Connect a GCP Project

Connect an individual GCP project to Tenable to monitor its cloud resources and security posture. To connect all projects in your organization at once, see Connect a GCP Organization.

Prerequisites

Before you begin:

• Grant sufficient permissions to the user who will create projects, create service accounts, authorize the service accounts, and enable logging in the Google Cloud Console.
• Define exceptions to allow Tenable network access if you use VPC Service Controls to restrict access to Google-managed services.
• Verify that your organization does not have a domain restriction policy that would block Tenable as a principal in IAM policies. If it does, Add Tenable as an Allowed Domain.
• Create a dedicated project for each Google Organization (including all its projects) that will host the service account used by Tenable.
• Enable billing for the dedicated project in the Google Cloud Console. For instructions, see Google's documentation on enabling billing{target=_blank}.

Connect a Project

To connect a GCP project:

1. In the Tenable One AI Exposure Console, navigate to Settings > Integrations and click + Add Integration.
2. In the Integrations Library, click GCP Project. The GCP Project wizard opens.
3. In the wizard:
   1. Enter the project ID of the GCP project you want to connect.
   2. Enter the organization ID. AI Exposure does not currently support projects that are not part of an organization.

   3. Under Google Workspace, select whether to use an existing Google Workspace integration. If an integration does not exist, you can click + Create.

      Note: Tenable recommends using your Google Workspace with your organization to enable identity-related visibility and complete risk assessment. Doing so:

      • Enables identity-related visibility, including users, permissions, and least-privilege analysis, providing a more complete risk assessment across your GCP cloud environment.
      • Allows visibility into identities, permissions, and access relationships, enhancing security posture management beyond just resource visibility.
   4. Under Capabilities, select the capabilities to enable. Your selection determines the required permissions and dynamically updates the deployment script. Tenable recommends enabling all capabilities to provide the most comprehensive security coverage. For more information, see Google Required Permissions.
   5. Under Deployment, select one of the following deployment options:
      • Cloud Shell. Script-based deployment.
        1. Enter the Management Project ID. This is the ID of the dedicated project hosting the service account for this integration.
        2. Copy the script displayed in the AI Exposure wizard, create a file with the script content, and then run it in your Cloud Shell to grant AI Exposure the required permissions.

      • Manual. Manually, via the Google Cloud Console. See Manually Deploy a GCP Project for step-by-step instructions.

        Caution: When you finish manual deployment, return to the wizard to complete Post Deployment.

   6. Under Post Deployment, enter the following values.

      Note: Keep the following in mind about the integration values:

      • How to retrieve values
        • Cloud Shell: Copy/paste the values from the script output.
        • Manual: See Manually Deploy a GCP Project for how to retrieve these values.
      • Shared integration values
        • These values must be identical across all projects in the same organization.
        • If a parent organization integration exists, these fields are managed at the organization level. Changes propagate automatically to all member projects.
   • Service Account Email
   • Pub/Sub Subscription Name
4. Click Finish.

Next steps:
After your project is added successfully:

• You can see the project on the Accounts > GCP page. From here you can manage your project and view project details to see, for example, which features are enabled and whether the required permissions were granted.

Data about your project resources will start to appear in AI Exposure. The time it takes for all data to appear varies depending on the size of your cloud environment.

Manually Deploy a GCP Project

As an alternative to the script-based deployment, you can manually deploy your GCP project via the Google Cloud Console. These procedures are relevant if you selected Manual for the deployment type when connecting your GCP project.

1. Create a Service Account for Tenable
2. Authorize the Service Account at the Org Level
3. Authorize the Service Account at the Project Level
4. Configure Audit Logs
5. Create a Custom Role with Org-Level Permissions

Create a Service Account for Tenable

Create a dedicated GCP project and service account that Tenable uses to access and monitor your project.

1. In the Google Cloud Console{target=_blank}, navigate to the project you created.
2. Go to IAM & Admin > Roles and then click + Create custom role.
3. Enter a title, description, and ID.
4. Click + Add permissions, and add the permissions listed under Create Service Account in Required Permissions.
5. Click Create to finish creating the role.
6. Go to IAM & Admin > Service Accounts and then click + Create service account.
7. Enter a Service account name, ID, and description.
8. Copy and save the service account email that is generated. You will need to enter this value in the Post Deployment section of the wizard when connecting your organization to AI Exposure.
9. Click Create and continue.
10. Select the custom role you created, and then click Continue and Done.

11. Select the newly created service account, click the Principals with access tab, and then Grant access.

    Important: If you are unable to grant access, you may have an organization policy with a domain restriction constraint that prevents choosing Tenable as a principal in IAM policies. This prevents Tenable from impersonating the created service account. If this is the case, follow the procedure described in Add Tenable as an Allowed Domain.
12. In the Add principals section, enter [email protected] in the New principals field.
13. In the Assign roles section, select the Service Account Token Creator role and then click Save to finish.
14. Go to IAM & Admin > Labels, click + Add label, and add the key/value pair that appears in the AI Exposure wizard:
    • Label key: ermetic-external-id
    • Value — Appears in the Deployment section of the AI Exposure wizard
15. Click Save to finish creating the service account.

