> ## Documentation Index > Fetch the complete documentation index at: https://conductorone-claude-gcp-connector-org-level-role.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Set up a Google Cloud Platform with Google Workspace connector > C1 provides identity governance and just-in-time provisioning for Google Cloud Platform with Google Workspace. Integrate your Google Cloud Platform with Google Workspace instance with C1 to run user access reviews (UARs) and enable just-in-time access requests. ## Capabilities | Resource | Sync | Provision | | :---------------------------------- | :------------------------------------------------------------ | :------------------------------------------------------------ | | Accounts | | | | Groups | | | | Folders | | | | Roles | | | | Projects | | | | Organizations | | | | Workforce Identity pools\* | | | | Workforce Identity pool providers\* | | | | Secrets - API keys | | | | Secrets - Service account keys | | | | Secrets - Secret Manager secrets | | | | Buckets | | | | IAM Role Assignments\*\* | | | \*Workforce Identity Federation support is optional and must be configured when you set up the connector. \*\*IAM Role Assignments use the Sparse ACL (RBAC) model. This resource type is opt-in and requires enabling the **Use RBAC** option when configuring the connector. When enabled, IAM role assignments are synced as scope binding resources instead of flat grants on projects, folders, and organizations. [This connector can sync secrets](/product/admin/inventory) and display them on the **Inventory** page. ## Gather Google Cloud Platform with Google Workspace credentials Configuring the connector requires credentials from both Google Cloud Platform and the Google Workspace Admin console. You'll complete the following steps: 1. Create a dedicated GCP project for the C1 integration 2. Enable the required APIs 3. Create a service account and assign it the necessary permissions 4. Download the service account's JSON key 5. Grant the service account domain-wide delegation in the Google Workspace Admin console 6. Locate your primary domain and Customer ID A user with the **Super Admin** role in Google Cloud Platform with Google Workspace must perform this task. ### Create a new project We recommend creating a dedicated GCP project for the C1 integration. This keeps the integration's permissions and audit logs isolated from your other projects. Each section below gives the Google Cloud console steps and the equivalent `gcloud` commands. Use whichever you prefer. To use the CLI, [install the gcloud CLI](https://cloud.google.com/sdk/docs/install) and run `gcloud auth login` first. As a Google Cloud Platform with Google Workspace Super Admin, sign in to [https://console.cloud.google.com](https://console.cloud.google.com/). In the toolbar, click the project select dropdown, and click **NEW PROJECT**. Create a new project for your organization: * **Project Name**: Choose a name, such as "C1 Integration" * **Organization/Location**: Choose the appropriate Organization/Location After the project is created, make sure the correct project is selected in the dropdown at the top. From the command line: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} gcloud projects create YOUR_PROJECT_ID \ --name="C1 Integration" \ --organization=YOUR_ORG_ID ``` ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} gcloud config set project YOUR_PROJECT_ID ``` To find your organization ID: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} gcloud organizations list ``` ### Enable the APIs The connector requires these four APIs. The service ID is the identifier you use with the `gcloud` CLI. | API | Service ID | Used for | | :--------------------------------- | :------------------------------------ | :------------------------------------------------------------------------------- | | Cloud Asset API | `cloudasset.googleapis.com` | Searching resources and IAM policies across the organization | | Cloud Resource Manager API | `cloudresourcemanager.googleapis.com` | Reading organizations, folders, and projects | | Identity and Access Management API | `iam.googleapis.com` | Reading roles and service accounts | | Admin SDK API | `admin.googleapis.com` | Reading Google Workspace users, groups, and roles through domain-wide delegation | In the navigation menu, navigate to **APIs & Services** > **Library**. Search for each of the following APIs and click **Enable**: * **Cloud Asset API** * **Cloud Resource Manager API** * **Identity and Access Management API** * **Admin SDK API** From the command line: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} gcloud services enable \ cloudasset.googleapis.com \ cloudresourcemanager.googleapis.com \ iam.googleapis.com \ admin.googleapis.com \ --project=YOUR_PROJECT_ID ``` To confirm which APIs are enabled on the project: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} gcloud services list --enabled --project=YOUR_PROJECT_ID ``` ### Optional: Sync secrets and buckets Complete this section only if you want the connector to sync secrets (API keys, service account keys, Secret Manager secrets) or Cloud Storage buckets. Secrets and bucket permissions are configured per project in GCP. If the connector is not filtering by project and the service account doesn't have permissions across all projects, the sync will fail. We recommend using the **Project IDs** filter to explicitly specify which projects to sync. **Required organization-level role:** Grant the service account the `roles/cloudasset.viewer` role at the organization level. This allows it to search resources across projects. ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} gcloud organizations add-iam-policy-binding YOUR_ORG_ID \ --member="serviceAccount:YOUR_SERVICE_ACCOUNT_EMAIL" \ --role="roles/cloudasset.viewer" ``` **Additional APIs to enable:** Enable these APIs for each project you want to sync (or only for the projects specified in the **Project IDs** filter): | Resource | API | Service ID | | :------------------------------- | :----------------- | :----------------------------- | | Secrets - API keys | API Keys API | `apikeys.googleapis.com` | | Secrets - Service account keys | IAM API | `iam.googleapis.com` | | Secrets - Secret Manager secrets | Secret Manager API | `secretmanager.googleapis.com` | | Buckets | Cloud Storage API | `storage.googleapis.com` | ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} gcloud services enable \ apikeys.googleapis.com \ iam.googleapis.com \ secretmanager.googleapis.com \ storage.googleapis.com \ --project=YOUR_PROJECT_ID ``` Repeat for each project you want to sync, changing `--project` each time. ### Create a service account Create the service account C1 will authenticate as. In the navigation menu, navigate to **APIs & Services** > **Credentials**. Select **CREATE CREDENTIALS** > **Service Account**. Under **Service account details**, fill in the following: * **Service account name:** C1 Integration * **Service account description:** for example, "Service account for C1 Google Cloud Platform with Google Workspace Integration" Click **CREATE AND CONTINUE**. Under **Grant this service account access to a project**, click **CONTINUE** without selecting a role. This step grants roles on the **project** only. The connector reads your organization, folders, and projects, so it needs a role granted at the **organization** level instead. Granting **Editor** here does not work. You'll grant the role at the organization in [Grant organization-level access](#grant-organization-level-access). Leave **Grant users access to this service account** blank. Click **DONE**. From the command line: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} gcloud iam service-accounts create c1-integration \ --project=YOUR_PROJECT_ID \ --display-name="C1 Integration" \ --description="Service account for C1 Google Cloud Platform with Google Workspace Integration" ``` The service account's email address follows the pattern `c1-integration@YOUR_PROJECT_ID.iam.gserviceaccount.com`. Use it wherever `YOUR_SERVICE_ACCOUNT_EMAIL` appears below. ### Grant organization-level access The connector calls Cloud Resource Manager against your organization, so the service account needs a role bound at the **organization** node. A role bound to the project is not enough, no matter how broad it is. Granting roles at the organization level requires the **Organization Administrator** role (`roles/resourcemanager.organizationAdmin`). Project Owner is not sufficient. Create a custom role that includes only the permissions the connector uses. For **READ** access (syncing access data only), the role needs these permissions: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} cloudasset.assets.analyzeIamPolicy cloudasset.assets.searchAllIamPolicies cloudasset.assets.searchAllResources iam.roles.get iam.roles.list resourcemanager.folders.getIamPolicy resourcemanager.folders.list resourcemanager.organizations.get resourcemanager.organizations.getIamPolicy resourcemanager.projects.get resourcemanager.projects.getIamPolicy resourcemanager.projects.list apikeys.keys.list iam.serviceAccounts.list iam.serviceAccountKeys.list secretmanager.secrets.get secretmanager.secrets.list secretmanager.secrets.getIamPolicy storage.buckets.list storage.buckets.getIamPolicy ``` To also provision access (READ/WRITE), add these permissions to the role: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} resourcemanager.folders.setIamPolicy resourcemanager.organizations.setIamPolicy resourcemanager.projects.setIamPolicy secretmanager.secrets.setIamPolicy storage.buckets.setIamPolicy ``` Create the role and bind it to the service account at the organization: In the Google Cloud console, open the resource picker at the top of the page and select your **organization**, not a project. Navigate to **IAM & Admin** > **Roles** and click **CREATE ROLE**. Add the permissions listed above, then click **CREATE**. Navigate to **IAM & Admin** > **IAM**, confirm the organization is still selected, and click **GRANT ACCESS**. In **New principals**, enter the service account's email address. In **Role**, select the custom role you created, then click **SAVE**. To do the same from the command line, create the role: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} gcloud iam roles create c1_gcp_connector \ --organization=YOUR_ORG_ID \ --title="C1 GCP Connector" \ --permissions=cloudasset.assets.analyzeIamPolicy,cloudasset.assets.searchAllIamPolicies,cloudasset.assets.searchAllResources,iam.roles.get,iam.roles.list,resourcemanager.folders.getIamPolicy,resourcemanager.folders.list,resourcemanager.organizations.get,resourcemanager.organizations.getIamPolicy,resourcemanager.projects.get,resourcemanager.projects.getIamPolicy,resourcemanager.projects.list ``` Then bind it at the organization: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} gcloud organizations add-iam-policy-binding YOUR_ORG_ID \ --member="serviceAccount:YOUR_SERVICE_ACCOUNT_EMAIL" \ --role="organizations/YOUR_ORG_ID/roles/c1_gcp_connector" ``` To confirm the binding exists: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} gcloud organizations get-iam-policy YOUR_ORG_ID \ --flatten="bindings[].members" \ --filter="bindings.members:YOUR_SERVICE_ACCOUNT_EMAIL" \ --format="table(bindings.role)" ``` If you sync secrets or buckets, also grant `roles/cloudasset.viewer` at the organization level, as described in [Optional: Sync secrets and buckets](#optional-sync-secrets-and-buckets). ### Get credentials Download the service account's JSON key and record its unique ID. Navigate back to **APIs & Services** > **Credentials**. Under **Service Accounts**, locate and click the service account you just created. Click the service account's email address. Locate and save the **Unique ID** — you'll need it when configuring domain-wide delegation in the next section. On the **Service Account Details Page**, click **KEYS**. Click **ADD KEY** > **Create new key**. Choose **JSON** and click **CREATE**. The new key is created and downloaded to your computer. Keep the downloaded file safe — you'll upload it when configuring the connector in C1. From the command line, create the JSON key: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} gcloud iam service-accounts keys create c1-credentials.json \ --iam-account=YOUR_SERVICE_ACCOUNT_EMAIL ``` Retrieve the numeric unique ID you'll use for domain-wide delegation: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} gcloud iam service-accounts describe YOUR_SERVICE_ACCOUNT_EMAIL \ --format='value(uniqueId)' ``` To review the keys that exist on the service account: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} gcloud iam service-accounts keys list \ --iam-account=YOUR_SERVICE_ACCOUNT_EMAIL ``` **If key creation fails,** your organization blocks it. Creating a key requires the `iam.serviceAccountKeys.create` permission, granted by the **Service Account Key Admin** role (`roles/iam.serviceAccountKeyAdmin`), and the `constraints/iam.disableServiceAccountKeyCreation` organization policy must not be enforced on the project. Google enforces that policy by default for organizations created on or after May 3, 2024, and key creation then fails with `FAILED_PRECONDITION: Key creation is not allowed on this service account`. Check whether the policy applies to your project: ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} gcloud org-policies describe iam.disableServiceAccountKeyCreation \ --project=YOUR_PROJECT_ID \ --effective ``` A user with the **Organization Policy Administrator** role (`roles/orgpolicy.policyAdmin`) can add a project-level exception. See Google's [organization policy constraints for service accounts](https://cloud.google.com/resource-manager/docs/organization-policy/restricting-service-accounts). ### Add the service account to Google Workspace Domain-wide delegation allows the GCP service account to access Google Workspace data — directory users, groups, roles, and audit logs — on behalf of your organization. You configure this in the Google Workspace Admin console at [https://admin.google.com](https://admin.google.com), which is separate from the Google Cloud console. The remaining steps have no `gcloud` equivalent. Domain-wide delegation, the customer ID, and the primary domain all live in Google Workspace rather than Google Cloud, so you must complete them in the Admin console. Go to [https://admin.google.com](https://admin.google.com) as a **SUPER ADMIN**. In the navigation menu, select **Security** > **Access and data control** > **API Controls**. Click **MANAGE DOMAIN WIDE DELEGATION**. Click **Add new** and fill out the form: * **Client ID**: The **Unique ID** you saved from the service account details page * **OAuth Scopes**: Copy and paste in the relevant scopes * Use the following scopes to give C1 **READ** access (syncing access data): ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} https://www.googleapis.com/auth/admin.directory.user.alias.readonly,https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly,https://www.googleapis.com/auth/admin.directory.group.member.