Google Network Security Provider Configuration Guide

This guide walks you through enabling the required Google Cloud APIs, creating a service account with read access to VPC Flow Logs, and gathering the configuration needed to create a Google Network Security integration with Synqly.

Synqly discovers both Network Management VPC Flow Logs configs and Compute subnetworks with flow logging enabled. Traffic events are read from Cloud Logging. If both logging surfaces are enabled for the same traffic, the same flows can appear twice in query results.

Prerequisites

Before you begin, make sure:

You have a Google Cloud project with VPC Flow Logs enabled
You can sign in to the Google Cloud Console with permission to enable APIs, create service accounts, and grant IAM roles

Enable the required APIs

Enable these APIs in the Google Cloud project where your service account will live:

In the Google Cloud Console, go to APIs & Services → Library.
Search for and enable Compute Engine API.
Search for and enable Cloud Logging API.
Search for and enable Network Management API.

Required IAM Roles

Role	IAM identifier	Purpose
Network Management Viewer	`roles/networkmanagement.viewer`	Discover Network Management VPC Flow Logs configs
Compute Network Viewer	`roles/compute.networkViewer`	Discover Compute subnetworks with flow logging enabled
Logs Viewer	`roles/logging.viewer`	Query VPC flow log entries from Cloud Logging

Create a service account and assign permissions

Creating a dedicated service account for this integration is recommended. Reusing an existing service account is a power-user setup and should only be done if you understand the access and lifecycle trade-offs.

1. Create the service account

Follow the Google documentation to create a service account.

Give the service account a clear name such as integration-google-network-security.

2. Grant the required IAM roles

Grant each of the roles from Required IAM Roles to the service account on the project the integration will use. See Grant a single role.

3. Create a JSON key for the service account

Create a JSON key for the service account by following the Google documentation to create a service account key.

Download the JSON key and keep it secure. You will need these values from the file:

client_email
client_id
private_key
token_uri

Also note the Google Cloud project ID for the project that contains your networking resources.

Configure the Integration

Create your integration by supplying the following values.

Credential: Token URL (Optional) Leave this blank to use the default Google token URL: https://oauth2.googleapis.com/token

Credential: Client Email The client_email value from your service account JSON key.

Credential: Client ID The client_id value from your service account JSON key.

Credential: Secret The private_key value from your service account JSON key. This is the full PEM-encoded private key string from the downloaded JSON file.

Project ID The Google Cloud project ID that contains the networking resources for the integration.

Traffic Log Configuration IDs (Optional) One or more fully qualified configuration identifiers. Accepts a Network Management path (projects/{project}/locations/global/vpcFlowLogsConfigs/{name}) or a Compute subnetwork path or selfLink (projects/{project}/regions/{region}/subnetworks/{name}). Bare names are rejected, and an identifier that does not resolve fails the query. When omitted, all discoverable configurations in the project are used.