GCP role permissions for Organization-level discovery and visibility - Adaptive Applications - BlueCat Gateway - 25.3

Cloud Discovery & Visibility Administration Guide
ft:locale
en-US
Product name
BlueCat Gateway
Version
25.3

The following permissions are needed by the Service Account that CDV uses in order for CDV to perform Organization-level discoveries on a GCP infrastructure. These permissions should be assigned to roles, which can then be assigned to the Service Account that CDV uses.

Tip: You can create a single role with all permissions, or separate roles for each type of action (General Discovery permissions, General Visibility permissions, additional permissions for Organization-level Discoveries, and additional permissions for Organization-level Visibility jobs). We recommend creating separate roles.

General Discovery permissions

These permissions are necessary to perform general Discovery operations (not at the Organization level). This is a consolidated list of permissions for discovering specific resources, as listed on Google Cloud Platform (GCP) environments.

  • compute.networks.get
  • compute.networks.list
  • compute.subnetworks.get
  • compute.subnetworks.list
  • compute.instances.get
  • compute.instances.list
  • dns.managedZones.list
  • dns.managedZones.get
  • dns.resourceRecordSets.list
  • dns.managedZones.list
  • dns.managedZones.get
  • dns.resourceRecordSets.list
  • compute.backendBuckets.get
  • compute.backendBuckets.list
  • compute.backendServices.get
  • compute.backendServices.list
  • compute.forwardingRules.get
  • compute.forwardingRules.list
  • compute.globalForwardingRules.get
  • compute.globalForwardingRules.list
  • compute.globalNetworkEndpointGroups.list
  • compute.instanceGroups.get
  • compute.instanceGroups.list
  • compute.networkEndpointGroups.get
  • compute.networkEndpointGroups.list
  • compute.regionBackendServices.get
  • compute.regionBackendServices.list
  • compute.regionNetworkEndpointGroups.get
  • compute.regionNetworkEndpointGroups.list
  • compute.regionTargetHttpProxies.get
  • compute.regionTargetHttpProxies.list
  • compute.regionTargetHttpsProxies.get
  • compute.regionTargetHttpsProxies.list
  • compute.regionTargetTcpProxies.get
  • compute.regionTargetTcpProxies.list
  • compute.regionUrlMaps.get
  • compute.regionUrlMaps.list
  • compute.targetHttpProxies.get
  • compute.targetHttpProxies.list
  • compute.targetHttpsProxies.get
  • compute.targetHttpsProxies.list
  • compute.targetPools.get
  • compute.targetPools.list
  • compute.targetSslProxies.get
  • compute.targetSslProxies.list
  • compute.targetTcpProxies.get
  • compute.targetTcpProxies.list
  • compute.urlMaps.get
  • compute.urlMaps.list
  • compute.forwardingRules.get
  • compute.forwardingRules.list
  • compute.globalForwardingRules.list
  • compute.globalForwardingRules.get
  • dns.managedZones.list
  • dns.managedZones.get
  • dns.resourceRecordSets.list
  • container.clusters.get
  • container.clusters.list
  • compute.instanceGroups.get
  • container.services.list
  • container.pods.list
  • dns.managedZones.list
  • dns.resourceRecordSets.list

General Visibility permissions

These permissions are necessary to perform general Visibility operations (not at the Organization level). The account must also have all General Discovery permissions. This is a consolidated list of additional permissions for visbility of specific resources, as listed on Google Cloud Platform (GCP) environments.

  • logging.sinks.create
  • logging.sinks.delete
  • logging.sinks.get
  • logging.sinks.update
  • logging.sinks.list
  • pubsub.subscriptions.create
  • pubsub.subscriptions.delete
  • pubsub.subscriptions.get
  • pubsub.subscriptions.list
  • pubsub.subscriptions.update
  • pubsub.subscriptions.consume
  • pubsub.topics.create
  • pubsub.topics.delete
  • pubsub.topics.get
  • pubsub.topics.list
  • pubsub.topics.getIamPolicy
  • pubsub.topics.setIamPolicy
  • pubsub.topics.attachSubscription
  • compute.globalOperations.get
  • compute.regionOperations.get
  • compute.zoneOperations.get

Organization-level Discovery and Visibility permissions

These additional permissions are necessary to perform discovery and visibility at an Organization level. The account must also have all General Discovery/Visibility permissions.

  • resourcemanager.organizations.get
  • resourcemanager.projects.get
  • resourcemanager.projects.list