> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enclave.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Enclave in these docs is the code and cloud security platform at enclave.ai. It is not Open Enclave, Intel SGX or other hardware enclaves, or enclave.gg.
> People use Enclave in the web app at https://app.enclave.ai or the desktop app. These docs describe no public Enclave API or CLI, so don't invent endpoints, commands, or config files.
> Connecting an integration needs a person to sign in and approve access in a browser. Tell the user the exact step to take instead of saying you completed it.

# GCP

> Connect Google Cloud projects with a read-only service account and no stored keys.

Connect a Google Cloud project so Enclave can map its resources and identities and link them to your code. Access is read-only, and no service account key is created or stored.

## What Enclave needs

The setup command creates these resources in your project:

* A **Workload Identity pool** with a provider that trusts only Enclave's scanner identity.
* A **scanner service account** that Enclave impersonates.
* **Read-only role bindings** for that service account.

It also enables the IAM, IAM Credentials, Cloud Resource Manager, Security Token Service, and Cloud Asset APIs in the project.

The service account gets these roles:

| Role | What it reads |
| - | - |
| `roles/compute.viewer` | Compute Engine instances, networks, subnets, firewalls, and load balancers |
| `roles/container.viewer` | GKE clusters |
| `roles/run.viewer` | Cloud Run services |
| `roles/cloudfunctions.viewer` | Cloud Functions |
| `roles/dns.reader` | Cloud DNS zones |
| `roles/artifactregistry.reader` | Artifact Registry repositories |
| `roles/storage.bucketViewer` | Cloud Storage bucket metadata only, not objects |
| `roles/iam.securityReviewer` | IAM policies and service accounts |
| `roles/cloudasset.viewer` | Cloud Asset Inventory |
| `roles/serviceusage.serviceUsageConsumer` | Calling the read APIs above |
| `roles/browser` | Project and hierarchy metadata |

### Who can run the setup

Whoever runs the command in Cloud Shell needs **Owner** on the project. Or they need all of these:

* `roles/iam.workloadIdentityPoolAdmin`
* `roles/iam.serviceAccountAdmin`
* `roles/serviceusage.serviceUsageAdmin`
* `roles/resourcemanager.projectIamAdmin`

In Enclave, you need the **Owner** or **Admin** role.

## Connect a project

**1. Open the setup page**

Open **Settings → Integrations** and click **Connect** next to **Google Cloud**.

**2. Enter your project ID**

Enter the **GCP project ID** to connect. To find it, run `gcloud projects list`. Enclave generates a one-line setup command for that project.

**3. Run the command in Cloud Shell**

Copy the command and run it in [Google Cloud Shell](https://shell.cloud.google.com), or in a terminal where `gcloud` is signed in.

> [!WARNING]
>
> The command contains a one-time setup token. Don't save it in a tracked file or paste it into a shared log.

**4. Wait for Enclave to detect it**

Enclave watches for the setup to finish and advances on its own. When you see **Connection complete!**, the project is connected and Enclave starts scanning it.

**5. Add more projects**

Click **Add another project** to connect another project, or **Done** to finish.

> [!TIP]
>
> Click **I'll finish later** to save the connection and come back. Reopen it from **Settings → Integrations → Google Cloud**.

## Manage a connection

Open **Settings → Integrations → Google Cloud** to see your connected projects.

* **Re-validate** checks that Enclave can still read a project.
* **Remove** stops scanning one project.
* **Add project** connects another project.
* **Disconnect GCP** removes the whole connection and stops scanning.

To revoke access from Google Cloud, delete the scanner service account or the Workload Identity pool the setup created.

## What Enclave will and won't do

* **Will**: read the configuration and metadata the roles above allow.
* **Won't**: create, change, or delete resources, read objects in your buckets, or store a long-lived credential. Each scan uses a short-lived access token that lasts about an hour.

## Troubleshooting

> [accordion] The page keeps waiting after I ran the command
>
> Check the command's output in Cloud Shell. If it failed, fix the error, then reopen the connection to get a new command. The setup token works only once, so don't rerun an old command after it was used.

> [accordion] The command fails with a permission error
>
> The account that ran it is missing a role. Grant **Owner** or the four admin roles listed in [Who can run the setup](#who-can-run-the-setup), then run a fresh command.

> [accordion] Enclave won't accept the project ID
>
> Project IDs are 6 to 30 characters: lowercase letters, digits, and hyphens. They start with a letter and end with a letter or digit. Use the project ID, not the project name or number.

> [accordion] Assets don't appear in Coverage
>
> Scans run when a project connects and once a day after that. To scan now, click **Analyze Environment** in [Coverage](https://docs.enclave.ai/onboarding/coverage.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.