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.domain.readonly,https://www.googleapis.com/auth/admin.reports.audit.readonly ``` * Use the following scopes to give C1 **READ/WRITE** access (syncing access data and provisioning access): ```bash theme={"theme":{"light":"css-variables","dark":"css-variables"}} https://www.googleapis.com/auth/admin.directory.user.alias.readonly,https://www.googleapis.com/auth/admin.directory.rolemanagement,https://www.googleapis.com/auth/admin.directory.group.member,https://www.googleapis.com/auth/admin.directory.group,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.domain.readonly,https://www.googleapis.com/auth/admin.reports.audit.readonly ``` Click **AUTHORIZE**. In the navigation menu, select **Account** > **Account Settings**. Copy and save the **Customer ID** from this page. ### Locate your primary domain In the navigation panel on the left, click **Account** > **Domains**. Click **Manage Domains**. Locate and copy the domain labeled as the **Primary Domain** in the **Type** column. Before moving on, confirm you have the following ready for the connector configuration: * **Customer ID** (from Account Settings) * **Primary domain** (from Manage Domains) * **Administrator email** — the email address of a super admin for your domain * **JSON credentials file** — the service account key downloaded in the Get credentials section ## Configure the Google Cloud Platform with Google Workspace connector To complete this task, you'll need: * The **Connector Administrator** or **Super Administrator** role in C1 * Access to the set of Google Cloud Platform with Google Workspace credentials generated by following the instructions above **Follow these instructions to use a built-in, no-code connector hosted by C1.** In C1, navigate to **Integrations** > **Connectors** and click **Add connector**. Search for **Google Cloud Platform with Google Workspace** and click **Add**. Choose how to set up the new Google Cloud Platform with Google Workspace connector: * Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1) * Add the connector to a managed app (select from the list of existing managed apps) * Create a new managed app Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed. If you choose someone else, C1 will notify the new connector owner by email that their help is needed to complete the setup process. Click **Next**. Find the **Settings** area of the page and click **Edit**. In the **Customer ID** field, enter the customer ID. In the **Domain** field, enter the primary domain. In the **Administrator email** field, enter the email address of a super admin for your domain. In the **Credentials (JSON)** area, click **Choose file** and upload the JSON key file. **Optional.** Check the box if you want to skip syncing Google Cloud Platform system accounts. **Optional.** Uncheck the box (which is checked by default) if you want to sync Google Cloud Platform default projects. **Optional.** In the **Project IDs** field, enter a list of project IDs to limit the connector's sync to only those projects. Be sure to enter project IDs, not project names. **Optional.** Check the box to **Enable Workforce Identity Federation**, which allows the connector to sync Workforce Identity pools and pool providers. * If you want the connector to provision Workforce Identity pools, enter the relevant **Workforce Identity Pool ID** and **Workforce Identity Pool Provider ID** in the relevant fields. If you enable Workforce Identity Federation, complete the **Shared identity source** configuration in the next step before finishing. By default, the connector only syncs roles that are assigned to an IAM policy. These settings allow you to configure the connector to sync roles regardless of their IAM policy status. 1. **Optional.** Check the box to **Always sync custom roles**. 2. **Optional.** In the **List of role IDs to always sync** field, enter a list of role IDs that should be synced. Be sure to enter role IDs, not role names. **Optional.** Check the box to **Use RBAC (Sparse ACL)** to enable the RBAC model for IAM role assignments. When enabled, role assignments are synced as scope binding resources (IAM Role Assignments) instead of flat grants on projects, folders, and organizations. This also enables provisioning of IAM role assignments via the scope binding model. Enabling this option changes how IAM access data is represented in C1. Flat grants on projects, folders, and organizations will no longer be synced — only the IAM Role Assignment resources will carry that data. Enable this only if your C1 configuration is set up to use the Sparse ACL model. Click **Save**. **If you enabled Workforce Identity Federation**, complete this additional configuration: 1. In the **Shared identity source** area of the page, click **Edit**. 2. Select the connector from which you want to pull identities. 3. **Optional.** Limit the identities pulled from the connector you selected to only those with a certain entitlement by setting the entitlement. 4. Click **Save**. The connector's label changes to **Syncing**, followed by **Connected**. You can view the logs to ensure that information is syncing. **Done.** Your Google Cloud Platform with Google Workspace connector is now pulling access data into C1. **Follow these instructions to use the Google Cloud Platform with Google Workspace connector, hosted and run in your own environment.