{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-guides/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"Google Network Security Provider Configuration Guide","siteUrl":"https://docs.synqly.com","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This guide walks you through enabling the required Google Cloud APIs, creating a service account with read access to VPC Flow Logs, and gathering the configuration needed to create a Google Network Security integration with Synqly."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Synqly discovers both Network Management VPC Flow Logs configs and Compute subnetworks with flow"," ","logging enabled. Traffic events are read from Cloud Logging. If both logging surfaces are enabled"," ","for the same traffic, the same flows can appear twice in query results."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"prerequisites","__idx":0},"children":["Prerequisites"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before you begin, make sure:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["You have a Google Cloud project with VPC Flow Logs enabled"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["You can sign in to the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://console.cloud.google.com/"},"children":["Google Cloud Console"]}," with permission to enable APIs, create service accounts, and grant IAM roles"]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"enable-the-required-apis","__idx":1},"children":["Enable the required APIs"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Enable these APIs in the Google Cloud project where your service account will live:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["In the Google Cloud Console, go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["APIs & Services → Library"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Search for and enable ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Compute Engine API"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Search for and enable ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Cloud Logging API"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Search for and enable ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Network Management API"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"required-iam-roles","__idx":2},"children":["Required IAM Roles"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Role"},"children":["Role"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"IAM identifier"},"children":["IAM identifier"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Purpose"},"children":["Purpose"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Network Management Viewer"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["roles/networkmanagement.viewer"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Discover Network Management VPC Flow Logs configs"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Compute Network Viewer"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["roles/compute.networkViewer"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Discover Compute subnetworks with flow logging enabled"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Logs Viewer"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["roles/logging.viewer"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Query VPC flow log entries from Cloud Logging"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"create-a-service-account-and-assign-permissions","__idx":3},"children":["Create a service account and assign permissions"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Creating a dedicated service account for this integration is recommended. Reusing an existing service account is a power-user setup and should only be done if you understand the access and lifecycle trade-offs."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"1-create-the-service-account","__idx":4},"children":["1. Create the service account"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Follow the Google documentation to ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://cloud.google.com/iam/docs/service-accounts-create"},"children":["create a service account"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Give the service account a clear name such as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["integration-google-network-security"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"2-grant-the-required-iam-roles","__idx":5},"children":["2. Grant the required IAM roles"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Grant each of the roles from ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#required-iam-roles"},"children":["Required IAM Roles"]}," to the service account on the project the integration will use. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://cloud.google.com/iam/docs/grant-role-sa"},"children":["Grant a single role"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"3-create-a-json-key-for-the-service-account","__idx":6},"children":["3. Create a JSON key for the service account"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Create a JSON key for the service account by following the Google documentation to ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://cloud.google.com/iam/docs/keys-create-delete#iam-service-account-keys-create-console"},"children":["create a service account key"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Download the JSON key and keep it secure. You will need these values from the file:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_email"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_id"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["private_key"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["token_uri"]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Also note the Google Cloud ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["project ID"]}," for the project that contains your networking resources."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"configure-the-integration","__idx":7},"children":["Configure the Integration"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Create your integration by supplying the following values."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Credential: Token URL (Optional)"]}," ","Leave this blank to use the default Google token URL: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://oauth2.googleapis.com/token"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Credential: Client Email"]}," ","The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_email"]}," value from your service account JSON key."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Credential: Client ID"]}," ","The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["client_id"]}," value from your service account JSON key."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Credential: Secret"]}," ","The ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["private_key"]}," value from your service account JSON key. This is the full PEM-encoded private key string from the downloaded JSON file."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Project ID"]}," ","The Google Cloud project ID that contains the networking resources for the integration."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Traffic Log Configuration IDs (Optional)"]}," ","One or more fully qualified configuration identifiers. Accepts a Network Management path (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["projects/{project}/locations/global/vpcFlowLogsConfigs/{name}"]},") or a Compute subnetwork path or selfLink (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["projects/{project}/regions/{region}/subnetworks/{name}"]},"). Bare names are rejected, and an identifier that does not resolve fails the query. When omitted, all discoverable configurations in the project are used."]}]},"headings":[{"value":"Prerequisites","id":"prerequisites","depth":2},{"value":"Enable the required APIs","id":"enable-the-required-apis","depth":2},{"value":"Required IAM Roles","id":"required-iam-roles","depth":2},{"value":"Create a service account and assign permissions","id":"create-a-service-account-and-assign-permissions","depth":2},{"value":"1. Create the service account","id":"1-create-the-service-account","depth":3},{"value":"2. Grant the required IAM roles","id":"2-grant-the-required-iam-roles","depth":3},{"value":"3. Create a JSON key for the service account","id":"3-create-a-json-key-for-the-service-account","depth":3},{"value":"Configure the Integration","id":"configure-the-integration","depth":2}],"frontmatter":{"slug":"guides/provider-configuration/google-networksecurity-setup","seo":{"title":"Google Network Security Provider Configuration Guide"}},"lastModified":"2026-08-19T20:11:23.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/provider-configuration/google-networksecurity-setup","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}