Integrating Google Cloud with CloudOps

This guide walks you through connecting your Google Cloud project to CloudOps for resource collection.

Prerequisites

Before connecting your Google Cloud project to CloudOps, you need to configure permissions and issue a Service Account key in Google Cloud.

The Service Account JSON key issued at the end of that step is the source of every value you enter on the Credentials card below.

Understanding Account Types

CloudOps registers two account types.

General Account: The basic account for collecting and managing an individual Google Cloud project’s resources, connected in one of two ways.
- Direct (Access Key): Connects the project directly with a Google Cloud service account’s own OAuth2 credentials.
- Delegated (Assumed Role): Connects by assuming credentials from a parent Root Account.
Root Account: An entry holding one credential that can reach many projects — a service account granted a role at the organization or folder level. Register it once and reuse it.

Which one should you use

Situation	How to register
Your projects sit under one organization or folder you can grant a role on (setup guide)	Register the Root Account first, then connect each workload project as General + Delegated
You have a single project, or they have no delegation relationship	General + Direct

The deciding factor is your organization’s structure, not how many projects you have. Without an organization or folder to grant a role on you cannot create a Root at all; conversely, if the delegation structure exists, a Root is worth having even for two — Direct means issuing, storing, and rotating separate credentials for every project.

⚠️

Delegated is only selectable once a Root Account exists. The registration screen asks for a Parent Root Account to delegate from; with no Root registered the list is empty and you are sent to register one first.

With a Root Account in place you can connect its delegated accounts in one pass through Bulk Register instead of registering them one at a time.

A Root Account is not collected

A Root Account is the delegation basis and credential provider — it is not a collection target. That is why a Root row reads differently in the account list:

Item	Root Account	General Account
Collection Status	Empty	`Success` · `Running` · `Failure` …
Last Collected	Empty	When resources were last collected
Collection Issues KPI	Excluded	Counted
Detail screen	Number of delegated General accounts	Collection status

ℹ️

This does not mean resources under the Root are missed. Registering a Root Account also registers its own General Account automatically — marked with an Auto badge in the account list — and that General account is what collects. In other words collection always happens at the General account level, with the Root standing behind it.

Register a Cloud Account

In the CloudOps console, go to [Settings > Cloud Account] and click the [Connect Account] dropdown. Select either Root Account or General Account to open the registration page.

The registration page uses a 4-step accordion wizard: Provider → Account Info → Verify → Save. A progress panel on the right tracks your completion status.

Select a provider

Select Google Cloud as the provider and click [Next].

Enter account info

In the Account Info step, the form fields differ depending on the account type you chose.

① Root Account — the page title shows Connect Root Account.

Enter the target Project ID, Account Name, and an optional Description.

② General Account — the page title shows Connect General Account.

Select a Connection Method:

Option 1) Direct (Access Key) — Register with the project’s own Service Account JSON.

Option 2) Delegated (Assumed Role) — Connect to a Root Account. Select the Parent Root Account to delegate permissions.

ℹ️

Delegated accounts reuse the OAuth2 credentials from the selected Parent Root Account. No additional JSON key is required — only the Project ID of the target project.

Enter credentials

Provide the credentials with permission to access the resources. You can enter via Input Form or paste the Service Account JSON via Json Code.

Input Form — fill each field individually from the issued JSON key:

Field	Required	Description
Type	Yes	Account type marker. Defaults to `general_account`.
Project ID	Yes	GCP Project ID — also visible in the project details on the Google Cloud dashboard.
Private Key ID	Yes	`private_key_id` value from the Service Account JSON.
Private Key	Yes	`private_key` value from the JSON. Masked in the UI.
Client Email	Yes	Service account email (e.g., `<name>@<project-id>.iam.gserviceaccount.com`).
Client ID	Yes	OAuth2 client identifier from the JSON.
Auth URI	Yes	OAuth2 authorization endpoint. Pre-filled with `https://accounts.google.com/o/oauth2/auth`.
Token URI	Yes	OAuth2 token endpoint. Pre-filled with `https://oauth2.googleapis.com/token`.
Auth Provider X509 Cert URL	Yes	Pre-filled with `https://www.googleapis.com/oauth2/v1/certs`.
Client X509 Cert URL	Yes	`client_x509_cert_url` value from the JSON.

Json Code — paste the JSON key file issued from Google Cloud Console as-is:

ℹ️

The JSON key is generated by following Web Manual Setup. The service account must hold at least the read-only roles required for each Google Cloud service the collector targets.

Verify

CloudOps verifies the entered credentials through Credential Format Verification and Account Validity Check. Once verification succeeds, proceed to the next step.

⚠️

If verification fails, check the following:

Credentials: Confirm that the Service Account JSON key values (Project ID, Private Key, Client Email, etc.) are correct.
Verification permission: Account validity check calls the Cloud Resource Manager projects.get() API. The service account must have the resourcemanager.projects.get permission (included in the Viewer role), and the Cloud Resource Manager API must be enabled in the target project.
Resource collection permissions: Verify that the roles specified in Web Manual Setup (Security Reviewer, Viewer, Storage Bucket Viewer, etc. — 8 roles) are granted to the service account and that the required APIs are enabled.

Save

Review the summary of Basic Info and Credentials, then click [Connect] to finalize. When you save the settings, the integration completes and resource collection begins.