The Google Cloud connector reads your resource hierarchy, resource inventory, IAM, network configuration, audit logs, network events and Security Command Center findings. With response actions added, it can propose a firewall deny rule, removing an IAM binding, and disabling a service account or a service account key. Every change still needs an approved plan.
Before you start
- You need Organisation Administrator and Logs Configuration Writer on your Google Cloud organisation, and Owner on the project you run the command in.
- We suggest a dedicated project for Vigilbase.
- In Vigilbase OS you need the
integration.manageandcredential.managepermissions.
Connect with Cloud Shell
The command gives Vigilbase read-only access through your own project, with no service account keys.
Open Integrations, choose Add connection and select Google Cloud. Choose Get the command.
Open Cloud Shell. Use the project Vigilbase should live in; switch projects from the menu at the top of the console.
Run this command. Paste it into Cloud Shell and press Enter. It checks the script has not been changed and lists everything it will create before you confirm. The command is not shown again after you leave the page.
Come back here. The page moves on by itself when the command reports back. If Cloud Shell could not reach Vigilbase, paste the code the command printed.
Choose Finish connecting.
To see what the command would create without changing anything, follow Preview without changes on the setup page.
If setup needs attention, the page says what to do. Most problems, such as missing trust or log subscriptions, are fixed by running the command again.
Add response actions (optional)
On the connection, choose Add response actions and set:
- Projects Vigilbase may change
- Actions Vigilbase may propose
- Proposer can approve
- Accounts Vigilbase must never touch
All Google Cloud actions are marked critical, so the person who proposes them can never approve them.