# Google Cloud

---
title: Connecting Google Cloud to WatchDog Security
category: Integrations
integration_type: oauth
products_supported:
  - Posture Management
  - Inventory
  - Vulnerabilities
  - Compliance Center
---
This guide explains how to connect **Google Cloud** to WatchDog Security using OAuth authentication.

Once connected, WatchDog will begin monitoring your Google Cloud environment for **security posture risks, configuration issues, vulnerabilities, and inventory data** across your organization and projects.

WatchDog supports both **Non-Privileged Mode** and **Privileged Mode** connections for Google Cloud.

---

## What WatchDog Monitors

:::tip[]
WatchDog operates in **read-only mode** and does **not modify configuration settings** within your Google Cloud environment.
:::

After the integration is connected, WatchDog may monitor:

<Accordion title="Scopes" defaultOpen>

**Identity & Access Management**

- Service Accounts  
- API Keys  
- SSH Keys  

**Resource Management**

- Organization Resource Manager  
- Project Resource Manager  
- Essential Contacts  

**Compute & Infrastructure**

- Compute Engine  
- Virtual Private Cloud (VPC)  
- Kubernetes Engine (GKE)  
- Cloud Run  
- Cloud Functions  
- App Engine  

**Storage & Databases**

- Cloud Storage  
- Cloud SQL  
- Cloud Firestore  
- BigTable  
- Memorystore Redis  
- AlloyDB  
- NetApp  
- Filestore  

**Containers & Artifact Security**

- Container Analysis  
- Artifact Registry  

**Networking & DNS**

- Cloud DNS  

**Security & Encryption**

- Key Management Service (KMS)  
- Secret Manager  
- SSL Certificate  
- Certificate Manager  

**Logging & Messaging**

- Cloud Logging  
- Pub/Sub  

**Application & Platform Services**

- Firebase  
- BigQuery  

**Security Scanning**

- Web Security Scanner  

</Accordion>

The exact information collected depends on the permissions granted during authorization.

---

## Requirements

Before connecting the integration, ensure the following:

- You have **administrator access** to the Google Cloud organization or project
- You're an **Account Owner** or **Security Admin** in WatchDog Security
- The Google account used during authorization has access to the resources you want WatchDog to monitor

---

## Authentication Modes

WatchDog supports two authentication modes for Google Cloud.

<AccordionGroup>

<Accordion title="Non-Privileged Mode" defaultOpen>

Non-Privileged Mode provides **read-only access** to your Google Cloud environment.  
This mode allows WatchDog to collect configuration metadata, resource inventory, and posture data without elevated privileges.

This connection is **required during setup**.

Example OAuth scopes used:

- `https://www.googleapis.com/auth/cloud-platform.read-only`
- `https://www.googleapis.com/auth/devstorage.read_only`
- `https://www.googleapis.com/auth/compute.readonly`

**Token Duration**

Access remains active until OAuth access is revoked.

</Accordion>

<Accordion title="Privileged Mode">

Privileged Mode provides **expanded administrative visibility** required for auditing certain Google Cloud services that cannot be accessed through read-only permissions.

Example additional OAuth scope:

- `https://www.googleapis.com/auth/cloud-platform`

During setup you can define how long WatchDog may retain privileged refresh tokens.

After the selected period expires, privileged tokens are automatically deleted and the integration must be reconnected if privileged monitoring is required.

</Accordion>

</AccordionGroup>

---

## Enabling Required APIs in Google Cloud

Before connecting the integration, ensure the required Google Cloud APIs are enabled.

Authorization may succeed even if these APIs are disabled, but WatchDog will not be able to collect data.

Commonly required APIs include:

- Cloud Resource Manager API  
- IAM API  
- Cloud Monitoring API  
- Cloud Asset API  
- Security Command Center API (optional)

You can enable these APIs through the **Google Cloud API Library** or with the Google Cloud CLI.

Example CLI command:

```bash
gcloud services enable \
  cloudresourcemanager.googleapis.com \
  iam.googleapis.com \
  monitoring.googleapis.com \
  cloudasset.googleapis.com \
  securitycenter.googleapis.com
```

:::note[]
Ensure required APIs are enabled before completing the OAuth connection in WatchDog.
:::

---

## Step 1 — Open the Integration in WatchDog

1. Log into the [**WatchDog Security Portal**](https://app.watchdogsecurity.io)
2. Navigate to: Management → Integrations
3. Locate **Google Cloud**
4. Click **Connect**

---

## Step 2 — Verify API Prerequisites

During setup, WatchDog prompts you to confirm that the required Google Cloud APIs have been enabled.

1. Review the required APIs
2. Confirm they are enabled in your Google Cloud environment
3. Select the confirmation checkbox
4. Click **Next**

---

## Step 3 — Connect Using Non-Privileged Mode

:::note[]
The Non-Privileged connection is required.
:::

1. Click **Connect via Non-Privileged Mode**
2. You will be redirected to Google
3. Sign in with your Google account
4. Review the requested permissions
5. Click **Allow**
6. Return to WatchDog
7. The initial synchronization will begin
8. Click **Next**

---

## Step 4 — (Optional) Connect Using Privileged Mode

Privileged Mode provides additional access required for monitoring certain services.

1. Click **Connect via Privileged Mode**
2. Choose how long WatchDog may retain privileged tokens
3. Complete the Google authorization flow
4. Return to WatchDog
5. Click **Done**

:::tip[]
Connecting both modes provides the most complete Google Cloud monitoring coverage.
:::

---

## Permissions Required

**Permissions Required:** Read all resources

Actual data visibility depends on:

- The Google account used during authorization
- Whether Privileged Mode is enabled
- Whether required APIs are enabled in the Google Cloud environment

---

## Initial Sync

<Accordion title="After the integration is connected" defaultOpen>

- WatchDog will begin collecting data from Google Cloud
- Initial synchronization time depends on environment size
- Large environments may take **up to one hour**

</Accordion>

<Accordion title="Data appears in the following modules" defaultOpen>

- **Posture Management**
- **Inventory**
- **Vulnerabilities**
- **Compliance Center**

</Accordion>

---

## Revoking Access

To fully remove WatchDog access from Google Cloud, revoke access in both WatchDog and your Google account.

### Step 1 — Disconnect in WatchDog

1. Log into **WatchDog Security**
2. Navigate to **Management → Integrations**
3. Locate **Google Cloud**
4. Click **Disconnect**
5. Confirm the action

This removes the integration and deletes stored OAuth tokens.

---

### Step 2 — Remove OAuth Access in Google

1. Open your [**Google Account Security Settings**](https://myaccount.google.com/security)
2. Navigate to **Third-party apps with account access**
3. Locate **WatchDog Security**
4. Select **Remove Access**

This fully revokes OAuth authorization from Google.

---

## Troubleshooting

<AccordionGroup>

<Accordion title="Integration Fails to Connect" defaultOpen>

Verify:

- Required APIs are enabled
- Your Google account has sufficient permissions
- OAuth authorization completed successfully

</Accordion>

<Accordion title="No Data Appears">

If no data appears:

- Wait for the initial sync to complete
- Confirm required APIs are enabled
- Ensure correct authorization mode was used
- Reconnect the integration if necessary

</Accordion>

</AccordionGroup>