Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

Version 1 Next »


1. In the Google console go to IAM & admin.


2. Go to Service accounts. Click Create Service Account.


3. Enter the name for the service account, e.g. "cloudaware-service-account". Click Create.


4. Specify the Project role as 'Viewer'. Click Continue.


5. Click +Create key. Select 'JSON' → Create.


6. A .json file will be automatically downloaded by the browser.

Create a custom role (optional)

A custom role is necessary if you are going to use backups and labels.

1. Go to IAM & admin, select "Roles" and click +Create Role.

Add the name and the description of the custom role. Set 'Role launch stage' as General Availability and click + Add Permissions.


2. Select the following permissions:

For backups

For labels

  • compute.disks.get

  • compute.disks.createSnapshot

  • compute.disks.list

  • compute.disks.setLabels

  • compute.snapshots.create

  • compute.snapshots.delete

  • compute.snapshots.get

  • compute.snapshots.list

  • compute.snapshots.setLabels

  • compute.zones.get

  • compute.zones.list

  • bigquery.datasets.update

  • bigquery.tables.update

  • cloudsql.instances.update

  • compute.addresses.setLabels

  • compute.disks.setLabels

  • compute.forwardingRules.setLabels

  • compute.globalAddresses.setLabels

  • compute.globalForwardingRules.setLabels

  • compute.images.setLabels

  • compute.instances.setLabels

  • compute.snapshots.setLabels

  • compute.targetVpnGateways.setLabels

  • compute.vpnTunnels.setLabels

  • dataproc.clusters.update

  • dataproc.jobs.update

  • cloudkms.cryptoKeys.update

  • storage.buckets.update

3. Assign the custom role to the service account you have just created (IAM & admin → IAM → select the service account).

Enable Google APIs on Google Project

1. Go to APIs & Services.

2. Click +ENABLE APIS AND SERVICES.

3. Using the search bar, locate and enable:

  • Compute Engine API

  • Identity and Access Management (IAM) API

  • Cloud Resource Manager API

  • Kubernetes Engine API (learn more)

  • Cloud Billing API (learn more)

Google Organizations (optional)

If you use Google Organizations, assign the role 'Viewer' to the service account for Cloudaware to consume your Organization data. Assign the following roles to the service account created earlier:

  • Organization Role Viewer

  • Folder Viewer

  • Organization Viewer

  • Organization Policy Viewer

  • Project Viewer

Click Save.

Assign the 'Project Viewer' role on the organization level for Cloudaware to automatically add and collect Google Projects within a Google Organization:


Google Billing Accounts (optional)

For Cloudaware to be able to collect the list of Google Billing Accounts, assign the role 'Billing Account Viewer' to the service account* that has access to billing accounts in question.

1. Go to Billing.

2. Go to the tab 'My Billing Accounts'. Check the box near the billing account. Click Add Principal on the right to manage permissions.

3. Select the service account* and assign the role Billing Account Viewer → Save.

*Note that the service account should be added to Cloudaware.

  • No labels