Overview & Objectives

Purpose:

This document describes how to onboard a single GCP project into the ARMO Platform. After onboarding, ARMO will have read-only visibility into the project’s resources, IAM policies, network exposure, and audit logs so that it can evaluate compliance, monitor for misconfigurations and risks, and surface attack paths.

Prerequisites

Required IAM Roles

The service account that ARMO uses is granted the following roles:

High-Level Flow

1. In the ARMO platform: initiate the “Connect GCP” flow and enter the display name and the Project ID.
2. In the GCP project: enable the required APIs.
3. In the GCP project: create a custom IAM role and a service account (e.g. cspm-cloud-security) with the required roles.
4. In the GCP project: generate a JSON key for the service account.
5. In ARMO: upload the JSON key and connect the project.
6. Verify data ingestion, alerts, and resource visibility.

Detailed Step-by-Step Onboarding

Step 1: Initiate Onboarding in ARMO Platform

1. Log in to the ARMO Platform and navigate to Settings → Accounts → GCP

2. Click the Google Cloud Platform card → Click Single Project → Click Next

3. In the Google Cloud Console, select the target project and go to Project Settings

4. Copy the Project ID

5. Back in ARMO, paste the Project ID and enter a Display name

   

Step 2: Enable the Required APIs in the GCP Project

In the target GCP project (the one being onboarded):

1. Click the Activate Cloud Shell icon at the top right of the GCP Console. An interactive shell opens at the bottom of the screen.

2. Make sure the shell is pointing at the right project:

   Bash

   gcloud config set project <PROJECT_ID>

3. Copy the command below, paste it into the shell and run it. A success message appears once it completes.

   Bash

   gcloud services enable serviceusage.googleapis.com cloudresourcemanager.googleapis.com iam.googleapis.com compute.googleapis.com storage.googleapis.com bigquery.googleapis.com sqladmin.googleapis.com container.googleapis.com dataproc.googleapis.com dns.googleapis.com cloudkms.googleapis.com apikeys.googleapis.com logging.googleapis.com monitoring.googleapis.com accessapproval.googleapis.com essentialcontacts.googleapis.com containeranalysis.googleapis.com containerscanning.googleapis.com cloudasset.googleapis.com

Step 3: Create the Custom IAM Role

1. Go to IAM & Admin → Roles

2. Click + Create Role

3. Enter a Title (e.g. ARMO CSPM), Description, ID and Role launch stage

4. Click Add permissions and add:

   storage.buckets.getIamPolicy

5. Click Create

Step 4: Create the Service Account and Assign Roles

1. Go to IAM & Admin → Service Accounts
2. Click Create service account
3. Name it (e.g. cspm-cloud-security) and click Create and continue
4. Assign the following roles:
   • Viewer
   • Security Reviewer
   • Service Usage Consumer
   • ARMO CSPM (the custom role from Step 3)
5. Click Done

Step 5: Generate a JSON Key and Connect in ARMO

1. Open the service account you created
2. Go to the Keys tab
3. Click Add Key → Create new key
4. Select JSON and click Create. The key file downloads to your machine.
5. Return to the ARMO platform where you initiated the “Add GCP” flow
6. Upload the downloaded JSON file
7. Click Connect
8. If ARMO shows “Congratulations”, then the onboarding is successful.

Security note: The JSON key grants access to the service account. Once it is uploaded to ARMO, delete the local copy and do not commit it to source control.

Step 6: Confirm Data Ingestion & Monitoring

• In ARMO, check that the project appears in the Settings / Accounts / GCP table.
• Check that ARMO is showing scanning results on the Compliance > Cloud page.
• Initial results typically appear within up to 60 minutes.

Troubleshooting