** When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals. This data is immediately available in the C1 UI for access reviews and access requests. ### Resources * [Official download center](https://dist.conductorone.com/ConductorOne/baton-google-cloud-platform): For stable binaries (Windows/Linux/macOS) and container images. ### Step 1: Set up a new Google Cloud Platform with Google Workspace connector In C1, navigate to **Integrations** > **Connectors** > **Add connector**. Search for **Baton** and click **Add**. Choose how to set up the new Google Cloud Platform with Google Workspace connector: * Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren't yet managed with C1) * Add the connector to a managed app (select from the list of existing managed apps) * Create a new managed app Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of C1 users. Setting multiple owners is allowed. If you choose someone else, C1 will notify the new connector owner by email that their help is needed to complete the setup process. Click **Next**. In the **Settings** area of the page, click **Edit**. Click **Rotate** to generate a new Client ID and Secret. Carefully copy and save these credentials. We'll use them in Step 2. ### Step 2: Create Kubernetes configuration files Create two Kubernetes manifest files for your Google Cloud Platform with Google Workspace connector deployment: #### Secrets configuration ```yaml expandable theme={"theme":{"light":"css-variables","dark":"css-variables"}} # baton-google-cloud-platform-secrets.yaml apiVersion: v1 kind: Secret metadata: name: baton-google-cloud-platform-secrets type: Opaque stringData: # C1 credentials BATON_CLIENT_ID: BATON_CLIENT_SECRET: # Google Cloud Platform with Google Workspace credentials BATON_CUSTOMER_ID: BATON_DOMAIN: BATON_ADMIN_EMAIL: BATON_CREDENTIALS_JSON: # Optional: include if you want C1 to provision access using this connector BATON_PROVISIONING: true # Optional: include to skip Google-managed system accounts BATON_SKIP_SYSTEM_ACCOUNTS: true # Optional: include to sync Cloud Storage buckets (requires the storage.buckets.list permission) BATON_SYNC_BUCKETS: true # Optional: include to sync API keys and service account keys BATON_SYNC_SECRETS: true # Optional: include to sync Secret Manager secrets (requires the Secret Manager API) BATON_SYNC_SECRET_MANAGER_SECRETS: true # Optional: include to always sync custom roles, even without assignments BATON_ALWAYS_SYNC_CUSTOM_ROLES: true # Optional: include to enable workforce identity federation support BATON_ENABLE_WORKFORCE_IDENTITY_FEDERATION: true BATON_WORKFORCE_IDENTITY_POOL_ID: BATON_WORKFORCE_IDENTITY_POOL_PROVIDER_ID: # Optional: include to limit sync to specific projects (enter project IDs, not names) BATON_PROJECT_FILTER: # Optional: Include to always sync specific roles (enter role IDs, not names) BATON_ALWAYS_SYNC_ROLES_FILTER: # Optional: include to use the Sparse ACL (RBAC) model for IAM role assignments. # When enabled, role assignments are synced as scope binding resources instead of # flat grants on projects, folders, and organizations. BATON_USE_RBAC: true ``` See the connector's README or run `--help` to see all available configuration flags and environment variables. #### Deployment configuration ```yaml expandable theme={"theme":{"light":"css-variables","dark":"css-variables"}} # baton-google-cloud-platform.yaml apiVersion: apps/v1 kind: Deployment metadata: name: baton-google-cloud-platform labels: app: baton-google-cloud-platform spec: selector: matchLabels: app: baton-google-cloud-platform template: metadata: labels: app: baton-google-cloud-platform baton: true baton-app: google-cloud-platform spec: containers: - name: baton-google-cloud-platform image: public.ecr.aws/conductorone/baton-google-cloud-platform:latest imagePullPolicy: IfNotPresent env: - name: BATON_HOST_ID value: baton-google-cloud-platform envFrom: - secretRef: name: baton-google-cloud-platform-secrets ``` ### Step 3: Deploy the connector Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files. Check that the connector data uploaded correctly. In C1, click **Apps**. On the **Managed apps** tab, locate and click the name of the application you added the Google Cloud Platform with Google Workspace connector to. Data should be found on the **Entitlements** and **Accounts** tabs. **Done.** Your Google Cloud Platform with Google Workspace connector is now pulling access data into C1. ## Troubleshooting ### The sync fails with a permission denied error on the organization **Example error:** `c1z-sync: failed getting metadata: google-cloud-platform: Organizations.Get('organizations/000000000000') failed: googleapi: Error 403: Permission 'resourcemanager.organizations.get' denied on resource '//cloudresourcemanager.googleapis.com/organizations/000000000000' (or it may not exist).` The error details report `"reason": "IAM_PERMISSION_DENIED"`. **Cause:** The service account's role is bound to the project rather than to the organization. Roles granted during service account creation, including **Editor**, apply only to the project and confer no access at the organization node. **To resolve this issue:** Grant the connector's custom role at the organization level. See [Grant organization-level access](#grant-organization-level-access). Google returns this same error when the organization doesn't exist, so also confirm the organization ID the connector is configured with is correct. Run `gcloud organizations list` to see the organizations you can access. The Troubleshooter URL included in the error opens Google's Policy Troubleshooter, which shows the principal, permission, and resource that failed.