Connect a GCP Organization

Connect your entire GCP organization to automatically onboard all current and future projects, without adding them individually.

Prerequisites

Before you begin:

• Grant sufficient permissions to the user who will create projects, create service accounts, authorize the service accounts, and enable logging in the Google Cloud Console.
• Define exceptions to allow Tenable network access if you use VPC Service Controls to restrict access to Google-managed services.
• Create a dedicated project for each Google Organization that will host the service account used by Tenable. If you already created a project when connecting a project to Tenable, use the same one.
• Enable billing for the dedicated project in the Google Cloud Console. For instructions, see Google's documentation on enabling billing.
• Terraform-specific:
  • Ensure you have Terraform CLI v0.13+ installed.
  • Ensure terraform init can download and install Google Cloud provider v7.11+ without conflicting with your existing configurations.

Connect an Organization

To connect a GCP organization:

1. In the Tenable One AI Exposure Console, navigate to Settings > Integrations and click + Add Integration.
2. In the Integrations Library, click GCP Organization. The GCP Organization wizard opens.
3. In the Configuration step (step 1 of 2)::
   1. Enter a name for the integration.
   2. Enter the organization ID.

   3. Under Google Workspace, select whether to use an existing Google Workspace integration. If an integration does not exist, you can click + Create.

      Note: Tenable recommends using your Google Workspace with your organization to enable identity-related visibility and complete risk assessment. Doing so:

      • Enables identity-related visibility, including users, permissions, and least-privilege analysis, providing a more complete risk assessment across your GCP cloud environment.
      • Allows visibility into identities, permissions, and access relationships, enhancing security posture management beyond just resource visibility.
   4. Under Capabilities, select the capabilities to enable. Your selection determines the required permissions and dynamically updates the deployment script. Tenable recommends enabling all capabilities to provide the most comprehensive security coverage. For more information, see Google Required Permissions.
   5. Under Deployment, select one of the following deployment options:
      • Cloud Shell. Script-based deployment.
        1. Enter the Management Project ID. This is the ID of the dedicated project hosting the service account for this integration.
        2. Copy the script displayed in the AI Exposure wizard, create a file with the script content, and then run it in your Cloud Shell to grant AI Exposure the required permissions.
      • Terraform. Module-based deployment. See Prerequisites before deploying.
        1. Enter the Management Project ID. This is the ID of the dedicated project hosting the service account for this integration.
        2. In the Google Cloud Console, navigate to the project you created.
        3. Go to IAM & Admin > Labels, click + Add label, and add the key/value pair that appears in the AI Exposure wizard.
        4. Copy the module invocation displayed in the AI Exposure wizard, add it to your Terraform configuration, and then run terraform apply. The module creates the identity and grants Tenable the permissions to connect and scan the environment.

      • Manual. Manually, via the Google Cloud Console. See Manually Deploy a GCP Organization for step-by-step instructions.

        Caution: When you finish manual deployment, return to the wizard to complete Post Deployment, and Step 2: Scopes and Hierarchy.

   6. Under Post Deployment, enter the following values.

      Note: Keep the following in mind about the integration values:

      • How to retrieve values
        • Cloud Shell: Copy/paste the values from the script output.
        • Terraform. Retrieve the values from the Terraform output.
        • Manual: See Manually Deploy a GCP Organization for how to retrieve these values.
      • Shared integration values
        • These values must be identical across the organization and all its member projects.
        • When an organization is connected, these fields can only be updated at the organization level. Changes will automatically propagate to all member projects.
      • Service Account Email
      • Pub/Sub Subscription Name
   7. When finished, click Next.
4. In the Scopes step (step 2 of 2):
   1. (Optional) Select Automatically update compartments structure to mirror your compartment's structure as folders within Tenable, preserving the hierarchy and keeping the view synchronized. For more information, see Account Hierarchy and Folders.

   2. Under Scopes, choose which compartments to onboard:

      • Sync all current and future projects (recommended)
      • Include specific folders and projects
      • Exclude specific folders and projects
      Note: If you include/exclude an entire folder, all current and future projects within the group are included/excluded. If you include/exclude specific projects in a folder, only the selected projects will be included/excluded.
5. Click Finish.

Next steps:
After your organization is added successfully:

• You can see the organization on the Integrations > GCP Organization page.
• You can see projects that belong to the organization on the Accounts > GCP page. From here you can manage your projects and view project details to see, for example, which features are enabled and whether the required permissions were granted.

Data about project resources will start to appear in AI Exposure. The time it takes for all data to appear varies depending on the size of your cloud environment.

Manually Deploy a GCP Organization

As an alternative to the script-based deployment, you can manually deploy your GCP organization via the Google Cloud Console. These procedures are relevant if you selected Manual for the deployment type when connecting your GCP organization.

1. Create a Service Account for Tenable
2. Authorize the Service Account at the Org Level
3. Configure Audit Logs

Create a Service Account for Tenable

Create a dedicated GCP project and service account that Tenable uses to access and monitor your organization.

