Skip to main content

GCP connection

When you create a connection to access GCP cloud resources, you must define the scope of the connection. A GCP connection must use a Google Cloud Service account.

The DoiT console provides a step-by-step wizard to help you create a GCP connection.

Required permissions​

To create a GCP connection, your DoiT account must have the CloudFlow Manager or CloudFlow Editor permission.

Setup​

Once you have launched the wizard, you must set up the connection and specify the Google Service Account for which this connection determines permissions.

  1. Sign in to the DoiT console, select Operate from the top navigation bar, and then select CloudFlow.

  2. Select Connections.

  3. From the left hand pane, select GCP.

  4. Select Create connection.

  5. In Connection name, enter a unique connection name that fits its usage. This connection exists in the DoiT platform and defines your users permissions to interact with the CloudFlow itself.

  6. In Service account name, enter the name of the Google Service Account to use with this connection.

    GCP connection setup configuration

  7. In Custom role ID, enter a name that fits its usage. This is the Google Cloud custom role that the CloudFlow assumes when it executes. Its permissions are what allows the CloudFlow to perform tasks in Google Cloud. The Google Cloud custom role does not have any permissions on the DoiT platform.

  8. You must choose the Google accounts and projects that your CloudFlows run on when using this connection.

    • Select Organization. In Select Organizations, choose an organization to use with this connection.

    • Select Project. In Select projects, choose the projects to use with this connection.

  9. When you have added all the organizations and projects for which this connection determines permissions, select Next.

Permissions​

Once you have setup the GCP custom role, you must specify the permissions for the custom role that the CloudFlow assumes when it executes.

  1. In GCP Predefined Roles, select the GCP predefined roles that you want to add to this connection.

    GCP connection permissions

  2. (Optional) If a CloudFlow requires additional GCP permissions, select + Add another permission to add them to the custom role.

  3. In Custom permission, enter the additional permission, for example storage.objects.get.

    Repeat the steps for each additional GCP permission you want to add.

  4. You must now create the Google service account that has the permissions you specified above. You do this using Google Infrastructure Manager or Terraform.

    1. Copy the provided code block.
    2. Select Open Google Cloud Shell.
    3. Paste the code and run the command.

  5. Select Next.

Access​

Finally, you must set which DoiT accounts have access to this connection and are authorized to use it in a CloudFlow.

  1. In Email, select the email address of a DoiT account who can use this connection.

  2. In Connection access level, select the access level the DoiT account has.

  3. To add another account, select + Add another user.

  4. Repeat these steps for each DoiT account who can use this connection.

  5. Select Done. It may take a few minutes to create your connection. Once the connection is created, you can use it in your CloudFlows.

Last updated on