GCP Scanner

The GCP Scanner is a native scanner type that inspects a connected Google Cloud project, folder, or organization, discovering the full inventory of identities such as Google Cloud users, groups, and service accounts, secrets stored in Secret Manager, and certificates managed through Private CA, Certificate Manager, and Compute Engine SSL certificates, along with the relationships between them. Each discovered object is evaluated against Identity & Secrets Intelligence security policies, which assess its risk posture and surface the resulting findings for review.

Prerequisites

• An Akeyless account with the Identity & Secrets Intelligence license.
• A deployed and connected Akeyless Gateway version 4.52.0 and later.
• A Gateway with Akeyless AI Insights configured.
• A GCP Target representing the service account that will scan the project, folder, or organization.
• The service account used by the Target granted the permissions listed under Required GCP Permissions below.
• Access to configure and run the scanner, granted via:
  1. "Manage ISI Scanners" or "Admin" Gateway Permission.
  2. "Identity & Secrets Intelligence" Administrative Rule set to Scoped or All.
  3. "List" permission on the GCP Target.

Required GCP Permissions

The service account used by the Target needs read access to your Google Cloud resource hierarchy. There are two ways to grant it:

• Quick Setup - assign a small set of predefined viewer roles. Fastest to configure, but grants more access than the scanner actually uses.
• Granular Permissions - assign only the exact permissions the scanner needs, following the principle of least privilege.

Both produce a complete scan, the difference is privilege scope, not scan coverage.

Quick Setup

Grant the scanner's service account these predefined roles:

• roles/browser
• roles/resourcemanager.folderViewer
• roles/iam.securityReviewer
• roles/secretmanager.viewer
• roles/logging.viewer
• roles/policyanalyzer.activityAnalysisViewer
• roles/privateca.auditor
• roles/certificatemanager.viewer
• roles/compute.viewer

Granular Permissions

All permissions below are read-only. The scanner never requires write access to your Google Cloud environment, and never reads secret values, only metadata.

Required Permissions

The permissions listed below are required for the scan to complete successfully. If any one of them is missing, the corresponding scan will fail.

Additional Permissions for Complete Coverage

These permissions are optional. If missing, the scan still completes, but with reduced visibility, and any gaps are reported in the Access Status field within the scan details.

Prerequisites Beyond IAM

Granting the permissions above is not sufficient on its own, the following must also be in place:

• APIs enabled per scanned project: Cloud Resource Manager, IAM, Secret Manager, and (per capability) Cloud Logging, Private CA, Certificate Manager, Compute Engine, Policy Analyzer. A disabled API is reported as a warning, granting a role does not fix it.
• Data Access audit logs: secret last-accessed dates require a DATA_READ audit-log configuration for Secret Manager (or all services) in the project.
• Workspace groups: group expansion requires domain-wide delegation configured in the Google Workspace Admin Console, plus a Workspace admin email set in the scanner settings.

Create a GCP Scanner

1. Log in to the Akeyless Console, and go to Products > Identity & Secrets Intelligence > Scanners.
2. Click New, and select the scanner type GCP, then click Next.
3. Define a Name for the scanner.
4. Select the Target representing the project, folder, or organization to scan, and the Gateway that will execute the scans, then click Next.
5. Use the Object Type drop-down list to select the scanner's scope, and click Finish.

Run a Scan

1. Log in to the Akeyless Console, and go to Products > Identity & Secrets Intelligence > Scanners.
2. Click the GCP scanner.
3. Click Start Scan.

Once the scan completes, results appear in Inventory for review.