Skip to main content
Connect a Google Cloud project so Enclave can map its resources and identities and link them to your code. Access is read-only, and no service account key is created or stored.

​
What Enclave needs

The setup command creates these resources in your project:
  • A Workload Identity pool with a provider that trusts only Enclave’s scanner identity.
  • A scanner service account that Enclave impersonates.
  • Read-only role bindings for that service account.
It also enables the IAM, IAM Credentials, Cloud Resource Manager, Security Token Service, and Cloud Asset APIs in the project. The service account gets these roles:

​
Who can run the setup

Whoever runs the command in Cloud Shell needs Owner on the project. Or they need all of these:
  • roles/iam.workloadIdentityPoolAdmin
  • roles/iam.serviceAccountAdmin
  • roles/serviceusage.serviceUsageAdmin
  • roles/resourcemanager.projectIamAdmin
In Enclave, you need the Owner or Admin role.

​
Connect a project

1

Open the setup page

Open Settings → Integrations and click Connect next to Google Cloud.
2

Enter your project ID

Enter the GCP project ID to connect. To find it, run gcloud projects list. Enclave generates a one-line setup command for that project.
3

Run the command in Cloud Shell

Copy the command and run it in Google Cloud Shell, or in a terminal where gcloud is signed in.
The command contains a one-time setup token. Don’t save it in a tracked file or paste it into a shared log.
4

Wait for Enclave to detect it

Enclave watches for the setup to finish and advances on its own. When you see Connection complete!, the project is connected and Enclave starts scanning it.
5

Add more projects

Click Add another project to connect another project, or Done to finish.
Click I’ll finish later to save the connection and come back. Reopen it from Settings → Integrations → Google Cloud.

​
Manage a connection

Open Settings → Integrations → Google Cloud to see your connected projects.
  • Re-validate checks that Enclave can still read a project.
  • Remove stops scanning one project.
  • Add project connects another project.
  • Disconnect GCP removes the whole connection and stops scanning.
To revoke access from Google Cloud, delete the scanner service account or the Workload Identity pool the setup created.

​
What Enclave will and won’t do

  • Will: read the configuration and metadata the roles above allow.
  • Won’t: create, change, or delete resources, read objects in your buckets, or store a long-lived credential. Each scan uses a short-lived access token that lasts about an hour.

​
Troubleshooting

Check the command’s output in Cloud Shell. If it failed, fix the error, then reopen the connection to get a new command. The setup token works only once, so don’t rerun an old command after it was used.
The account that ran it is missing a role. Grant Owner or the four admin roles listed in Who can run the setup, then run a fresh command.
Project IDs are 6 to 30 characters: lowercase letters, digits, and hyphens. They start with a letter and end with a letter or digit. Use the project ID, not the project name or number.
Scans run when a project connects and once a day after that. To scan now, click Analyze Environment in Coverage.