---
updatedAt: 2026-08-13T08:16:40.000Z
agentTools:
  projectIndex: https://docs.axonius.com/llms.txt
---

# GCP Initial Setup

To connect Axonius to Google Cloud Platform, you first need to:

1. Enable cloud APIs
2. Create a service account and grant permissions to that service account

## 1. Enable Cloud APIs

1. Navigate to the [Google Cloud Console](https://console.cloud.google.com/) and select the project that you want Axonius to connect to.

2. Navigate to **APIs & Services **`>`**  Dashboard**. ![](https://raw.githubusercontent.com/Axonius/ax-docs-pub/refs/heads/main/Images/image\(460\).png)

3. The following APIs are required:

<Table>
  <thead>
    <tr>
      <th>
        Enabled API Name
      </th>

      <th>
        Required / Optional
      </th>

      <th>
        Used for
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        Compute Engine API
      </td>

      <td>
        Required
      </td>

      <td>
        The adapter to fetch assets data from Google Cloud Platform.
      </td>
    </tr>

    <tr>
      <td>
        Cloud Resource Manager API
      </td>

      <td>
        Required
      </td>

      <td>
        The adapter to fetch assets data from Google Cloud Platform.
      </td>
    </tr>

    <tr>
      <td>
        Container Artifact API
      </td>

      <td>
        Required
      </td>

      <td>
        `https://container.googleapis.com`
      </td>
    </tr>

    <tr>
      <td>
        Identity and Access Management (IAM) API
      </td>

      <td>
        Required
      </td>

      <td>
        `https://iam.googleapis.com`
      </td>
    </tr>

    <tr>
      <td>
        Security Command Center API
      </td>

      <td>
        Required
      </td>

      <td>
        `https://securitycenter.googleapis.com`
      </td>
    </tr>

    <tr>
      <td>
        Google Cloud Storage JSON API
      </td>

      <td>
        Optional
      </td>

      <td>
        [Advanced Settings](https://docs.axonius.com/axonius-help-docs/docs/gcp-advanced-settings)**:**

        - **Fetch Google Cloud Storage buckets** - Fetch all Google Cloud Storage buckets
        - **Fetch Object metadata in Google Cloud Storage buckets** - Fetch Object metadata in GCP Storage buckets.
      </td>
    </tr>

    <tr>
      <td>
        Cloud SQL Admin API
      </td>

      <td>
        Optional
      </td>

      <td>
        [Advanced Settings](https://docs.axonius.com/axonius-help-docs/docs/gcp-advanced-settings)**:**

        - **Fetch Google Cloud SQL database instances** - Fetch all Google Cloud SQL instances.
      </td>
    </tr>

    <tr>
      <td>
        [Cloud DNS API ](https://docs.cloud.google.com/dns/docs/reference/rest)
      </td>

      <td>
        Optional
      </td>

      <td>
        [Advanced Settings](https://docs.axonius.com/axonius-help-docs/docs/gcp-advanced-settings)**:**

        - **Fetch Google Cloud DNS Managed Zones** - Fetch DNS managed zones from Google Cloud DNS.
      </td>
    </tr>

    <tr>
      <td>
        [Secret Manager API](https://docs.cloud.google.com/secret-manager/docs/reference/rest?rep_location=me-central2)
      </td>

      <td>
        Optional
      </td>

      <td>
        [Advanced Settings](https://docs.axonius.com/axonius-help-docs/docs/gcp-advanced-settings):

        - **Fetch Google Cloud Secret Manager Secrets** - Fetch metadata from Google Cloud Secret Manager secrets across your GCP projects.
      </td>
    </tr>
  </tbody>
</Table>

For example, in the screenshot below you can see that since the **Cloud Resource Manager API** doesn't appear in the list, it isn't enabled and needs to be enabled. ![](https://raw.githubusercontent.com/Axonius/ax-docs-pub/refs/heads/main/Images/image\(461\).png)

To enable an API, click **Enable APIs and Services** at the top of the page.

