Google Required Permissions

The following permissions are required to connect Google Workspace and GCP projects/organizations to Tenable One AI Exposure.

Google Workspace Permissions

You need to create a service account for Tenable. You can grant permissions to the service account in one of the following two ways when you Connect a Google Workspace:

Custom role — Recommended for most organizations.
Domain-wide delegation — Recommended for organizations that require Advanced IAM functionality.

Both methods support all core product functionality, including Just-In-Time (JIT) Access.

Required Permissions

Step	Permission	Description
1. Create Service account	resourcemanager.projects.get	Allows read access to project metadata, including project name, ID, and associated labels.
	serviceusage.services.enable serviceusage.services.list	Allows viewing and enabling services (APIs) within a Google Cloud project. This is required to activate specific APIs that AI Exposure depends on.
	Service Account Token Creator	Allows Tenable to generate access tokens to communicate with the API. For more information about why this permission is required, see Service Account Token Creator Role.
2a. Custom role (Recommended)	Manage customer: Read customer (all)	Allows read access to retrieve the primary domain name. This property is used for GCP permission evaluation.
	Groups: Read	Allows read access to groups.
	Organization Units: Read	Allows read access to organization units.
	Users: Read	Allows read access to users.
	(Optional) Groups: Update	Allows leveraging Just-In-Time access to temporarily add users to Google Workspace groups.
2b. Domain-wide delegation (Advanced)	OAuth scopes: cloud-identity.groups.readonly admin.directory.customer.readonly admin.directory.domain.readonly admin.directory.group.readonly admin.directory.orgunit.readonly admin.directory.rolemanagement.readonly admin.directory.user.readonly admin.reports.audit.readonly cloud-identity.inboundsso.readonly	Allows read access to organization units, groups, users and advanced IAM features such as Admin roles and SSO profiles. For more information, see Added IAM Capabilities with Domain-Wide Delegation

GCP Project and Organization Permissions

Feature	GCP Roles	Notes
Monitoring (read-only)	App Engine Viewer Artifact Registry Reader BigQuery Metadata Viewer Cloud Asset Viewer Compute Network Viewer Compute Viewer Kubernetes Engine Viewer Organization Policy Viewer Organization Viewer Security Reviewer	When connecting a GCP organization, these permissions must be granted at the organization level. Assign Organization Viewer at the organization level, including for projects.
Data Protection	Custom role with the following permissions: bigquery.datasets.get bigquery.datasets.getIamPolicy bigquery.models.export bigquery.models.getData bigquery.models.getMetadata bigquery.models.list bigquery.routines.get bigquery.routines.list bigquery.tables.createSnapshot bigquery.tables.export bigquery.tables.get bigquery.tables.getData bigquery.tables.getIamPolicy bigquery.tables.list bigquery.tables.replicateData cloudsql.backupRuns.create cloudsql.backupRuns.delete cloudsql.backupRuns.get cloudsql.backupRuns.list cloudsql.instances.get dataplex.projects.search resourcemanager.projects.get resourcemanager.projects.list storage.folders.get storage.folders.list storage.managedFolders.get storage.managedFolders.list storage.objects.get storage.objects.list	See Data Protection documentation for more information.
Workload Protection	Custom role with the following permissions: compute.disks.createSnapshot compute.disks.use compute.snapshots.create compute.snapshots.delete compute.snapshots.setIamPolicy compute.snapshots.setLabels compute.snapshots.useReadOnly	Using this feature requires the Standard/Enterprise license. See Workload Protection documentation for more information.
Remediation (read-write)	BigQuery Data Owner Security Admin Service Account Admin
Just-In-Time Access (User Access Administrator)	Security Admin
Audit logs	Pub/Sub Subscriber	See the steps to configure audit logs for projects or organizations for specific instructions.

Org-Level Custom Role for Single-Project Connections

If you connect an individual GCP project without connecting its parent organization, AI Exposure still requires a basic set of permissions granted at the organization level, via a custom role with the following permissions:

`cloudasset.assets.searchAllIamPolicies`
`compute.firewallPolicies.list`
`iam.roles.get`
`iam.roles.list`
`iam.workforcePools.list`
`iam.workforcePoolProviderKeys.list`
`iam.workforcePoolProviders.list`
`recommender.iamPolicyInsights.list`
`recommender.iamPolicyRecommendations.list`
`resourcemanager.folders.getIamPolicy`
`resourcemanager.folders.list`
`resourcemanager.organizations.get`
`resourcemanager.organizations.getIamPolicy`
`resourcemanager.projects.list`

See Create a Custom Role with Org-Level Permissions for the procedure to create this role, and GCP FAQs for more information about why this is required.