reports an error like this, either when you verify the installation or in the weekly install-issues email:

Error in service Google Cloud: P0 does not have permission to perform this operation.
Please ask your P0 admin to verify your Google Cloud installation.
Message from Google Cloud was: Permission 'resourcemanager.projects.getIamPolicy' denied on
resource '//cloudresourcemanager.googleapis.com/projects/<project-id>' (or it may not exist).

P0 reads a project's IAM policy to discover who has access and to grant access at request time. The IAM management install grants resourcemanager.projects.getIamPolicy to P0's service account on the project. Depending on your install path, this comes through the P0 IAM Admin custom role, or through the P0 IAM Manager custom role plus the predefined roles/iam.securityReviewer role (used when you install the security perimeter component first). The error means P0 can't use that permission on the project it names. Common causes:

Cause	Fix
The project was never installed. This is the usual cause when the project was created after you set up P0.	Install IAM management on that project. See Install IAM management on each project.
P0's role binding on the project was deleted or edited after install — the P0 IAM Admin or P0 IAM Manager custom role, or the roles/iam.securityReviewer binding.	Rerun the project's install commands to recreate the roles and bindings.
The Cloud Resource Manager API is disabled on the project.	Enable cloudresourcemanager.googleapis.com on the project.
The project was deleted, or the ID in the error is wrong.	Remove the project from the IAM management component in P0.

Until you fix it, the alert repeats and P0 can't broker access to that project.