4. Search for the API you want to enable and select it. For example: **Cloud Resource Manager API** ![](https://raw.githubusercontent.com/Axonius/ax-docs-pub/refs/heads/main/Images/image\(462\).png)

5. Click **Enable**. ![](https://raw.githubusercontent.com/Axonius/ax-docs-pub/refs/heads/main/Images/image\(463\).png)

## 2. Create a Service Account and Grant Permissions to that Service Account

1. Navigate to the [Google Cloud Console](https://console.cloud.google.com/) and select the project that you want Axonius to connect to.

2. Select **IAM & admin** `>`  **Service accounts**. ![](https://raw.githubusercontent.com/Axonius/ax-docs-pub/refs/heads/main/Images/image\(115\).png) 

3. Click **Create a Service Account**.

![GCPService1.png](https://raw.githubusercontent.com/Axonius/ax-docs-pub/refs/heads/main/Images/GCPService1\(1\).png)

4. Provide a name and description for the service account, then click **Create**. If you already clicked **Done**, skip to Step 8.

![GCPService2.png](https://raw.githubusercontent.com/Axonius/ax-docs-pub/refs/heads/main/Images/GCPService2\(1\).png)

5. In the **Grant this service account access to a project** section, give the service account the roles listed below, as well as the "Security Reviewer" role.

<Table>
  <thead>
    <tr>
      <th>
        Role Name
      </th>

      <th>
        Required / Optional
      </th>

      <th>
        Used for
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        Compute Viewer
      </td>

      <td>
        Required
      </td>

      <td>
        Grants read-only access to Axonius to fetch assets.
      </td>
    </tr>

    <tr>
      <td>
        Kubernetes Engine Viewer
      </td>

      <td>
        Required
      </td>

      <td>
        Grants read-only access to Axonius to fetch assets.
      </td>
    </tr>

    <tr>
      <td>
        Storage Object Viewer
      </td>

      <td>
        Optional
      </td>

      <td>
        [Advanced Settings](https://docs.axonius.com/axonius-help-docs/docs/gcp-advanced-settings)**:**

        - **Fetch Google Cloud Storage buckets** - Fetch all Google Cloud Storage buckets.
        - **Fetch Object metadata in Google Cloud Storage buckets** - Fetch Object metadata in GCP Storage buckets.
      </td>
    </tr>

    <tr>
      <td>
        Cloud SQL Viewer
      </td>

      <td>
        Optional
      </td>

      <td>
        [Advanced Settings](https://docs.axonius.com/axonius-help-docs/docs/gcp-advanced-settings)**:**

        - **Fetch Google Cloud SQL database instances** - Fetch all Google Cloud SQL instances.
      </td>
    </tr>

    <tr>
      <td>
        IAM: Role Viewer
      </td>

      <td>
        Optional
      </td>

      <td>
        [Advanced Settings](https://docs.axonius.com/axonius-help-docs/docs/gcp-advanced-settings)**:**

        - **Fetch IAM permissions for users** - Fetch IAM permissions and associate those to the users roles.
      </td>
    </tr>

    <tr>
      <td>
        Security Reviewer
      </td>

      <td>
        Required
      </td>

      <td>
        Provides permissions to list all resources and allow policies on them.
      </td>
    </tr>
  </tbody>
</Table>

![GCPService3.png](https://raw.githubusercontent.com/Axonius/ax-docs-pub/refs/heads/main/Images/GCPService3.png)

6. Skip the **Grant users access to this service account** step.
7. Click **Done**.
8. To modify, or review the permissions granted to this service account in any project or at the organization level, go to IAM, find the service account you've created and click **Edit Permissions**.

