Integrating GCP with Escape's ASM enhances visibility and management of deployments across GCP services. ## Discovered Resources The GCP integration automatically discovers and inventories the following resources from your GCP project: - **API Gateway Schemas**: OpenAPI specifications and API schemas registered in GCP API Gateway - **API Gateway Services**: API services and their configurations exposed through GCP API Gateway - **Cloud Run Services**: HTTP endpoints exposed by Cloud Run services - **Cloud Functions**: HTTP-triggered Cloud Functions endpoints - **App Engine Applications**: App Engine application endpoints - **Cloud Load Balancing**: Public frontend IPs of global and regional forwarding rules (external HTTP(S), TCP/SSL proxy, and network load balancers) - **GCP Hosts**: Cloud DNS managed zones and records exposing public endpoints These discovered resources are automatically classified as Assets (APIs, DNS records, WebApps) in Escape's ASM, enabling continuous security monitoring and testing. ### Supported GCP Services **GCP API Gateway**: Managed API gateway for creating, securing, and monitoring APIs. **Cloud Run**: Fully managed serverless platform for containerized applications. **Cloud Functions**: Event-driven serverless compute platform. **App Engine**: Fully managed platform for building web applications. **Compute Engine**: Virtual machines and load balancers exposing services. ### Create a Service Account JSON Key (for a Project) Create a service account and key in GCP for a project: 1. Navigate to your [API Credentials page]() 2. Click **Create Service Account** and follow the setup instructions 3. Assign the **Viewer** role from **Basic** roles 4. Click **Done** to create the account 5. Open the newly created service account 6. Go to the **Keys** tab and click **Add Key** 7. Select **Create new key**, choose **JSON** format, and click **Create** 8. Save the downloaded JSON file and copy its contents 9. Paste the JSON contents into the designated text area in Escape **Important**: Enable the following APIs in the GCP console: - [API Gateway API]() - [Cloud Resource Manager API]() - [DNS API]() - [Cloud Run Admin API]() - [Cloud Functions API]() - [App Engine Admin API]() - [Compute Engine API]() ### Create a Service Account JSON Key (for an Organization) Create a service account and key in GCP for an organization: 1. Navigate to the [GCP IAM Admin Console]() at the organization level (requires organization owner access) 2. Ensure you have the following roles: - `Organization Administrator` - `Organization Role Administrator` (Add roles using the edit button next to your user) 3. Go to [organization-level roles]() and click **Create Role** 4. Configure the role: - **Title**: Escape Integration Role - **ID**: escape\_integration\_role - **Role Launch Stage**: General availability 5. Add the following permissions: ```text # API Gateway Permissions apigateway.apiconfigs.get apigateway.apiconfigs.list apigateway.apis.get apigateway.apis.list apigateway.gateways.get apigateway.gateways.list apigateway.locations.get apigateway.locations.list apigateway.operations.get apigateway.operations.list # Compute Engine (load balancer frontends and HTTP(S) URL maps) compute.addresses.get compute.addresses.list compute.backendServices.get compute.backendServices.list compute.firewallPolicies.get compute.firewallPolicies.list compute.forwardingRules.get compute.forwardingRules.list compute.globalForwardingRules.get compute.globalForwardingRules.list compute.instances.get compute.instances.list compute.networks.get compute.networks.list compute.targetHttpProxies.get compute.targetHttpsProxies.get compute.regionTargetHttpProxies.get compute.regionTargetHttpsProxies.get compute.urlMaps.get compute.regionUrlMaps.get # Cloud Run Permissions run.services.list run.services.get # Cloud Functions Permissions cloudfunctions.functions.list cloudfunctions.functions.get # App Engine Permissions appengine.applications.get appengine.services.list appengine.versions.list # DNS & Resource Manager Permissions dns.managedZones.get dns.managedZones.list dns.policies.get dns.policies.list resourcemanager.folders.get resourcemanager.folders.list resourcemanager.organizations.get resourcemanager.projects.get resourcemanager.projects.list ``` ### Creating and Configuring the Service Account 1. Create a new GCP Project or use an existing one for the Escape service account 2. Visit the [Service Accounts page]() and configure: - **Name**: Escape Integration Service Account - **ID**: escape-integration-service-acc (or your preferred naming convention) 3. Create a service account key: - Navigate to the service account details - Go to **Keys** tab and click **Add Key** - Create a new key in JSON format - Save the downloaded JSON file 4. Grant organization-level access: - Copy the service account email: `escape-integration-service-acc@.iam.gserviceaccount.com` - Go to [Organization IAM]() - Click **Grant Access** - Paste the service account email and select the custom role created earlier 5. Complete the integration by pasting the JSON key into [Escape's GCP integration page]() 6. Turn on **Discover every project in the organization** Organization-wide discovery uses both the organization-level role and the **Discover every project in the organization** toggle. - **GCP project ID** stays the project that hosts the service account. Escape validates the credentials against it, so it must be a real project: don't put the numeric organization ID here. - Toggle **Discover every project in the organization** on, and Escape polls every project the service account can see. - Leave it off to discover only the project above. To cover a fixed set instead, leave it off and add the project IDs under **Additional projects to discover**. > [!NOTE] > > **Info** > > You can alternatively use predefined roles like `roles/compute.networkViewer` and `roles/iam.securityReviewer` for a simplified setup. Use the discovered Assets to select GCP-hosted APIs and web applications for security testing.