At-a-Glance

What it does: Connects GCP with Drata to sync IAM users for Access Reviews and automate infrastructure monitoring/evidence collection.
Who it’s for: Security, compliance, and IT administrators managing GCP IAM and infrastructure.
Directionality: One-way (GCP → Drata). Drata only imports IAM users and infrastructure evidence.

Prerequisites & Data Access

Google Workspace account (user): Must be a Super Admin.
- Used in Step 2 to grant domain-wide delegation so Drata can read MFA status.
GCP account (user running the script): Must have permissions that have the following roles granted
- Organization Administrator
- Organization Policy Administrator
- Organization Role Administrator
- Service Account Admin
- Service Account Key Admin
- Service Usage Admin
Scope decision: Organization vs. Project level
- When running the script or Terraform, you’ll be asked whether the service account should connect at the organization level (recommended) or the project level.
  - Organization level: One setup covers all projects.
  - Project level: You’ll need to repeat the setup for each project.
Estimated setup time: ~30–45 minutes.

Permissions & Data Table

Permission / Scope	Why It’s Needed (and When)	Data Accessed (Read Only)
Compute Engine API	Monitors SSH access, firewall rules, load balancers, VM usage (Step 1).	VM configs, firewall rules, load balancer data
Cloud Resource Manager API	Reads IAM principals and org/project structure for Access Reviews (Step 1).	Org/project metadata, IAM principals
Admin SDK API (Workspace)	Verifies MFA status of IAM users (Step 2; required for Test 88).	MFA status, user/group directory info
Cloud SQL Admin API	Checks database encryption and backup settings (Step 1). Note: Enabled by the setup script by default. Only used if your org runs Cloud SQL.	DB configs, encryption/backup settings
Cloud Monitoring API	Collects resource metrics (CPU, I/O, storage utilization, queue age) (Step 1). Note: Enabled by the setup script by default. Only used if Infrastructure monitoring is enabled in Drata.	Monitoring metrics
Cloud Storage API	Ensures encryption and versioning for storage buckets (Step 1).	Storage configs, encryption, versioning

Enable (GCP) Google Cloud Platform

Go to Drata’s Connections page. Then, search and select for GCP.
Choose a connection type:
- Access Review: Sync IAM users.
- Infrastructure: Enable monitoring tests.
- You can enable Access Review and/or Infrastructure later during the connection process in Drata as well.

Step 1: Connect your Google Cloud Platform (GCP)

You have two ways to connect your GCP. You can either connect using a script or connect manually. It is recommended to connect using a script.

Script (Recommended)
- GCP native script instructions: https://github.com/drata/gcp-shell-drata-setup
- Terraform script instructions: https://github.com/drata/gcp-terraform-drata-setup
Connect manually
- Go to Manually connect GCP for step by step instructions.

Step 2: Provision domain wide delegation client in Google Workspace

We need to grant the GCP service account access to your connected Google Workspace account.

Please login to your Google Admin console with an account that has Super Admin privileges, then go to "Security → Access and data control → API controls." Scroll to the bottom to get to Domain wide delegation.
In the Domain wide delegation section, click on Manage Domain Wide Delegation button.
- Note: If you are using Google Workspace as your IdP and you have already connected it to Drata, you will see another entry in the Domain Wide Delegation list. It's OAuth scope will be:
  - https://www.googleapis.com/auth/admin.directory.user.readonly
- Ensure this entry remains intact so as not to break your IdP connection.

Click on the Add new button.

Enter the numeric client ID (unique ID - not the service account email address
- For those that utilized the script or terraform, you can pull the client ID from the newly created "drata-key-file.json".
Leave the Overwrite existing client ID checkbox un-checked.

Copy and paste the Cloud Platform Scope into the OAuth scopes (comma-delimited) text field.

Cloud Platform Scope:

https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.directory.group.member.readonly,https://www.googleapis.com/auth/cloud-identity.groups.readonly

For improved readability, the same scopes are listed without commas and separated by spaces:

https://www.googleapis.com/auth/admin.directory.user.readonly
https://www.googleapis.com/auth/admin.directory.group.readonly
https://www.googleapis.com/auth/admin.directory.group.member.readonly
https://www.googleapis.com/auth/cloud-identity.groups.readonly