Skip to content
All guidesGetting started

Connect Google Cloud Identity using WIF — Keyless (recommended)

Workload Identity Federation + a custom read-only admin role assigned directly to the service account: no key file, no impersonation, no domain-wide delegation.

  1. 1Google Cloud and Google Workspace setup for Cybermatic. Values to collect — record these as you complete the setup: Project number Pool ID Provider ID Service-account email Primary Workspace domain
  2. 2Step 1 — Create the service account. 1. Sign in to the Google Cloud console. 2. Use the project selector at the top of the page. 3. Select a project that your organization controls. 4. Open the navigation menu. 5. Go to IAM & Admin → Service Accounts. 6. Select Create service account. 7. Enter: Service account name: cybermatic-identity-scanner Service account ID: cybermatic-identity-scanner Description: Keyless identity used by the Cybermatic Google Workspace scanner 8. Select Create and continue. 9. Do not assign any project-level Google Cloud roles. 10. Select Done. 11. Open the new service account and copy its email address. It should resemble: cybermatic-identity-scanner@PROJECT_ID.iam.gserviceaccount.com Do not create a key — do not open the Keys tab and do not select Add key. Workload Identity Federation is specifically intended to eliminate externally managed service-account keys.
  3. 3Step 2 — Enable all required APIs. Enable all five APIs below to avoid connector failures. 1. Go to APIs & Services → Library. 2. Search for and enable each API: 1. Admin SDK API 2. IAM API 3. IAM Service Account Credentials API 4. Security Token Service API 5. Cloud Resource Manager API 3. Confirm that each API shows API enabled. The Admin SDK supports the Directory API, while Google's WIF setup guidance calls for the IAM, Resource Manager, Service Account Credentials, and Security Token Service APIs.
  4. 4Step 3 — Find the numeric project number. 1. Go to IAM & Admin → Settings. 2. Locate: Project name Project ID Project number 3. Copy the numeric Project number. Example: 123456789012 Do not use the project ID, such as: security-connectors-prod Workload Identity principal identifiers require the numeric project number.
  5. 5Step 4 — Create the Workload Identity pool. Skip this step if you already have the Cybermatic AWS provider configured in Google Cloud and intend to reuse it. 1. Go to IAM & Admin → Workload Identity Federation. 2. Select Create pool. 3. Enter: Name: Cybermatic Pool Pool ID: cybermatic-pool Description: Federated identities used by Cybermatic scanners 4. Verify that the pool is enabled. 5. Select Continue. Pool IDs cannot normally be changed after creation. If your organization enforces the constraints/iam.workloadIdentityPoolProviders org policy, add https://sts.amazonaws.com to the allowed providers list first (Organization policies → workloadIdentityPoolProviders → allow), or the provider creation in the next step will be rejected.
  6. 6Step 5 — Add the Cybermatic AWS provider. Inside the pool-creation workflow: 1. Under Select a provider, choose AWS. 2. Enter: Provider name: Cybermatic AWS Provider ID: cybermatic-aws AWS account ID: 530374616608 3. Select Continue. 4. In Configure provider attributes, select Edit mapping. 5. Configure the following mappings: google.subject = assertion.arn attribute.aws_account = assertion.account 6. Select Save.
  7. 7Step 6 — Allow the federated identity to use the service account. 1. Go to IAM & Admin → Service Accounts. 2. Select: cybermatic-identity-scanner 3. Open the Permissions tab. Depending on the current console layout, the button may be called: Grant access Manage access Add principal 4. In New principals, enter the following, replacing PROJECT_NUMBER: principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/cybermatic-pool/attribute.aws_account/530374616608 Example: principalSet://iam.googleapis.com/projects/123456789012/locations/global/workloadIdentityPools/cybermatic-pool/attribute.aws_account/530374616608 5. Under Assign roles, search for: Workload Identity User 6. Select: Workload Identity User 7. Select Save.
  8. 8Step 7 — Create the Google Workspace read-only role. This step is performed in the Google Admin console, not the Google Cloud console. 1. Sign in to the Google Admin console as a Super Administrator. 2. Go to Account → Admin roles. 3. Select Create new role. 4. Enter: Name: Cybermatic Read Only Description: Read-only Google Workspace directory access for the Cybermatic identity scanner 5. Select Continue. 6. Find and expand Groups. 7. Select only: Read 8. Find and expand Organization Units. 9. Select only: Read 10. Find and expand Users. 11. Select only: Read 12. Select Continue. 13. Review the privileges. 14. Select Create role.
  9. 9Step 8 — Assign the Workspace role to the service account. Use the dedicated service-account assignment workflow rather than the normal user-member workflow. 1. In Account → Admin roles, locate Cybermatic Read Only. 2. Point to the role and select Assign admin. 3. Select Assign service accounts. 4. Enter the complete service-account email: cybermatic-identity-scanner@PROJECT_ID.iam.gserviceaccount.com 5. Select Add. 6. Select Assign role. 7. Verify that the service account appears as an assigned administrator. Google Workspace explicitly supports assigning any prebuilt or custom role except Super Admin directly to a service account. Changes normally occur quickly but can take up to 24 hours.
  10. 10Step 9 — Locate your primary Workspace domain. 1. In the Google Admin console, go to: Account → Domains → Manage domains. 2. Find the entry labeled Primary domain. 3. Copy only the domain name, for example: yourcompany.com Do not enter: • https://yourcompany.com • www.yourcompany.com • admin@yourcompany.com • Your Google Cloud project ID • The service-account email address
  11. 11Step 10 — Connect the configuration in Cybermatic. 1. Sign in to Cybermatic. 2. Open Connections. 3. Find Identity providers. 4. Select Google Cloud Identity. 5. Keep Keyless — recommended selected. 6. Enter: Project number → your numeric project number Pool ID → cybermatic-pool Provider ID → cybermatic-aws Service account email → full .iam.gserviceaccount.com address Primary Google Workspace domain → your primary domain, such as yourcompany.com 7. Double-check that the project number is numeric. 8. Select Connect.
  12. 12What Cybermatic checks. • 2-Step Verification enrollment across all active users — with a Critical finding for any admin without 2SV. • Whether 2SV is actually enforced (enrollment without enforcement decays). • Super Admin count against Google's 2–4 recommendation. • Active accounts with no sign-in for 90+ days. Every user appears on the Identities page with their 2SV status. The scanner acts only through its own minimal read-only role; it cannot read mail or files, and cannot change anything.
  13. 13Troubleshooting. "impersonating the service account was denied (403)" — the Workload Identity User grant from Step 6 is missing or the principalSet string doesn't match; re-check it character-for-character, especially the project number. "Google WIF exchange failed" — pool ID, provider ID, or project number doesn't match what exists; all three appear in Workload Identity Federation → your pool. "reading users was denied (403)" — the admin role assignment from Step 8 is missing or still propagating (usually minutes, up to 24 hours). Confirm the Cybermatic Read Only role lists the service account as an assigned administrator. 2SV status shows Unknown for everyone — some Workspace editions gate the security-report fields behind additional privileges; edit the custom role and additionally grant the security-related read privilege under Users, then rescan. Nothing to rotate — that's the feature. Access is revoked at any time by unassigning the admin role or removing the Step 6 grant.

Tip: The custom role in Step 7 is the entire trust relationship — three read privileges, assigned to one service account, revocable with one click. If an auditor asks what Cybermatic can do in Google, that role's privilege list is the complete answer.

More in Getting started