# (Google Cloud) Service Account Policy Management

## Service Account Policy

**SpaceONE** highly recommends to set appropriate permissions to **Service Account** for each purpose.&#x20;

* **General Collector** (Retrieve Google Cloud Resources into **SpaceONE** Inventory)
  * Google Compute VM Collector - **google-cloud compute**
  * Google Cloud Service Collector - **google-cloud-services**
  * Google power state Collector - **google-cloud-power-state**
* **Power-scheduler** (Post Action to Google Cloud resources to turn on/off for following resources Compute VMs, Instance group, Cloud SQL) with [register schedule](https://spaceone-dev.gitbook.io/user-guide/automation/power-scheduler)
  * Google Cloud power Controller<br>

**STEP 1. Please, Set service account**  to Create API for each use case:

* [**General Collector**](#general-collector)
  * [**Special Roles**](#special-roles)&#x20;
* [**Power Controller**](#power-controller)

**STEP 2. Register Your Service Account into SpaceONE**&#x20;

* [**Register Service Account into SpaceONE**](#register-your-service-account-into-spaceone)

## General Collector&#x20;

Collector requires appropriate authorities to collect cloud resources. We strongly recommend to limit collector's service account its permission to **read only access**.&#x20;

Otherwise, you can add more restrictions per resources or actions. One of the useful example is to restrict its rights within region.

**STEP 1. Log in Google Cloud Console > IAM**&#x20;

Go to IAM >  Service Account and Click **`+ CREATE SERVICE ACCOUNT`**

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MT9hVaVP1WjO_BTOD1X%2F-MT9jvl6FFLOZwwUBmyC%2FScreen%20Shot%202021-02-10%20at%2016.00.20.png?alt=media\&token=5b9d7794-80bf-4e68-a85c-2eda00c7407e)

**STEP 2. Set Service account details**

Enter ***Service account name***, and ***Service account description***

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MT9mH3OvpszTuVfb1GS%2F-MT9n4PkyFYroQ_BR_np%2FScreen%20Shot%202021-02-10%20at%2016.16.10.png?alt=media\&token=a2b9b603-ab55-462c-85cf-f97622a5de8a)

**STEP 3: Grant Service account  to project**

Set Permission to Viewer(Role): Read All Access and Click **`CONTINUE`**

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MT9mH3OvpszTuVfb1GS%2F-MT9qcEYOEMQUZjMkofr%2FScreen%20Shot%202021-02-10%20at%2016.27.10.png?alt=media\&token=3e576ac6-6310-41d0-8ce2-265c1b0b88c5)

**STEP 4: Grant Users access to this service Account (optional)**&#x20;

***You can skip this process*** and move to next.  \
Set Service account users role and Service account admin role.

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MT9qxwsCvlfeOgjzaws%2F-MT9s1iY43kanQpiYFD-%2FScreen%20Shot%202021-02-10%20at%2016.36.25.png?alt=media\&token=8a7cd8b1-bd92-4ae0-9ccb-a3769f8827ae)

Click **`DONE`** if everything is finished.&#x20;

\
**STEP 5: CREATE KEY**

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MT9qxwsCvlfeOgjzaws%2F-MT9uoxXYoJE1H70Ig07%2FScreen%20Shot%202021-02-10%20at%2016.44.34.png?alt=media\&token=3755520c-7a6c-44de-a6dc-020a8c352770)

Find a Service account that you created right before in previous step. Click Action button and Selec&#x74;**`Create Key`** &#x20;

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MT9qxwsCvlfeOgjzaws%2F-MT9xjaMUoWf3Ap5X539%2FScreen%20Shot%202021-02-10%20at%2017.01.11.png?alt=media\&token=ce9be48e-3b1b-4b58-8a13-0abe589dd688)

Select Key Type and Click **`CREATE`** button. We suggest JSON Type  as recommended above.

