---
title: "GCP Connection Scanning Configuration"
slug: "fortanix-key-insight-gcp-connection-scanning-configuration"
updated: 2026-06-16T13:01:09Z
published: 2026-06-16T13:01:09Z
canonical: "support.fortanix.com/fortanix-key-insight-gcp-connection-scanning-configuration"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# GCP Connection Scanning Configuration

## 1.0 Introduction

This article describes the minimum access privileges required for Fortanix Key Insight to scan the Google Cloud Platform (GCP) cloud organization and projects.

## 2.0 Terminology Reference

*For GCP terminologies and concepts, refer to* [*All Connections Concepts*](/v1/docs/fortanix-key-insight-concepts-for-all-connections) *and* [*GCP Connection Concepts*](/v1/docs/fortanix-key-insight-gcp-connection-concepts)*.*

## 3.0 Onboard a GCP Project

This section describes the steps to onboard a single GCP project in Fortanix Key Insight.

*For a comprehensive list of GCP permissions required to onboard a GCP project, refer to* [*GCP Connection Permissions*](/v1/docs/fortanix-key-insight-gcp-connection-permissions)*.*

### 3.1 Prerequisites

Ensure the following before onboarding a GCP project into Fortanix Key Insight:

#### 3.1.1 Enable Required APIs

The following GCP APIs must be enabled in the project where the service account is created and where resources will be scanned:

- **Cloud Resource Manager API** – Retrieves project metadata and resource hierarchy.
- **Cloud Key Management Service (KMS)** **API** – Discovers and reads Cloud KMS key metadata.
- **Cloud Storage API** – Scans Google Cloud Storage buckets and objects.
- **Cloud SQL Admin API** – Retrieves Cloud SQL instance configuration and metadata.
- **Kubernetes Engine API** - Retrieves GKE cluster configuration, node metadata and workload status, and related resource settings.
- **Compute Engine API** – Retrieves Compute Engine virtual machine (VM) instances, disk encryption configuration, metadata, and related resource settings.

These APIs provide **read-only** access required to scan the supported services: **Cloud Key Management Service (KMS)**, **Cloud Storage,** **Cloud SQL, Google Kubernetes Engine (GKE),** and **Google Compute Engine (GCE)**.

> [!WARNING]
> WARNING
> 
> If any of the above APIs are not enabled, the GCP connection test may fail with service-disabled or insufficient-permission errors.
> 
> Navigate to **GCP Cloud Console → APIs & Services → Enable APIs and Services** to enable these APIs in the target project.

#### 3.1.2 Grant Required IAM Permissions

Ensure the service account used for onboarding has **read-only** access to the supported GCP services within the target project. Missing permissions may cause the connection test to fail or result in incomplete scan results.

*For instructions on creating the service account and assigning the required roles, refer to* [*Section 3.2: Create a Service Account with Required Permissions*](/v1/docs/fortanix-key-insight-gcp-connection-scanning-configuration#32-create-a-service-account-with-required-permissions)*.*

### 3.2 Create a Service Account with Required Permissions

You can create a service account and grant permissions using **any of the** following methods:

- Predefined viewer roles
- Custom role with minimum required permissions (least privilege)

#### 3.2.1 Using Predefined Viewer Roles

Perform the following steps to create a Google Cloud IAM Service Account using the predefined viewer roles in the project to be scanned:

1. Log in to the [Google Cloud Console](https://console.cloud.google.com/).
2. In the top navigation bar, select the target project where the service account will be created.
3. Navigate to **IAM & Admin → Service Accounts**.
4. On the **Service Accounts** page, click **Create Service Account.**
5. On the **Create service account** page:
  1. **Service account name:** Enter a service account name. For example, **fortanix-key-insight-gcp**.
  2. **Service account ID:** This field auto-populates based on the name entered.
  3. **Service account description** (Optional): Enter a description of the service account.
  4. Click **Create and Continue**.
  5. On the **Permissions (Optional)** section, search for and add the following IAM roles from the **Select a role** drop down, based on the supported services:
    - **Cloud KMS Viewer** – Provides read-only access to Cloud KMS keys and key metadata.
    - **Storage Bucket Viewer** (**beta**) – Provides read-only access to Cloud Storage objects and bucket metadata.

> [!NOTE]
> NOTE
> 
> If **Storage Bucket Viewer (beta)** is not available, add the **Storage Object Viewer** role instead.
    - **Cloud SQL Viewer** – Provides read-only access to Cloud SQL instances, configurations, and metadata.
    - **Kubernetes Engine Viewer** - Provides read-only access to GKE resources, including cluster configuration, node metadata, and workload status.
    - **Compute Viewer**: Provides read-only access to GCE resources, including VM instances, disks, images, and associated metadata.
  6. Click **Continue**.
  7. Click **Done** to complete the service account creation.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/KI_GCP%20Service%20Account(1).png)

**Figure 1: Create a Service Account**

#### 3.2.2 Using a Custom Role (Least Privilege)

Instead of assigning multiple predefined viewer roles, you can create a custom IAM role that includes only the minimum permissions required for scanning (least privilege).

