Pre-Requisite: In order to complete the following onboard steps you will need to have privileges to: create a new GCP project, create a service account, and modify your organizations IAM policy.
Step 1: Creating a new GCP project
- Click on https://console.cloud.google.com/projectcreate and create a new project. Ensure that the project gets created in your organization.
Step 2: Enabling APIs for the new project
Click on each link below and then “Enable API” button near the top of the page. Ensure that the newly created project is currently selected in the project list drop down.
...
- Cloud Resource Manager API
- https://console.cloud.google.com/apis/library/cloudresourcemanager.googleapis.com
- This enables us to view resources such projects
- Firebase Management API
- https://console.cloud.google.com/apis/library/firebase.googleapis.com
- This enables us to view Firebase projects and associated resources
- Firebase Rules API
- https://console.cloud.google.com/apis/library/firebaserules.googleapis.com
- This enables us to view your Firebase projects’ rules
- Cloud Functions API
- https://console.cloud.google.com/apis/library/cloudfunctions.googleapis.com
- This enables us to enumerate your Cloud Functions
- App Engine Admin API
- https://console.cloud.google.com/apis/library/appengine.googleapis.com
- This enables us to enumerate the deployed App Engine services so that we can discover APIs deployed with the Endpoints Framework
Step 3: Create a service account in the new GCP project
Go to https://console.cloud.google.com/iam-admin/serviceaccounts/create and then:
...
- It will look like DataTheoremDiscovery@rosy-canyon-234300.iam.gserviceaccount.com where “DataTheoremDiscovery” is the service account name and “rosy-canyon-234300” is the project in which the service account was created
Step 4: Add the new service account as a member to your organization
Go to https://console.cloud.google.com/iam-admin/iam and then:
- At the top of the page, click the project selection drop-down list (the down arrow). In the window that appears, click on “ALL” above the table, and then select your Organization (building icon) from the list of items.
- Click on ADD near the top of the page.
- In the sidebar that will appear from the right, add the newly created service account’s email in the “New members” field
- Click on select a role, and type in “Security Reviewer”, select the “Security Reviewer” role from the list below the input field.
- Click on Add Another Role and do the same as above for “Firebase Viewer”
- Click on Add Another Role and do the same as above for “Service Controller”
- Click on Add Another Role and do the same as above for “App Engine Viewer”
- Finally, click on “Save”
Step 5: Get your organization ID
Go to https://console.cloud.google.com and then, at the top of the page, click on the project selection drop-down list (the down arrow). On the window that appears, on the right side, click the three vertical dots, then click Settings. Your organization id will appear on the settings page.
Step 6: Send the JSON file and organization ID to Data Theorem
Send the JSON file (from Step 3) and organization ID (from step 5) to support@datatheorem.com
Extra Resources:
https://cloud.google.com/iam/docs/understanding-service-accounts
...