Skip to content
Guides
/
/
Google Cloud Security Con...

This guide walks you through enabling the required Google Cloud APIs, creating a service account with read access to Security Command Center and Cloud Asset Inventory, and collecting the values needed to connect Google Cloud Security to Synqly.

In Development

The Google Cloud Security connector is currently in development.

Prerequisites

Before you begin, make sure:

  • You know whether you want the integration to read data at the organization or project level.
  • Security Command Center is already activated for the Google Cloud scope you want to connect.
  • You can sign in to the Google Cloud Console with permission to enable APIs, create service accounts, and grant IAM roles on the target scope.

Enable the required APIs

Enable these APIs in the Google Cloud project where your service account will live:

  1. In the Google Cloud Console, go to APIs & Services -> Library.
  2. Search for and enable Security Command Center API.
  3. Search for and enable Cloud Asset API.

Create a service account and assign permissions

Creating a dedicated service account for this integration is recommended. Reusing an existing service account is a power-user setup and should only be done if you understand the access and lifecycle trade-offs.

1. Create the service account

Follow the Google documentation to create a service account.

Give the service account a clear name such as integration-google-cloud-security.

2. Grant the required IAM roles on your target scope

Grant the service account access on the same organization or project you plan to use in scope_path.

Assign the following roles on the target scope:

RoleIAM identifierEnablesRequired
Security Center Findings Viewerroles/securitycenter.findingsViewerquery_compliance_findings, query_ioms, and query_threatsYes
Cloud Asset Viewerroles/cloudasset.viewerquery_cloud_resource_inventoryYes
Service Usage Consumerroles/serviceusage.serviceUsageConsumerCloud Asset Inventory API access in environments where serviceusage.services.use is requiredOptional

If your organization prefers broader read-only access, Security Center Admin Viewer (roles/securitycenter.adminViewer) can be used instead of Security Center Findings Viewer.

3. Create a JSON key for the service account

Create a JSON key for the service account by following the Google documentation to create a service account key.

Unlike the Google Workspace Identity setup, this connector does not use domain-wide delegation.

Download the JSON key and keep it secure. You will need these values from the file:

  • client_email
  • client_id
  • private_key
  • token_uri

Choose your scope_path

The scope_path is used to determine which Google Cloud scope to query for findings and inventory.

Supported formats:

  • organizations/{numeric_id}
  • projects/{project_id}
  • projects/{project_number}

Examples:

  • organizations/123456789012
  • projects/my-production-project
  • projects/123456789012

Use an organization-scoped path when you want coverage across the full organization. Use a project-scoped path when you want to limit the integration to a single project.

Configure the integration

Create your integration in Synqly with the following values.

Credential: Token URL (Optional) Leave this blank to use the default Google token URL: https://oauth2.googleapis.com/token

Credential: Client Email The client_email value from your service account JSON key.

Credential: Client ID The client_id value from your service account JSON key.

Credential: Secret The private_key value from your service account JSON key. This is the full PEM-encoded private key string from the downloaded JSON file.

Scope Path The organization or project scope you want Synqly to read, formatted exactly as described in the scope_path section above.

Previous page
Next page