Perform the following steps to create a Google Cloud IAM Service Account using a custom role in the project to be scanned:

1. **Create a Custom Role**:
  1. Log in to the [Google Cloud Console](https://console.cloud.google.com/).
  2. Navigate to the **IAM & Admin** **→** **Roles.**
  3. Click **Create Role.**
  4. On the **Create role** page:
    1. **Title**: Enter the role name. For example, **Fortanix Key Insight Scanner Role.**
    2. **Description** (Optional): Enter a role description.
    3. **ID**: Enter the role ID. For example, **FortanixKeyInsightScanner.**
  5. Click **Add permissions** and add the following permissions according to the required GCP services:

| **GCP Service** | **Permissions** |
| --- | --- |
| **Cloud Key Management Service (KMS)** | - `cloudkms.cryptoKeyVersions.get` - `cloudkms.cryptoKeyVersions.list` - `cloudkms.cryptoKeys.get` - `cloudkms.cryptoKeys.list` - `cloudkms.keyRings.get` - `cloudkms.keyRings.list` - `cloudkms.locations.list` |
| **Cloud SQL** | - `cloudsql.instances.get` - `cloudsql.instances.list` - `cloudsql.databases.list` - `cloudsql.users.list` |
| **Cloud Storage** | - `storage.buckets.get` - `storage.buckets.list` |
| **Google Kubernetes Engine (GKE)** | - `container.clusters.get` - `container.clusters.list` |
| **Google Compute Engine (GCE)** | - `compute.instances.get` - `compute.instances.list` - `compute.projects.get` - `compute.regions.list` - `compute.zones.list` |
  6. Click **Create** to create a new custom role.
2. **Create a Service Account and Assign the Custom Role:**
  1. Navigate to **IAM & Admin** **→** **Service Accounts**.
  2. On the **Service Accounts** page, click **Create Service Account.**
  3. On the **Create service account** page:
    1. **Service account name:** Enter a service account name. For example, **fortanix-key-insight-gcp**.
    2. **Service account ID:** This field auto-populates based on the name entered.
    3. **Service account description** (Optional): Enter a description of the service account.
    4. Click **Create and Continue**.
    5. On the **Permissions (Optional)** section, search for and select the custom role created in *Step 1* from the **Select a role** drop-down.
  4. Click **Continue**.
  5. Click **Done** to complete the service account creation.

### 3.3 Create and Save a Private Key for the Service Account

Fortanix Key Insight requires a service account key file to authenticate to GCP.

Perform the following steps to create a service account key file for the project selected in the previous section:

1. Navigate to **IAM & Admin → Service Accounts**.
2. Select the service account created in [*Section 3.2: Create a Service Account with Required Permissions*](/v1/docs/fortanix-key-insight-gcp-connection-scanning-configuration#32-create-a-service-account-with-required-permissions)*.*
3. Go to the **Keys** tab.
4. On the **Keys** page, click **Add Key → Create New Key**.
5. In the **Create private key** dialog box, select **JSON**.
6. Click **Create**. The JSON key file is generated and saved in your local machine.
7. Download and securely store the JSON file.
8. Copy the following values from the JSON file:

![A close-up of a computer screen  AI-generated content may be incorrect.](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/gcp-connection-scanning-configuration-image-64tbvpvx.png)

**Figure 2: Obtain the GCP credentials**

These values will be used in the Fortanix Key Insight UI when onboarding a GCP connection.
  - `client_email`: Use this as the **Service Account Email**.
  - `private_key`: Use this as the **Private Key**.

> [!NOTE]
> NOTE
> 
> When pasting the private key into the Fortanix Key Insight user interface (UI):
> 
> - Preserve the full multi-line PEM block exactly as provided in the JSON(including line breaks).
> 
> `-----BEGIN PRIVATE KEY----- <base64 data> -----END PRIVATE KEY-----`
> - Do **not** escape characters, remove newlines, or paste the entire JSON file.
> 
> Incorrect formatting will cause the connection test to fail.
  - `project_id`: Use this as the **Project ID**.

> [!NOTE]
> NOTE
> 
> - Service account key files contain sensitive credentials. Therefore, store them securely.
> - Service account keys **do not** expire automatically, so rotate them regularly (for example, every 90 days or according to your organization’s security policy) and delete unused keys immediately.

## 4.0 Onboard a GCP Organization

This section describes the steps to configure a GCP organization to perform key scans using Fortanix Key Insight.

*For a comprehensive list of GCP permissions required to onboard a GCP organization, refer to* [*GCP Connection Permissions*](/v1/docs/fortanix-key-insight-gcp-connection-permissions)*.*

Before adding a new GCP organization connection in Fortanix Key Insight, configure an IAM service account with organization-level visibility.

