Integrating Google Cloud with CloudOps

This guide walks you through connecting your Google Cloud project to CloudOps for resource collection.

Prerequisites

Before connecting your Google Cloud project to CloudOps, you need to configure permissions and issue a Service Account key in Google Cloud.

The Service Account JSON key issued at the end of that step is the source of every value you enter on the Credentials card below.

Understanding Account Types

The following account types can be registered in CloudOps:

General Account

This is the basic account for collecting and managing individual Google Cloud project resources. CloudOps’s General Account can be created in two ways:

Option 1) You can directly register a Google Cloud service account using individual OAuth2 credentials.
Option 2) You can connect to a Root Account created in CloudOps and delegate its credentials.

Root Account

This is an account that manages multiple Google Cloud projects by connecting them at once.

You can create a Root Account in CloudOps that can be connected to General Accounts.
The Root Account is referenced and utilized when accessing General Accounts.

ℹ️

If you plan to manage multiple Google Cloud projects, register the Root Account once first, then connect each workload project as a General Account + Delegated (Assumed Role).

Register a Cloud Account

Navigate to Cloud Account and select Google Cloud

In the CloudOps console, go to [Settings > Cloud Account] and click [Connect Account]. Select Google Cloud as the provider and click [Next].

Select account type and connection method

In the Account Info step, specify the Account Type and Connection Method.

① Register a Root Account — skip if already registered.

Account Type: Root Account
Enter the target Project ID, Account Name, and an optional Description.

② Register a General Account

Account Type: General Account
Select a Connection Method:

Option 1) Direct (Access Key) — Register with the project’s own Service Account JSON.

Option 2) Delegated (Assumed Role) — Connect to a Root Account. Select the Parent Root Account to delegate permissions.

ℹ️

Delegated accounts reuse the OAuth2 credentials from the selected Parent Root Account. No additional JSON key is required — only the Project ID of the target project.

Enter credentials

Provide the credentials with permission to access the resources. You can enter via Input Form or paste the Service Account JSON via Json Code.

Input Form — fill each field individually from the issued JSON key:

Field	Required	Description
Type	Yes	Account type marker. Defaults to `general_account`.
Project ID	Yes	GCP Project ID — also visible in the project details on the Google Cloud dashboard.
Private Key ID	Yes	`private_key_id` value from the Service Account JSON.
Private Key	Yes	`private_key` value from the JSON. Masked in the UI.
Client Email	Yes	Service account email (e.g., `<name>@<project-id>.iam.gserviceaccount.com`).
Client ID	Yes	OAuth2 client identifier from the JSON.
Auth URI	Yes	OAuth2 authorization endpoint. Pre-filled with `https://accounts.google.com/o/oauth2/auth`.
Token URI	Yes	OAuth2 token endpoint. Pre-filled with `https://oauth2.googleapis.com/token`.
Auth Provider X509 Cert URL	Yes	Pre-filled with `https://www.googleapis.com/oauth2/v1/certs`.
Client X509 Cert URL	Yes	`client_x509_cert_url` value from the JSON.

Json Code — paste the JSON key file issued from Google Cloud Console as-is:

ℹ️

The JSON key is generated by following Web Manual Setup. The service account must hold at least the read-only roles required for each Google Cloud service the collector targets.

Verify

CloudOps verifies the entered credentials through Credential Format Verification and Account Validity Check. Once verification succeeds, proceed to the next step.

⚠️

If verification fails, check the following:

Credentials: Confirm that the Service Account JSON key values (Project ID, Private Key, Client Email, etc.) are correct.
Verification permission: Account validity check calls the Cloud Resource Manager projects.get() API. The service account must have the resourcemanager.projects.get permission (included in the Viewer role), and the Cloud Resource Manager API must be enabled in the target project.
Resource collection permissions: Verify that the roles specified in Web Manual Setup (Security Reviewer, Viewer, Storage Bucket Viewer, etc. — 8 roles) are granted to the service account and that the required APIs are enabled.

Save

Review the summary of Basic Info and Credentials, then click [Connect] to finalize. When you save the settings, the integration completes and resource collection begins.