1. In the Google Cloud Console, navigate to the project you created.
2. Go to IAM & Admin > Roles and then click + Create custom role.
3. Enter a title, description, and ID.
4. Click + Add permissions, and add the permissions listed under Create Service Account in Required Permissions.
5. Click Create to finish creating the role.
6. Go to IAM & Admin > Service Accounts and then click + Create service account.
7. Enter a Service account name, ID, and description.
8. Copy and save the service account email that is generated. You will need to enter this value in the Post Deployment section of the wizard when connecting your organization to AI Exposure.
9. Click Create and continue.
10. Select the custom role you created, and then click Continue and Done.

11. Select the newly created service account, click the Principals with access tab, and then Grant access.

    Important: If you are unable to grant access, you may have an organization policy with a domain restriction constraint that prevents choosing Tenable as a principal in IAM policies. This prevents Tenable from impersonating the created service account. If this is the case, follow the procedure described in Add Tenable as an Allowed Domain.
12. In the Add principals section, enter [email protected] in the New principals field.
13. In the Assign roles section, select the Service Account Token Creator role and then click Save to finish.
14. Go to IAM & Admin > Labels, click + Add label, and add the key/value pair that appears in the AI Exposure wizard:
    • Key: ermetic-external-id
    • Value — Appears in the Deployment section of the AI Exposure wizard
15. Click Save to finish creating the service account.

Authorize the Service Account at the Org Level

Grant the service account the permissions Tenable requires to scan and monitor your organization.

1. In the Google Cloud Console, select the organization you want to connect to Tenable using the project picker at the top left of the screen.
2. Navigate to IAM & Admin > IAM and then click Grant access.
3. In the Add principals section, enter the service account email you saved earlier in the New principals field.
4. In the Assign roles section, select relevant roles according to the desired capabilities.
5. Click Save to finish.

Configure Audit Logs

Set up a Pub/Sub topic, subscription, and log sink to stream GCP audit logs to Tenable.

1. In the Google Cloud Console, select the relevant project with the project picker and create a Pub/Sub topic by following these steps:
   1. Navigate to Pub/Sub > Topics and then click + Create topic.
   2. In the Topic ID field, enter tenable-audit-logs.
   3. Clear Add a default subscription.
   4. Select Enable message retention and set the duration to at least 1 day.
   5. Click Create.
2. Create a Pub/Sub subscription by following these steps:
   1. Navigate to Pub/Sub > Subscriptions and then click + Create subscription.
   2. In the Subscription ID field, enter tenable-audit-logs-sub.
   3. Select the topic you created earlier.
   4. In the Delivery type section, select Pull.
   5. In the Message retention duration section, set the duration to at least 1 day.
   6. In the Retry policy section, select Retry after exponential backoff delay and keep the default values.
   7. In the Expiration period section, select Never expire.
   8. Click Create.
   9. In the Permissions tab of the newly created subscription, click Add principal.
   10. In the Add principals section, enter the service account email you saved earlier in the New principals field.
   11. In the Assign roles section, select the Pub/Sub Subscriber role and then click Save to finish.
   12. Copy and save the Pub/Sub subscription name. You will need to enter this value in the Post Deployment section of the wizard when connecting your organization to AI Exposure.

3. Create a log sink at the organization level by following these steps:

   1. Select the relevant organization with the project picker and navigate to Logging > Configure > Log router.
   2. Click Create sink.
   3. In the Sink name field, enter tenable-audit-logs and then click Next.
   4. For the sink service, select Cloud Pub/Sub topic and then Use a Cloud Pub/Sub topic in a project.
   5. In the Sink destination field, replace [PROJECT_ID] and [TOPIC_ID] with the relevant IDs and click Next.

   6. Select Include logs ingested by this organization and all child resources, and then paste the following in the inclusion filter:

      Copy

      LOG_ID(cloudaudit.googleapis.com/activity) OR
      LOG_ID(cloudaudit.googleapis.com/data_access) OR
      LOG_ID(cloudaudit.googleapis.com/policy)

   7. Click Next.
   8. Click + Add exclusion.

   9. In the Exclusion filter name field, enter exclude-k8s-internal and then paste the following in the exclusion filter:

      Copy

      protoPayload.authenticationInfo.principalEmail-:* OR
      protoPayload.authenticationInfo.principalEmail=~"^system:" OR
      protoPayload.authenticationInfo.principalEmail=~"@container-engine-robot.iam.gserviceaccount.com$" OR
      protoPayload.authenticationInfo.principalEmail=~"@security-center-api.iam.gserviceaccount.com$"

   10. Click Create sink.
   Important: Even if you are a GCP Organization Admin or Super Admin, Google Cloud segregates logging permissions by default. If you receive the error Permission logging.sinks.create denied on resource when trying to create the sink, you must explicitly grant your user account the Logging Admin or Logs Configuration Writer role at the organization level.
4. Assign the Pub/Sub Publisher role to the service account at the organization level.
   1. Go to IAM & Admin > IAM.
   2. Find the service account and click Edit principal.
   3. Click + Add another role.
   4. Select Pub/Sub Publisher.
   5. Click Save.