### 4.1 Prerequisites

Ensure the following before onboarding a GCP organization into Fortanix Key Insight:

#### 4.1.1 Enable Required APIs

Ensure that all required APIs listed in [*Section 3.1.1: Enable Required APIs*](/v1/docs/fortanix-key-insight-gcp-connection-scanning-configuration#311-enable-required-apis) are enabled in every project within the organization that should be scanned.

If required APIs are not enabled in certain projects, those projects may be skipped or return permission errors during scanning.

#### 4.1.2 Grant Required IAM Permissions

Ensure the service account used for onboarding has **read-only** access to the supported GCP services at the organization level. Missing permissions may cause the connection test to fail or result in incomplete scan results.

*For instructions on creating the service account and assigning the required roles at the organization level, refer to* [*Section 4.2:* *Create a Service Account with Required Permissions*](/v1/docs/fortanix-key-insight-gcp-connection-scanning-configuration#42-create-a-service-account-with-required-permissions)*.*

### 4.2 Create a Service Account with Required Permissions

Perform the following steps to create the service account in a project that belongs to your GCP organization (preferably a central project managed by your security team):

> [!NOTE]
> NOTE
> 
> You cannot create service accounts at the organization level. You must create them within a project.

1. Log in to the [Google Cloud Console](https://console.cloud.google.com/).
2. In the top navigation bar, select the project where you want to create the service account.
3. Navigate to **IAM & Admin → Service Accounts**.
4. On the **Service Accounts** page, click **Create Service Account**.
5. On the **Create service account** page:
  1. **Service account name:** Enter a service account name. For example, **fortanix-key-insight-gcp-organization**.
  2. **Service account ID:** This field auto-populates based on the name entered.
  3. **Service account description** (Optional): Enter a description of the service account.
  4. Click **Create and Continue**.
  5. In the **Permissions (Optional)** section, **do not** assign any roles. Click **Continue**.
  6. Click **Done** to create a service account.
6. Navigate to **IAM & Admin → IAM**.
7. In the resource selector at the top of the IAM page, select your **Organization**.
8. Locate the service account created in *Step 5*, and click **Edit Principal**.
9. In the **Roles** section, assign the following IAM roles to enable organization-wide read-only scanning, based on the supported services:

> [!NOTE]
> NOTE
> 
> Assigning the required roles at the **Organization level** grants inherited visibility across all folders and projects within that organization.
  - **Organization Viewer** – Provides read-only access to all resources and metadata across the organization.
  - **Cloud KMS Viewer** – Provides read-only access to Cloud KMS keys and key metadata.
  - **Storage Bucket Viewer (beta)** – Provides read-only access to Cloud Storage objects and bucket metadata.

> [!NOTE]
> NOTE
> 
> If **Storage Bucket Viewer (beta)** is not available, add the **Storage Object Viewer** role instead.
  - **Cloud SQL Viewer** – Provides read-only access to Cloud SQL instances, configurations, and metadata.
  - **Kubernetes Engine Viewer** - Provides read-only access to GKE resources, including cluster configuration, node metadata, and workload status.
  - **Compute Viewer**: Provides read-only access to GCE resources, including VM instances, disks, images, and associated metadata.
10. Click **Save** to apply the permissions.

### 4.3 Create and Save a Private Key for the Service Account

*For steps on how to create and save a private key for the service account in GCP organization, refer to* [*Section 3.3: Create and Save a Private Key for the Service Account*](/v1/docs/fortanix-key-insight-gcp-connection-scanning-configuration#33-create-and-save-a-private-key-for-the-service-account)*.*

### 4.4 Obtain the GCP Organization ID

Perform the following steps to obtain your GCP organization ID using the Google Cloud Console:

1. Log in to the [Google Cloud Console](https://console.cloud.google.com/).
2. In the top navigation bar, open the project and organization selector (project picker), and select your **Organization**.
3. On the right side of the top navigation bar, click More actions ( ![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Picture2(3).png)) menu.
4. Select **Settings**. This page displays your organization resource ID.
5. Copy the organization ID value to use it in the Fortanix Key Insight (UI) when onboarding a GCP connection.

*For detailed steps on obtaining the organization ID using the Google Cloud CLI or REST API, refer to the* [*Google Cloud official documentation*](https://docs.cloud.google.com/resource-manager/docs/creating-managing-organization#retrieving_your_organization_id)*.*

Fortanix Key Insight identifies encryption keys and data services across on-premises and hybrid multicloud environments, providing a unified dashboard for tracking key mappings and cryptographic security. It offers security and compliance teams data-driven insights to assess risks, align with best practices, and meet industry regulations. Iy also supports continuous risk mitigation and crypto-agility, adapting to evolving security needs, including preparation for the post-quantum era.