WatchDog Security Help Center
    Admin Guide
    • Docs Home
    • Admin Guide
    • User Guide
    • MSP Guide
    • Release Notes
    • Back to home
    • Integrations
    • Amazon Web Services (AWS)
    • Atlassian Cloud Admin
    • BitBucket Cloud
    • Cloudflare
    • Confluence Cloud
    • Docker Hub
    • Figma
    • Google Cloud
    • Google Workspace
    • Intercom
    • Linear
    • Microsoft 365
    • Microsoft Azure
    • Microsoft Teams
    • Namecheap
    • Slack
    • Tailscale
    • Twingate

    Google Cloud

    This guide explains how to connect Google Cloud to WatchDog Security using OAuth authentication.
    Once connected, WatchDog will begin monitoring your Google Cloud environment for security posture risks, configuration issues, vulnerabilities, and inventory data across your organization and projects.

    What WatchDog Monitors#

    WatchDog operates in read-only mode and does not modify configuration settings within your Google Cloud environment.
    After the integration is connected, WatchDog may monitor:
    Scopes
    Identity & Access Management
    Service Accounts
    API Keys
    SSH Keys
    Resource Management
    Organization Resource Manager
    Project Resource Manager
    Essential Contacts
    Compute & Infrastructure
    Compute Engine
    Virtual Private Cloud (VPC)
    Kubernetes Engine (GKE)
    Cloud Run
    Cloud Functions
    App Engine
    Storage & Databases
    Cloud Storage
    Cloud SQL
    Cloud Firestore
    BigTable
    Memorystore Redis
    AlloyDB
    NetApp
    Filestore
    Containers & Artifact Security
    Container Analysis
    Artifact Registry
    Networking & DNS
    Cloud DNS
    Security & Encryption
    Key Management Service (KMS)
    Secret Manager
    SSL Certificate
    Certificate Manager
    Logging & Messaging
    Cloud Logging
    Pub/Sub
    Application & Platform Services
    Firebase
    BigQuery
    Security Scanning
    Web Security Scanner
    The exact information collected depends on the permissions granted during authorization.

    Requirements#

    Before connecting the integration, ensure the following:
    You're an Account Owner or Security Admin in WatchDog Security
    You have a dedicated Google user account for the integration, with access to at least one Google Cloud project
    A Google Cloud administrator has assigned the approved IAM roles below and enabled the required APIs
    Use the dedicated Google account when authorizing WatchDog. Do not connect using an Owner, Editor, or administrator account.

    Step 1: Create a Dedicated Google Account#

    Create a dedicated user for the WatchDog integration.
    1.
    Sign in to the Google Admin Console with an administrator account that can manage users
    2.
    Navigate to Directory → Users
    3.
    Click Add new user
    4.
    Enter a name and email address, such as WatchDog Integration and watchdog@yourcompany.com
    5.
    Set a strong password and complete the user creation process
    6.
    Sign in with the new account to complete any first-time setup and configure 2-Step Verification
    Do not assign Google Workspace administrator roles to this account.
    Once created, follow the Configure Google Cloud Access section to grant this account all three required IAM roles—Viewer, Folder Viewer, and Security Reviewer—on the organizations, folders, or projects you want to monitor.
    Creating the user does not automatically grant the required Google Cloud permissions. Use this same account when authorizing WatchDog.

    Step 2: Configure Google Cloud Access#

    The Google account used to connect WatchDog must have only approved roles across all accessible organizations, folders, and projects.
    Approved roleRole ID
    Viewerroles/viewer
    Folder Viewerroles/resourcemanager.folderViewer
    Security Reviewerroles/iam.securityReviewer
    All three roles are required. Assign Viewer, Folder Viewer, and Security Reviewer to the same Google account at each organization, folder, or project you want WatchDog to monitor. Roles inherited from a parent organization or folder do not need to be assigned again.
    If you use Google Cloud organizations
    1.
    Have a Google Cloud administrator open IAM & Admin → IAM in the Google Cloud Console
    2.
    Select the organization you want WatchDog to monitor
    3.
    Grant the dedicated Google account all three roles: Viewer, Folder Viewer, and Security Reviewer
    4.
    Confirm the account has access to all folders and projects within that organization that you want monitored
    5.
    Repeat for each organization you want WatchDog to monitor
    Roles granted at the organization level are inherited by its folders and projects. You do not need to assign the same roles again on each child resource.
    Check for additional roles assigned directly to folders or projects, or received through groups. Adding Viewer does not remove existing elevated access.
    If you want to monitor specific folders or projects
    If you do not use a Google Cloud organization
    WatchDog checks the connected account's roles across all accessible organizations, folders, and projects. Connections with roles outside the approved list are rejected, even if those roles apply to resources you do not intend to monitor. Ask your Google Cloud administrator to remove unsupported access before connecting.
    For more information, see Google Cloud IAM role inheritance.

    Step 3: Enabling Required APIs in Google Cloud#

    Before connecting the integration, ensure the required Google Cloud APIs are enabled.
    Authorization may succeed even if these APIs are disabled, but WatchDog will not be able to collect data.
    Commonly required APIs include:
    Cloud Resource Manager API
    IAM API
    Cloud Monitoring API
    Cloud Asset API
    Security Command Center API (optional)
    You can enable these APIs through the Google Cloud API Library or with the Google Cloud CLI.
    Example CLI command:

    Step 4: Open the Integration in WatchDog#

    1.
    Log into the WatchDog Security Portal
    2.
    Navigate to: Management → Integrations
    3.
    Locate Google Cloud
    4.
    Click Connect

    Step 5: Authorize the Integration#

    After authorization is completed, you will be redirected back to WatchDog Security automatically.
    You will be redirected to the Google authorization page.
    1.
    Sign in with the dedicated Google account configured above
    2.
    Review the permissions requested by WatchDog
    3.
    Click Allow to approve the connection
    WatchDog will then establish a secure OAuth connection to your Google Cloud environment.

    Initial Sync#

    After the integration is connected
    WatchDog will begin collecting data from Google Cloud
    Initial synchronization time depends on environment size
    Large environments may take up to one hour
    Data appears in the following modules
    Posture Management
    Inventory
    Vulnerabilities
    Compliance Center

    Revoking Access#

    To fully remove WatchDog access from Google Cloud, revoke access in both WatchDog and your Google account.
    Disconnect Google Cloud Integration Within WatchDog
    1.
    Log into WatchDog Security
    2.
    Navigate to Management → Integrations
    3.
    Locate Google Cloud
    4.
    Click Disconnect
    5.
    Confirm the action
    This removes the integration and deletes stored OAuth tokens.
    Remove OAuth Access in Google

    Troubleshooting#

    Integration Fails to Connect
    Verify:
    Required APIs are enabled
    You signed in with the dedicated Google account
    The account has only approved IAM roles across all accessible organizations, folders, and projects
    All three required roles are assigned or inherited on the resources you want monitored
    The account has access to at least one project
    OAuth authorization completed successfully
    Unsupported Permissions Detected
    No Data Appears
    Modified at 2026-10-05 00:03:12
    Previous
    Figma
    Next
    Google Workspace
    Built with