# Google Cloud

---
title: Connecting Google Cloud to WatchDog Security
category: Integrations
integration_type: oauth
products_supported:
  - Posture Management
  - Inventory
  - Vulnerabilities
  - Compliance Center
---

This guide explains how to connect **Google Cloud** to WatchDog Security using OAuth authentication.

Once connected, WatchDog will begin monitoring your Google Cloud environment for **security posture risks, configuration issues, vulnerabilities, and inventory data** across your organization and projects.

---

## What WatchDog Monitors

:::tip[]
WatchDog operates in **read-only mode** and does **not modify configuration settings** within your Google Cloud environment.
:::

After the integration is connected, WatchDog may monitor:

<Accordion title="Scopes" defaultOpen>

**Identity & Access Management**

- Service Accounts  
- API Keys  
- SSH Keys  

**Resource Management**

- Organization Resource Manager  
- Project Resource Manager  
- Essential Contacts  

**Compute & Infrastructure**

- Compute Engine  
- Virtual Private Cloud (VPC)  
- Kubernetes Engine (GKE)  
- Cloud Run  
- Cloud Functions  
- App Engine  

**Storage & Databases**

- Cloud Storage  
- Cloud SQL  
- Cloud Firestore  
- BigTable  
- Memorystore Redis  
- AlloyDB  
- NetApp  
- Filestore  

**Containers & Artifact Security**

- Container Analysis  
- Artifact Registry  

**Networking & DNS**

- Cloud DNS  

**Security & Encryption**

- Key Management Service (KMS)  
- Secret Manager  
- SSL Certificate  
- Certificate Manager  

**Logging & Messaging**

- Cloud Logging  
- Pub/Sub  

**Application & Platform Services**

- Firebase  
- BigQuery  

**Security Scanning**

- Web Security Scanner  

</Accordion>

The exact information collected depends on the permissions granted during authorization.

---

## Requirements

Before connecting the integration, ensure the following:

- You're an **Account Owner** or **Security Admin** in WatchDog Security
- You have a **dedicated Google user account** for the integration, with access to at least one Google Cloud project
- A Google Cloud administrator has assigned the approved IAM roles below and enabled the required APIs

Use the dedicated Google account when authorizing WatchDog. **Do not connect using an Owner, Editor, or administrator account.**

---

## Step 1: Create a Dedicated Google Account

Create a dedicated user for the WatchDog integration.

1. Sign in to the [**Google Admin Console**](https://admin.google.com/) with an administrator account that can manage users
2. Navigate to **Directory → Users**
3. Click **Add new user**
4. Enter a name and email address, such as **WatchDog Integration** and **watchdog@yourcompany.com**
5. Set a strong password and complete the user creation process
6. Sign in with the new account to complete any first-time setup and configure **2-Step Verification**

:::tip[]
**Do not assign Google Workspace administrator roles to this account.**
:::

Once created, follow the **Configure Google Cloud Access** section to grant this account all three required IAM roles—**Viewer**, **Folder Viewer**, and **Security Reviewer**—on the organizations, folders, or projects you want to monitor.

Creating the user does not automatically grant the required Google Cloud permissions. Use this same account when authorizing WatchDog.

---

## Step 2: Configure Google Cloud Access

The Google account used to connect WatchDog must have only approved roles across **all accessible organizations, folders, and projects**.

| Approved role | Role ID |
| --- | --- |
| Viewer | `roles/viewer` |
| Folder Viewer | `roles/resourcemanager.folderViewer` |
| Security Reviewer | `roles/iam.securityReviewer` |

**All three roles are required.** Assign **Viewer**, **Folder Viewer**, and **Security Reviewer** to the same Google account at each organization, folder, or project you want WatchDog to monitor. Roles inherited from a parent organization or folder do not need to be assigned again.

<AccordionGroup>

<Accordion title="If you use Google Cloud organizations" defaultOpen>

1. Have a Google Cloud administrator open **IAM & Admin → IAM** in the [**Google Cloud Console**](https://console.cloud.google.com/)
2. Select the organization you want WatchDog to monitor
3. Grant the dedicated Google account **all three roles: Viewer, Folder Viewer, and Security Reviewer**
4. Confirm the account has access to all folders and projects within that organization that you want monitored
5. Repeat for each organization you want WatchDog to monitor

Roles granted at the organization level are inherited by its folders and projects. **You do not need to assign the same roles again on each child resource.**

Check for additional roles assigned directly to folders or projects, or received through groups. Adding Viewer does not remove existing elevated access.