**STEP 6: Review**

You will see Key ID on the list and its service account JSON on your local.&#x20;

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MT9qxwsCvlfeOgjzaws%2F-MT9yuo_Dp-vfzntjD3c%2FScreen%20Shot%202021-02-10%20at%2017.05.55.png?alt=media\&token=65857f38-65cc-4aff-ab6a-40ea449b90d8)

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MT9qxwsCvlfeOgjzaws%2F-MT9yzB1zAU1pqqITZhB%2FScreen%20Shot%202021-02-10%20at%2017.07.16.png?alt=media\&token=71699a8b-cca9-499d-aa87-b07a4b39defa)

### Special Roles

***SpaceONE***'s ***General Collector*** requires permission to access for following services:

{% hint style="info" %}
**Google Cloud APIs are categorized as its types, and therefore must set up a Special Role that Collect to other than general cloud services.**  &#x20;
{% endhint %}

* Cloud Storage
  * Object
    * list
    * get
    * getIamPolicy
  * Bucket
    * list
    * get
    * getIamPolicy
* Big Query
  * Resource Viewer
  * Data Viewer

**Step 1. Create Role**

Go to IAM > Role > **+ Create Role**

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MXfZd-Fg0QImR2TAMrX%2F-MXfaBj9RzUEEWV3vW8m%2FScreen%20Shot%202021-04-07%20at%2018.09.05.png?alt=media\&token=d9158d43-a64c-4e46-8a3b-89efed398192)

**Step 2. Add Permissions to Role**

**Please, find appropriate permission within cloud services**

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MXfZd-Fg0QImR2TAMrX%2F-MXfcEloIPsm7FcgfP-f%2FScreen%20Shot%202021-04-07%20at%2018.18.42.png?alt=media\&token=3aef157e-ca89-4830-a2dd-6f5d3031077f)

* storage.buckets.get
* storage.buckets.getIamPolicy
* storage.buckets.list
* storage.objects.get
* storage.objects.getIamPolicy
* storage.objects.list

Click **`ADD`** button

\
**STEP 3: Review Permission**&#x20;

Review permissions in created role.

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MXfZd-Fg0QImR2TAMrX%2F-MXfclcfM1yBx84skC1s%2FScreen%20Shot%202021-04-07%20at%2018.20.27.png?alt=media\&token=d1b2753e-1d93-4525-be0d-8ca1b5e2057e)

**STEP 4: Set Created Role into Service Account**&#x20;

Drive to Menu IAM > IAM&#x20;

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MTAMR3qxRC7FnWgdGpu%2F-MTAOIanqw9McrIQA8oH%2FScreen%20Shot%202021-02-10%20at%2019.02.52.png?alt=media\&token=38466a8f-d2b9-42f6-9a06-ef94703cf36a)

Click pencil icon to edit and Add New Role that created in previous step

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MXfZd-Fg0QImR2TAMrX%2F-MXfe6i2VMnIyrAjyr6f%2FScreen%20Shot%202021-04-07%20at%2018.24.41.png?alt=media\&token=083dca8c-7e38-4e06-8d34-a200215443c2)

**STEP 5: Set BigQuery Permission into Service Account**&#x20;

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MXfZd-Fg0QImR2TAMrX%2F-MXfeVDQey3BQs8nR3KR%2FScreen%20Shot%202021-04-07%20at%2018.26.14.png?alt=media\&token=d2fdf3ca-0c6c-4ec0-b581-de77ec5c85b8)

Click **`Save`** button.

## Power Controller

***SpaceONE***'s ***Power Scheduler*** requires edit permission to update following Cloud Services:&#x20;

* **VM Instance**
* **Instance Group**
* **Cloud SQL**

**Step 1. Create Role**

Go to IAM > Role > **+ Create Role**

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MTAC2c0Hu-3EEQjLUim%2F-MTACOosMULQytKr7eKo%2FScreen%20Shot%202021-02-10%20at%2018.09.00.png?alt=media\&token=e95b48cc-4c67-4354-a35d-cc5ae1198d2e)

**Step 2. Add Permissions to Role**

**Please, find appropriate permission within cloud services**

* VM Instance&#x20;
  * Start
  * Stop
  * Reset
* Instance Group (Manager)
  * Resize
  * Autoscaler
    * Update
* Cloud SQL
  * Update

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MTACmlC3joKLYNBytJU%2F-MTAFXS_I-GkwS2Mb9h7%2FScreen%20Shot%202021-02-10%20at%2018.23.13.png?alt=media\&token=ad1c8d00-59a2-49ce-8be2-49e367a7f62c)

Click **`ADD`** button

\
**STEP 3: Review Permission**&#x20;

Review permissions in created role.

