Hello,
I am working on a Google Cloud / Google Workspace integration with SailPoint Identity Security Cloud and CIEM.
Current configuration:
-
Integration mode: Client Credentials
-
Enabled APIs:
- Admin SDK API
- Groups Settings API
- Identity and Access Management IAM API
- Cloud Resource Manager API
- Cloud Asset API
-
OAuth scopes currently configured:
-
https://www.googleapis.com/auth/admin.directory.rolemanagement
-
https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly
-
https://www.googleapis.com/auth/admin.directory.domain
The Google Workspace user used to generate and authorize the refresh token has elevated admin roles, including User Management Admin, Group Admin and Super Admin.
The Google Workspace user used to generate and authorize the refresh token has elevated admin roles, including User Management Admin, Group Admin and Super Admin.
The connector is not aggregating Google Cloud service accounts, for example the service accounts visible in Google Cloud Console under IAM & Admin > Service Accounts
From the SailPoint CIEM GCP documentation, it looks like CIEM requires the Google Workspace SaaS connector to use Service Account as the Grant Type, and Client Credentials is not supported for CIEM. The same documentation also lists GCP organization-level permissions such as:
- iam.serviceAccounts.list
- iam.serviceAccounts.getIamPolicy
- cloudasset.assets.searchAllResources
- cloudasset.assets.searchAllIamPolicies
- resourcemanager.projects.list
- resourcemanager.projects.get
Can someone confirm the following?
- Is it expected that GCP service accounts are not aggregated when the Google Workspace / GCP configuration uses Client Credentials?
- To aggregate Google Cloud service accounts with CIEM, is Service Account grant type mandatory?
- Should Google Cloud service accounts appear as account objects in the Google Workspace/GCP source, or are they only used by CIEM for cloud access/effective access visibility?
- Are Google Workspace admin roles such as Super Admin, User Management Admin and Group Admin relevant for reading GCP service accounts, or is the required access controlled only through GCP IAM permissions assigned to the SailPoint service account?
- Is the recommended configuration to create a GCP service account, assign the required custom GCP role at organization scope, configure domain-wide delegation for the Workspace part, and use the service account JSON key in the connector?
Thanks in advance for your support.
Looking forward to receiving a feedback.
Kind Regards,
Paolo