</Accordion>

<Accordion title="If you want to monitor specific folders or projects">

1. Have a Google Cloud administrator open **IAM & Admin → IAM** in the [**Google Cloud Console**](https://console.cloud.google.com/)
2. Select the folder or project you want WatchDog to monitor
3. Grant the dedicated Google account **all three roles: Viewer, Folder Viewer, and Security Reviewer**
4. Repeat for each folder or project you want monitored, unless all three roles are already inherited from a parent organization or folder

Roles granted on a folder are inherited by its child folders and projects. Use the **same Google account** across the selected resources.

</Accordion>

<Accordion title="If you do not use a Google Cloud organization">

1. Have a Google Cloud administrator open **IAM & Admin → IAM** in the [**Google Cloud Console**](https://console.cloud.google.com/)
2. Select a project you want WatchDog to monitor
3. Grant the dedicated Google account **all three roles: Viewer, Folder Viewer, and Security Reviewer**
4. Repeat for **every project** you want WatchDog to monitor

Use the **same Google account** across these projects. Projects without an organization must be configured individually.

</Accordion>

</AccordionGroup>

:::warning[]
WatchDog checks the connected account's roles across all accessible organizations, folders, and projects. Connections with roles outside the approved list are rejected, even if those roles apply to resources you do not intend to monitor. Ask your Google Cloud administrator to remove unsupported access before connecting.

For more information, see [**Google Cloud IAM role inheritance**](https://docs.cloud.google.com/iam/docs/resource-hierarchy-access-control).
:::

---

## Step 3: Enabling Required APIs in Google Cloud

Before connecting the integration, ensure the required Google Cloud APIs are enabled.

Authorization may succeed even if these APIs are disabled, but WatchDog will not be able to collect data.

Commonly required APIs include:

- Cloud Resource Manager API
- IAM API
- Cloud Monitoring API
- Cloud Asset API
- Security Command Center API (optional)

You can enable these APIs through the **Google Cloud API Library** or with the Google Cloud CLI.

Example CLI command:

```bash
gcloud services enable \
  cloudresourcemanager.googleapis.com \
  iam.googleapis.com \
  monitoring.googleapis.com \
  cloudasset.googleapis.com \
  securitycenter.googleapis.com
```

---

## Step 4: Open the Integration in WatchDog

1. Log into the [**WatchDog Security Portal**](https://app.watchdogsecurity.io)
2. Navigate to: Management → Integrations
3. Locate **Google Cloud**
4. Click **Connect**

---

## Step 5: Authorize the Integration

:::note[]
After authorization is completed, you will be redirected back to WatchDog Security automatically.
:::

You will be redirected to the **Google authorization page**.

1. Sign in with the **dedicated Google account** configured above
2. Review the permissions requested by WatchDog
3. Click **Allow** to approve the connection

WatchDog will then establish a secure OAuth connection to your Google Cloud environment.

---

## Initial Sync

<Accordion title="After the integration is connected" defaultOpen>

- WatchDog will begin collecting data from Google Cloud
- Initial synchronization time depends on environment size
- Large environments may take **up to one hour**

</Accordion>

<Accordion title="Data appears in the following modules" defaultOpen>

- **Posture Management**
- **Inventory**
- **Vulnerabilities**
- **Compliance Center**

</Accordion>

---

## Revoking Access

To fully remove WatchDog access from Google Cloud, revoke access in both WatchDog and your Google account.


<AccordionGroup>
  <Accordion title="Disconnect Google Cloud Integration Within WatchDog" defaultOpen>
    1. Log into **WatchDog Security**
    2. Navigate to **Management → Integrations**
    3. Locate **Google Cloud**
    4. Click **Disconnect**
    5. Confirm the action
      
    This removes the integration and deletes stored OAuth tokens.
  </Accordion>
  <Accordion title="Remove OAuth Access in Google">
        1. Open your [**Google Account connections**](https://myaccount.google.com/connections) using the connected account
        2. Locate **WatchDog Security**
        3. Remove its access to your Google account

        This fully revokes OAuth authorization from Google.
  </Accordion>
</AccordionGroup>

---

## Troubleshooting

<AccordionGroup>

<Accordion title="Integration Fails to Connect" defaultOpen>

Verify:
- Required APIs are enabled
- You signed in with the dedicated Google account
- The account has only approved IAM roles across all accessible organizations, folders, and projects
- All three required roles are assigned or inherited on the resources you want monitored
- The account has access to at least one project
- OAuth authorization completed successfully

</Accordion>

<Accordion title="Unsupported Permissions Detected">

Review the resources and roles listed in the error. Ask your Google Cloud administrator to remove roles outside the approved list, including access inherited from a parent resource or received through a group, then reconnect.

**Adding Viewer does not replace Owner, Editor, or other existing roles.**

</Accordion>

<Accordion title="No Data Appears">

If no data appears:

- Wait for the initial sync to complete
- Confirm required APIs are enabled
- Confirm the connected account has access to the missing organizations, folders, or projects
- Reconnect the integration if necessary

</Accordion>

</AccordionGroup>