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MTAMR3qxRC7FnWgdGpu%2F-MTANEZFBmVEIPHzWGpV%2FScreen%20Shot%202021-02-10%20at%2018.57.43.png?alt=media\&token=a0f619c7-a947-47bd-93f6-d8dadc3efa04)

**STEP 4: Set Created Role into Service Account**&#x20;

Drive to Menu IAM > IAM&#x20;

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MTAMR3qxRC7FnWgdGpu%2F-MTAOIanqw9McrIQA8oH%2FScreen%20Shot%202021-02-10%20at%2019.02.52.png?alt=media\&token=38466a8f-d2b9-42f6-9a06-ef94703cf36a)

Click pencil icon to edit and Add New Role that created in previous step.&#x20;

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MTAMR3qxRC7FnWgdGpu%2F-MTAOzcsXf675Q2UrJ0Z%2FScreen%20Shot%202021-02-10%20at%2019.05.18.png?alt=media\&token=0afee047-f868-4ba6-9afe-8b65f9f70124)

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MTAMR3qxRC7FnWgdGpu%2F-MTAOx5gsNB6zkNe46u_%2FScreen%20Shot%202021-02-10%20at%2019.05.26.png?alt=media\&token=b57eca12-d894-4226-ab8e-16f093101415)

&#x20;Click **`Save`** button.

## Register Your Service Account into SpaceONE

**Step 1: Please, Sign In into SpaceONE portal**

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MYO5Stvfef3VYcyHS8P%2F-MYO6UubGM1XlqG5HrBS%2FScreen%20Shot%202021-04-16%20at%2014.17.41.png?alt=media\&token=b22cc927-f592-4e1d-90f7-3eccb1f4901d)

**Step 2: Drive to menu Service Account : `Identity` > `Service Account` from Top Menu bar**

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MYO5Stvfef3VYcyHS8P%2F-MYO6YBmYV25sWTY5NtE%2FScreen%20Shot%202021-04-16%20at%2014.18.20.png?alt=media\&token=7708da4c-8188-40b4-b48d-54b3bd4510ce)

**Step 3: Select Provider Google > Click `+ Add` Button**

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MYO5Stvfef3VYcyHS8P%2F-MYOEGSvzoNI7iisblMN%2FScreen%20Shot%202021-04-16%20at%2014.36.04.png?alt=media\&token=755225e0-91ba-4c13-aa5d-6d55155e1cd2)

**Step 4: Please, fill out all required fields as below with your Service Account JSON that you issued at** [**General Collector Step**](#general-collector)**.**

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MYOUbLWmrhl6HRhLMvx%2F-MYOV8N9QPABtU_GEXk5%2FScreen%20Shot%202021-04-16%20at%2016.06.09.png?alt=media\&token=24d8d8ed-07c4-4928-9f4c-ceb8d8d8b9a1)

\
**Step 5: Fill out Credentials Info or simply copy and paste JSON and Select Project that you want to map service account.** <br>

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MYOUbLWmrhl6HRhLMvx%2F-MYOWYWfF5A-QSJlsyZy%2FScreen%20Shot%202021-04-16%20at%2016.11.11.png?alt=media\&token=58a42875-269c-4289-8b87-cf258011f178)

**Step 6: Click `Save` Button and Check if Service Account has register on the list.**&#x20;

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MYOUbLWmrhl6HRhLMvx%2F-MYOXKsUHaGzSZIA38UJ%2FScreen%20Shot%202021-04-16%20at%2016.14.44.png?alt=media\&token=c1587ffe-981e-48da-b284-425a8605baee)
