...
Click on each link below and then “Enable API” button near the top of the page.
Service Usage API
https://console.cloud.google.com/apis/library/serviceusage.googleapis.com
This enables us to make sure necessary APIs are enabled
Cloud Resource Manager API
https://console.cloud.google.com/apis/library/cloudresourcemanager.googleapis.com
This enables us to view resources such as the list of projects (only those we will have access to, as per this specific setup)
Firebase Management API
https://console.cloud.google.com/apis/library/firebase.googleapis.com
This enables us to view Firebase projects and associated resources
Firebase Realtime Database Management API
https://console.cloud.google.com/apis/library/firebasedatabase.googleapis.com
This enables us to enumerate your Firebase Realtime databases
Firebase Rules API
https://console.cloud.google.com/apis/library/firebaserules.googleapis.com
This enables us to view your Firebase projects’ rules
Cloud Functions API
https://console.cloud.google.com/apis/library/cloudfunctions.googleapis.com
This enables us to enumerate your Cloud Functions
App Engine Admin API
https://console.cloud.google.com/apis/library/appengine.googleapis.com
This enables us to enumerate the deployed App Engine services so that we can discover APIs deployed with the Endpoints Framework
Kubernetes Engine API
https://console.cloud.google.com/apis/library/container.googleapis.com
This enables us to enumerate Kubernetes clusters
Secret Manager API
https://console.cloud.google.com/apis/library/secretmanager.googleapis.com
This enables us to enumerate secrets (note that we cannot access secrets value, only secrets metadata)
...
Go to https://console.cloud.google.com/iam-admin/serviceaccounts/create and then:
Enter any name for the “Service account name” of “DataTheoremDiscovery”. For the description field, enter a meaningful description such as:
"This service account will be used by Data Theorem to perform resource discovery".
Click on Create near the bottom.Click on “Continue” on the Service Account Permissions page. You will be adding permissions later.
On the final page, click on “+ CREATE KEY” near the bottom of the page. On the right sidebar, ensure “JSON” is selected and then click on CREATE. Save the JSON (used in Step 6) file. Close the warning dialog that may appear.
Click on “DONE” near the bottom of the page.
Copy the email of the new service account that will now appear in the list of service accounts for
your project
It will look like DataTheoremDiscovery@rosy-canyon-234300.iam.gserviceaccount.com where “DataTheoremDiscovery” is the service account name and “rosy-canyon-234300” is the project in which the service account was created
...
Go to https://console.cloud.google.com/iam-admin/iam and then:
At the top of the page, click the project selection drop-down list (the down arrow). In the window that appears, click on “ALL” above the table, and then make sure your project is selected.
Click on ADD near the top of the page.
In the sidebar that will appear from the right, add the newly created service account’s email in the
“New members” field
Click on select a role, and type in “Security Reviewer”, select the “Security Reviewer” role from
the list below the input field.
Click on Add Another Role and do the same as above for “Firebase Viewer”
Click on Add Another Role and do the same as above for “Service Controller”
Click on Add Another Role and do the same as above for “App Engine Viewer”
Finally, click on “Save”
Step 5: Onboarding additional projects
...