Overview
Tierity connects to a Google Cloud project with a service account key. Each scan lists the project’s resources through Cloud Asset Inventory and imports findings from Security Command Center, so cloud findings sit alongside the rest of your queue.Prerequisites
- Permission to create service accounts and keys in the project
- Cloud Asset API enabled in the project, and Security Command Center enabled if you want its findings
- Manage access (or higher) in Tierity
Credentials required
The key is encrypted before it’s stored, and Tierity never shows it again after you save it.
Setup
1
Create a service account
In the Google Cloud console, go to IAM & Admin → Service Accounts → Create service account and name it
tierity.2
Grant read-only roles
Give it these roles on the project:
- Cloud Asset Viewer (
roles/cloudasset.viewer) - Security Center Findings Viewer (
roles/securitycenter.findingsViewer)
3
Create a key
Open the service account, go to Keys → Add key → Create new key, choose JSON, and download it.
4
Connect in Tierity
Go to Config → Integrations → GCP, paste the contents of the JSON key, and click Test connection. Add one connection per project.
What gets synced
- Resources: everything Cloud Asset Inventory reports for the project, with type, location and labels
- Findings: Security Command Center findings with severity, category and the affected resource