![GCPService4.png](https://raw.githubusercontent.com/Axonius/ax-docs-pub/refs/heads/main/Images/GCPService4.png)

![GCPService5.png](https://raw.githubusercontent.com/Axonius/ax-docs-pub/refs/heads/main/Images/GCPService5.png)

![GCPSErvice6.png](https://raw.githubusercontent.com/Axonius/ax-docs-pub/refs/heads/main/Images/GCPSErvice6.png)

9. In the Service Account just created, go to **Keys**.

10. Click **Add key** and then **Create**. ![](https://raw.githubusercontent.com/Axonius/ax-docs-pub/refs/heads/main/Images/image\(118\).png)

11. Your JSON key is subsequently downloaded. Finish creating the account and go back to the Service Accounts page. Copy the email address of the new service account.

12. In the top part of the page, select the organization resource, and go to **IAM & Admin - IAM**.
    1. Click **Add** and use the service account email to add the new service account as a new member of the organization.
    2. Click **+ Add Another role** to add the following roles to added member:

<Table>
  <thead>
    <tr>
      <th>
        Role Name
      </th>

      <th>
        Required / Optional
      </th>

      <th>
        Used for
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        Compute Viewer
      </td>

      <td>
        Required
      </td>

      <td>
        Grants read-only access to Axonius to fetch assets.
      </td>
    </tr>

    <tr>
      <td>
        Kubernetes Engine Viewer
      </td>

      <td>
        Required
      </td>

      <td>
        Grants read-only access to Axonius to fetch assets.
      </td>
    </tr>

    <tr>
      <td>
        Storage Object Viewer
      </td>

      <td>
        Optional
      </td>

      <td>
        [Advanced Settings](https://docs.axonius.com/axonius-help-docs/docs/gcp-advanced-settings)**:**

        - **Fetch Google Cloud Storage buckets** - Fetch all Google Cloud Storage buckets.
        - **Fetch Object metadata in Google Cloud Storage buckets** - Fetch Object metadata in GCP Storage buckets.
      </td>
    </tr>

    <tr>
      <td>
        Cloud SQL Viewer
      </td>

      <td>
        Optional
      </td>

      <td>
        [Advanced Settings](https://docs.axonius.com/axonius-help-docs/docs/gcp-advanced-settings)**:**

        - **Fetch Google Cloud SQL database instances** - Fetch all Google Cloud SQL instances.
      </td>
    </tr>

    <tr>
      <td>
        IAM: Role Viewer
      </td>

      <td>
        Optional
      </td>

      <td>
        [Advanced Settings](https://docs.axonius.com/axonius-help-docs/docs/gcp-advanced-settings)**:**

        - **Fetch IAM permissions for users** - Fetch IAM permissions and associate those to the users roles.
      </td>
    </tr>

    <tr>
      <td>
        • Security Center Findings Viewer role• Security Center Assets Viewer role(Or alternatively, Security Center Admin)
      </td>

      <td>
        Optional
      </td>

      <td>
        [Advanced Settings](https://docs.axonius.com/axonius-help-docs/docs/gcp-advanced-settings)**:**

        - **Security Command Center organizations** - Fetch Security Command Center device assets and their associated vulnerabilities from a specified list of organizations (NOTE: Those organization-level roles are required for each of the specified organizations.)
      </td>
    </tr>
  </tbody>
</Table>

![image.png](https://raw.githubusercontent.com/Axonius/ax-docs-pub/refs/heads/main/Images/image\(1233\).png)

12. Click **Save**.

<Callout icon="🚧" theme="warn">
  **Note**

  GCP Enforcement Actions require additional permissions, as detailed in each Enforcement Action page:

  - [GCP - Add or Remove Tags to/from Assets](/docs/gce-compute-add-tags)
  - [GCP - Add or Remove Labels to/from Assets](https://docs.axonius.com/axonius-help-docs/docs/gcp-add-or-remove-labels-tofrom-assets)
  - [GCP - Send Object To Bucket](https://docs.axonius.com/axonius-help-docs/docs/send-object-to-gce)
</Callout>