GCP CIEM connector with Client Credentials does not aggregate Google Cloud Service Accounts

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hello,

I am working on a Google Cloud / Google Workspace integration with SailPoint Identity Security Cloud and CIEM.

Current configuration:

The Google Workspace user used to generate and authorize the refresh token has elevated admin roles, including User Management Admin, Group Admin and Super Admin.

The connector is not aggregating Google Cloud service accounts, for example the service accounts visible in Google Cloud Console under IAM & Admin > Service Accounts

From the SailPoint CIEM GCP documentation, it looks like CIEM requires the Google Workspace SaaS connector to use Service Account as the Grant Type, and Client Credentials is not supported for CIEM. The same documentation also lists GCP organization-level permissions such as:

  • iam.serviceAccounts.list
  • iam.serviceAccounts.getIamPolicy
  • cloudasset.assets.searchAllResources
  • cloudasset.assets.searchAllIamPolicies
  • resourcemanager.projects.list
  • resourcemanager.projects.get

Can someone confirm the following?

  1. Is it expected that GCP service accounts are not aggregated when the Google Workspace / GCP configuration uses Client Credentials?
  2. To aggregate Google Cloud service accounts with CIEM, is Service Account grant type mandatory?
  3. Should Google Cloud service accounts appear as account objects in the Google Workspace/GCP source, or are they only used by CIEM for cloud access/effective access visibility?
  4. Are Google Workspace admin roles such as Super Admin, User Management Admin and Group Admin relevant for reading GCP service accounts, or is the required access controlled only through GCP IAM permissions assigned to the SailPoint service account?
  5. Is the recommended configuration to create a GCP service account, assign the required custom GCP role at organization scope, configure domain-wide delegation for the Workspace part, and use the service account JSON key in the connector?

Thanks in advance for your support.

Looking forward to receiving a feedback.

Kind Regards,

Paolo

2

  1. Is it expected that GCP service accounts are not aggregated when the Google Workspace / GCP configuration uses Client Credentials?

    Response: client creds won’t work, see response below

  2. To aggregate Google Cloud service accounts with CIEM, is Service Account grant type mandatory?

    Response: “SailPoint’s Cloud Infrastructure Entitlement Management (CIEM) only supports Service Account as a grant type” source: Prerequisites

  3. Should Google Cloud service accounts appear as account objects in the Google Workspace/GCP source, or are they only used by CIEM for cloud access/effective access visibility?

    Response: if you mean GCP project service accounts, yes they should be listed under Accounts, after an account aggregation

  4. Are Google Workspace admin roles such as Super Admin, User Management Admin and Group Admin relevant for reading GCP service accounts, or is the required access controlled only through GCP IAM permissions assigned to the SailPoint service account?

    Response: super admin should cover all GW admin console (Google Workspace admin) console and API permissions; I’m not certain of GW admin console to GCP tie there, BUT make sure you have ALL the relevant scopes set (manage domain-wide delegation) for your GCP service account config correctly in GW admin console, also make sure the GCP service account has been granted the custom GCP role at the org level (GCP ORG → IAM → grant access), and finally, make sure the user account (created in GW admin console) is granted everything listed under this header:

    The required GCP IAM Roles for GCP Management

    listed here: Prerequisites

  5. Is the recommended configuration to create a GCP service account, assign the required custom GCP role at organization scope, configure domain-wide delegation for the Workspace part, and use the service account JSON key in the connector?

    Response: how much time do you have? I’ll do my best to keep this concise

    1. GW admin console: create user account to be impersonated
    2. GW admin console: give this account super admin
    3. GCP org level: create custom role
    4. GCP org level: create new project
    5. GCP project: enable required APIs
    6. GCP project: create service account
    7. GCP project: create new JSON key
    8. follow the documentation to create a rsa key in the PEM format
    9. GCP org level: grant your GCP service account the custom role
    10. GCP org level: grant the user account everything listed here: Prerequisites
      The required GCP IAM Roles for GCP Management
    11. GW admin console: via manage domain-wide delegation, grant your GCP service account (clientID required here) all the required scopes and Authorize
    12. if done in 1 sitting, walk away for 5-10mins before configuring source; trust me
3

con’t; listed below is what I’ve config to get everything working; if there’s a more concise/least privilege list, please share

Google Workspace admin console

GCP

--Project

  • APIs:
    • Admin SDK API
    • Cloud Asset API
    • Cloud Logging API
    • Cloud Resource Manager API
    • Groups Settings API
    • Identity and Access Management (IAM) API

--ORG level

  • custom role permissions:
    • cloudasset.assets.searchAllIamPolicies
    • cloudasset.assets.searchAllResources
    • iam.roles.list
    • iam.serviceAccounts.getIamPolicy
    • iam.serviceAccounts.list
    • logging.logEntries.list
    • resourcemanager.folders.getIamPolicy
    • resourcemanager.folders.list
    • resourcemanager.organizations.get
    • resourcemanager.organizations.getIamPolicy
    • resourcemanager.projects.get
    • resourcemanager.projects.getIamPolicy
    • resourcemanager.projects.list
    • iam.roles.delete
    • iam.roles.get
    • iam.roles.update
    • iam.serviceAccounts.create
    • iam.serviceAccounts.get
    • iam.serviceAccounts.setIamPolicy
    • resourcemanager.folders.setIamPolicy
    • resourcemanager.organizations.setIamPolicy
    • resourcemanager.projects.setIamPolicy
  • user account grants:
    • Cloud Asset Viewer
    • Folder IAM Admin
    • Organization Administrator
    • Organization Role Administrator
    • Organization Role Viewer
    • Project IAM Admin
    • Service Account Admin
  • service account grants:
    • custom role
    • Service Account Admin