Create Service Account and Download Configuration File
You need to enable access to the necessary APIs from the API library.
Enable Access to APIs in API library
- Navigate to the Google Cloud Platform (GCP) console.
- Select the organization.
- To onboard all the projects, navigate to APIs and Services > Library.
- Select a project or create a new project. Ensure that you have selected the correct project.
- In the API library, click the following APIs and enable them. If you need help finding the API, use the search field.
- Compute Engine API (Mandatory)
- Cloud Resource Manager API (Mandatory)
- Kubernetes Engine API
- Cloud SQL Admin API
- BigQuery API
- Cloud Functions API
- Cloud DNS API
- Cloud Key Management Service (KMS) API
- Cloud Logging API
- Stackdriver Monitoring API
- Identity and Access Management (IAM) API
- Cloud Pub/Sub API
- Service Usage API
- Cloud Dataproc API
- API Keys API
Create Service Account and Download Configuration File
- Login to the GCP console and select an Organization.
- Select a project or create a new project. Ensure you have selected the correct project.
- From the left sidebar, navigate to IAM & admin > Service accounts and click CREATE SERVICE ACCOUNT.
- Provide a service account ID, name (optional), and description (optional) for the service account, and click CREATE.
- Next, navigate to IAM & Services > IAM and click ADD.
- Enter your service account in New Principal.
- Add the following roles in the Role field and click SAVE.
- Resource Manager -> Organization Viewer
- Resource Manager -> Folder Viewer
- Security Reviewer
- Select the newly created service account.
- Click Actions > Manage Keys > Add Key > Create a new Key. Select JSON as the key type and click Create (A message saying "Private key saved to your computer" is displayed, and the JSON file is downloaded to your computer).
- Upload the configuration (JSON) file to complete GCP connector creation in Qualys Cloud Platform.
If you want to use the same service account for setting up connectors for additional projects, you can assign service account as a member in IAM at the organization level or at the project level.
Let us view the steps for the same.
Assign Service Account in IAM at project levelAssign Service Account in IAM at project level
(1) Login to Google Cloud Platform (GCP) console.
(2) From the left navigation bar, select IAM & admin.
(3) Select the project from the drop-down menu in the top-left corner.
(4) In the IAM menu bar, click +ADD.
(5) In the New Members box, type the name of the service account and click the suggested value.
(6) In the Select a role drop-down box, select the appropriate role. Choose Viewer role and Security Reviewer role to assign at least reader permissions to the service account.
(7) Click Save.
(8) To add additional projects, repeat steps 3 through 7.
(1) Login to Google Cloud Platform (GCP) console.
(2) In the left navigation bar, select IAM & admin.
(3) Select your organization from the drop-down menu in the top-left corner.
(4) In the IAM menu bar, click +ADD.
(5) In the New Members box, type the name of the service account and click the suggested value.
(6) In the Select a role drop-down box, select the appropriate role. Choose Viewer role and Security Reviewer role to assign at least reader permissions to the service account.
(7) Click Save.