A working instance of a Google Workspace source.
Ensure that you perform the following steps before generating a Client ID, Client Secret, Refresh Token for Client Credentials, and Private Key for Service Account:
Is it possible to incorporate an overall Google Workspace and GCP admin console config summary, like listed below? The idea is to provide an overview of the flow that can be referenced (in one browser tab or notes) along side the detailed instruction pages. Also, because there are multiple sets of permissions (user account permission(s), project APIs, custom GCP role, org level access config), I think it would be helpful to have a dropdown widget on the relevant instruction page w/ ONLY the relevant permissions. For example, where domain-wide delegation is mentioned, insert dropdown widget for required scopes only. Or for the user account, set up in Google Workspace admin console, list super admin or a dropdown of required Google Workspace permissions (both console and API). In a similar vein, where relevant for CIEM, outline if configuring CIEM include: xyz (scopes or APIs or permissions). To your credit all the information is there, though it was difficult for me to follow beginning to end.
1. GW admin console: create user account to be impersonated
2. GW admin console: give this account super admin
3. GCP org level: create custom role
4. GCP org level: create new project
5. GCP project: enable required APIs
6. GCP project: create service account
7. GCP project: create new JSON key
8. follow the documentation to create a rsa key in the PEM format
9. GCP org level: grant your GCP service account the custom role
10. GCP org level: grant the user account everything listed here: Prerequisites
The required GCP IAM Roles for GCP Management
11. GW admin console: via manage domain-wide delegation, grant your GCP service account (clientID required here) all the required scopes and Authorize
@Lanardg Thank you for your input. We’ve created a Jira issue to track the effort and we’ll update the comment thread when it’s been addressed: CONDOCS-12915.