Authorize the Service Account at the Org Level

Grant the service account the organization-level permissions Tenable requires to access and monitor your GCP environment. For step-by-step guidance on resolving GCP role and permission errors, see Resolve Cloud Onboarding Permission and Role Errors (AWS, Azure, GCP).

Role bindings in this procedure are granted at the organization level, following Tenable's best-practice recommendations. If you are not planning to connect your entire organization (for example, as part of a trial), Tenable supports granting these role bindings at the project level instead. In that case, you must still grant a basic set of permissions at the organization level via a custom role, and then contact Technical Support for assistance completing the integration. For more information, see Grant Organization-Level Permissions.

1. In the Google Cloud Console{target=_blank}, select the organization you want to connect to Tenable using the project picker at the top left of the screen.
2. Navigate to IAM & Admin > IAM and then click Grant access.
3. In the Add principals section, enter the service account email you saved earlier in the New principals field.
4. In the Assign roles section, add the following roles:
   • Cloud Asset Viewer
   • Security Reviewer
   • Organization Policy Viewer
   • Organization Viewer
5. Click Save to finish.

Authorize the Service Account at the Project Level

Grant the service account the project-level permissions Tenable requires to scan and monitor your project.

1. In the Google Cloud Console{target=_blank}, select the relevant project using the project picker at the top left of the screen.
2. Navigate to IAM & Admin > IAM and then click Grant access.
3. In the Add principals section, enter the service account email you saved earlier in the New principals field.
4. In the Assign roles section, select relevant roles according to the desired capabilities.

5. Click Save to finish.

   Note: If you enabled Workload Protection in the Capabilities section, there is an additional step to grant Workload Protection permissions. See the relevant Workload Protection documentation for more information.

Configure Audit Logs

Set up a Pub/Sub topic, log sink, and subscription to stream GCP audit logs to Tenable.

1. In the Google Cloud Console{target=_blank}, select the relevant project with the project picker and create a Pub/Sub topic by following these steps:
   1. Navigate to Pub/Sub > Topics and then click + Create topic.
   2. In the Topic ID field, enter tenable-audit-logs.
   3. Clear Add a default subscription.
   4. Select Enable message retention and set the duration to at least 1 day.
   5. Click Create.
2. Create a Pub/Sub subscription by following these steps:
   1. Navigate to Pub/Sub > Subscriptions and then click + Create subscription.
   2. In the Subscription ID field, enter tenable-audit-logs-sub.
   3. Select the topic you created earlier.
   4. In the Delivery type section, select Pull.
   5. In the Message retention duration section, set the duration to at least 1 day.
   6. In the Retry policy section, select Retry after exponential backoff delay and keep the default values.
   7. In the Expiration period section, select Never expire.
   8. Click Create.
   9. In the Permissions tab of the newly created subscription, click Add principal.
   10. In the Add principals section, enter the service account email you saved earlier in the New principals field.
   11. In the Assign roles section, select the Pub/Sub Subscriber role and then click Save to finish.
   12. Copy and save the Pub/Sub subscription name. You will need to enter this value in the Post Deployment section of the wizard when connecting your project to AI Exposure.
3. Create a log sink by following these steps:
   1. Navigate to Logging > Configure > Log router.
   2. Click Create sink.
   3. In the Sink name field, enter tenable-audit-logs and then click Next.
   4. For the sink service, select Cloud Pub/Sub topic and the relevant topic and then click Next.

   5. Paste the following in the inclusion filter:

      Copy

      LOG_ID(cloudaudit.googleapis.com/activity) OR
      LOG_ID(cloudaudit.googleapis.com/data_access) OR
      LOG_ID(cloudaudit.googleapis.com/policy)

   6. Click Next.
   7. Click + Add exclusion.

   8. In the Exclusion filter name field, enter exclude-k8s-internal and then paste the following in the exclusion filter:

      Copy

      protoPayload.authenticationInfo.principalEmail-:* OR
      protoPayload.authenticationInfo.principalEmail=~"^system:" OR
      protoPayload.authenticationInfo.principalEmail=~"@container-engine-robot.iam.gserviceaccount.com$" OR
      protoPayload.authenticationInfo.principalEmail=~"@security-center-api.iam.gserviceaccount.com$"

   9. Click Create sink.

Create a Custom Role with Org-Level Permissions

In the procedure outlined above, role bindings are granted at the organization level, following AI Exposure's best practices. However, if you are not planning to connect your entire organization at any point (e.g., as part of a trial), AI Exposure supports granting these role bindings at the project level instead. If you decide to grant role bindings at the project level, AI Exposure still requires that you grant a basic set of permissions at the organization level.

To create a custom role:

1. In the Google Cloud Console{target=_blank}, select the relevant organization using the project picker at the top left of the screen.
2. Navigate to IAM & Admin > Roles and then click + Create custom role.
3. Enter a title, description, and ID.
4. Click + Add permissions, and add the permissions listed in Org-Level Custom Role for Single-Project Connections.
5. Click Create to finish creating the role.
6. Add the custom role to the Tenable service account, on the organization level.

For more information about creating custom roles, refer to the relevant Google Cloud documentation. For more information about why AI Exposure requires organization-level permissions when connecting an individual project, see Grant Organization-Level Permissions.