Skip to content
All guidesGetting started

Connect Google Cloud using a Service Account JSON key

The simple path: a read-only Viewer service account key, stored encrypted and used only for scan calls.

  1. 1Select the correct project. 1. Open the Google Cloud Console. 2. Click the project selector at the top. 3. Select the project you want to connect to Cybermatic. 4. Confirm that the correct project name appears at the top.
  2. 2Confirm “Disable service account key creation” is off or not enforced. Go to: Navigation menu → IAM & Admin → Organization Policies. Click on View Constraints. In the Name column, find “Disable service account key creation”. This corresponds to “iam.disableServiceAccountKeyCreation” in the ID column. It may also be shown under “iam.managed.disableServiceAccountKeyCreation”. If it’s showing Inactive in the Status, move to the next step. If it’s showing Active: click on “Disable service account key creation”, click Manage policy, then — Under Policy source, select: Override parent's policy. Click Add a rule if a rule is not already displayed. Under Enforcement, select: Off. Click Done. Click Set policy. The intended configuration is — Policy source: Override parent's policy · Enforcement: Off. Confirm the policy is disabled: return to the policy details page and verify that the effective policy for the project says something similar to “Not enforced” or “Enforcement: Off”.
  3. 3Create the Cybermatic service account. 1. Open the navigation menu in the upper-left corner. 2. Go to: IAM & Admin → Service Accounts. 3. Confirm that the correct project is selected. 4. Click Create service account. 5. Enter the following — Service account name: cybermatic-scanner Service account ID: Google should automatically create: cybermatic-scanner The resulting email address will resemble: cybermatic-scanner@YOUR_PROJECT_ID.iam.gserviceaccount.com Service account description: Read-only service account used by Cybermatic to scan Google Cloud resources and security configurations. 6. Click Create and continue. Google generates the service-account ID from the name. The ID cannot be changed after the service account is created.
  4. 4Grant the Viewer role. You should now see the section named: Grant this service account access to project. 1. Click the Select a role field. 2. Search for: Viewer 3. Select: Viewer 4. Verify that you selected Viewer, not: Editor, Owner, or Service Account User. 5. Click Continue. 6. Leave the optional service-account user and administrator fields blank. 7. Click Done. The legacy Viewer role provides project-wide read-only access and generally allows viewing — but not modifying — existing Google Cloud resources.
  5. 5Enable the required Google Cloud APIs. Go to: Navigation menu → APIs & Services → Library. Make sure you are still working in the correct project. Google’s normal process is to search for an API, open its page, and click Enable. If the page shows Manage, the API is already enabled. 1. Cloud Resource Manager API — allows the scanner to identify and read project-level resource information. 2. Compute Engine API — used to enumerate resources such as virtual machines, networks, firewall rules, disks, addresses, and related Compute Engine configurations. 3. Cloud SQL Admin API — exposes Cloud SQL instance configuration information. Verify the APIs: go to APIs & Services → Enabled APIs & services and search for each of these: Cloud Resource Manager API, Compute Engine API, Cloud SQL Admin API. All three should appear in the enabled API list.
  6. 6Create the JSON service-account key. 1. Go to: IAM & Admin → Service Accounts. 2. Find: cybermatic-scanner. 3. Click the service account’s email address. 4. Open the Keys tab. 5. Click: Add key → Create new key. 6. Select: JSON. 7. Click Create. Google will download a file to your computer. Its name will resemble: your-project-name-a1b2c3d4e5f6.json
  7. 7Connect Google Cloud in Cybermatic. 1. Sign in to Cybermatic. 2. Open Connections. 3. Under Connect a cloud or SaaS account. 4. Choose: Google Cloud. 5. Change the authentication method to JSON key. 6. Open the downloaded JSON file using a trusted text editor. 7. Select and copy the entire JSON document, including the opening and closing braces. 8. Paste the entire JSON content into Cybermatic's service-account-key field. 9. Select Connect.
  8. 8Important security warning. The downloaded JSON file contains a private key. Treat it like a password. Do not: • Email it. • Upload it to Slack or Teams. • Place it in a public folder. • Commit it to GitHub or another source-control repository. • Paste it into a support ticket. • Edit individual values inside it.

Tip: Prefer the keyless (WIF) method when you can — the JSON key is a long-lived credential you must protect and rotate. Cybermatic stores it encrypted in AWS Secrets Manager and uses it for read-only calls only.

More in Getting started