# Google Cloud

> GCP project posture and IAM. Prerequisites, setup steps and troubleshooting.

Source: https://docs.csquaregrc.com/connectors/gcp

## What it does

Google Cloud gives cSquare read-only posture evidence: IAM bindings, org policies and Security Command Center findings, refreshed on a schedule instead of screenshotted each quarter.

## Prerequisites

- A cSquare GRC workspace where you are an **owner** or **admin**.
- Connection method: **API key or token**.
- Access needed at Google Cloud: Read-only. roles/viewer plus roles/iam.securityReviewer.

## Set up

Open **Settings > Integrations** in [the app](https://app.csquaregrc.com), find Google Cloud, then:

1. Create a dedicated service account in the project or folder you want monitored.
2. Grant it the Viewer and Security Reviewer roles. Do not grant any write role; the collector only reads.
3. Create a JSON key for that service account and download it.
4. Paste the JSON key and the project ID here, then run Test connection.

## Verify the connection

1. Back in **Settings > Integrations**, Google Cloud should show **Connected** with a recent sync time.
2. Open **Evidence** and filter by source **Google Cloud**. The first sync can take a few minutes.
3. Open a control that depends on Google Cloud and confirm the new evidence is linked.

## AI prompts

Paste these into Fibo in the app, or into any assistant connected through [MCP](/mcp/connect).

```text
I just connected Google Cloud to cSquare GRC. Check that it is syncing, list the evidence it has collected so far, and tell me which controls in my active programs now have evidence from Google Cloud.
```

```text
Which controls in my programs could be covered by Google Cloud evidence but still have no current evidence? Group them by framework and suggest what to collect.
```

## Troubleshooting

### PERMISSION_DENIED on securitycenter calls

Security Command Center is not enabled, or the service account lacks Security Center Findings Viewer at the organization level. Enable the API and grant the role.

### Invalid JWT signature

The JSON key was edited or truncated on paste. Re-download the key and paste the whole file contents unchanged.

### Test connection fails immediately

Nine times out of ten the credential was pasted with a trailing space, or it was issued in a different tenant or region. Re-copy it and try again.

### The connector is quarantined

Collection paused after three consecutive failures. Fix the credential, then use Re-test and re-enable on the Active connections tab; it only resumes when the test passes.

### Connected, but no evidence appears

Check that at least one collection type is selected and that the account can see the resources. Read-only accounts scoped to a single project will only return that project.

### Still stuck?

```text
My Google Cloud connector in cSquare GRC is failing. Here is the error I see: <paste error>. Walk me through the likely causes and the exact fix, step by step.
```