Onboard a Google Cloud Project to Dome9

In this topic:

    This topic describes how to onboard a Google Cloud project to your Dome9 account.

    Onboard a Google cloud project

    1. In the Dome9 console,navigate to Cloud Inventory and select Add GCP Cloud Account.

      Cloud-Inventory-Add-GCP-Account.png

      The Add Google Cloud Account Wizard will appear, directing you through the steps required to define Dome9 as an application.

    2. Login to the Google Cloud management portal.

    3. Navigate to APIs & Services, in the left navigation menu.

      GCP-Onboard-GCP-APIsandServices.png
    4. Enable APIs and Services.

      GCP-Onboard-GCP-Enable-APIsandServices.png
    5. Enable the Compute Engine API (if it is not already enabled).
      GCP-Onboard-GCP-Enable-Compute-Engine-API.png
    6. In APIs & Services, click Credentials in the left menu.

      GCP-Onboard-GCP-APIsandServices-Credentials.png
    7. Select the Credentials tab.

    8. Click Create Credentials.

    9. Select Service account key.

    10. In Service account drop down menu select New service account.

      GCP-Onboard-GCP-APIsandServices-Create-service-account-key.png

    11. Enter Dome9-Connect in the Service account name field.

      GCP-Onboard-GCP-APIsandServices-Create-service-account-key2.png
    12. In the Role field, select Viewer (from the Project list) and Security Reviewer (from the IAM list).

      GCP-Onboard-GCP-APIsandServices-Create-service-account-role.png
    13. Select JSON as the Key type.

      GCP-Onboard-GCP-APIsandServices-Create-service-account-role2.png
    14. Click Create.

    15. Download and save JSON file with the key.

    16. In the Dome9 console, add a name for the cloud account, then click UPLOAD PRIVATE KEY and upload the file you saved.
      GCP-Onboard-GCP-APIsandServices-Create-upload-private-key.png

    17. Click FINISH.  Dome9 will access your GCP account, using the Key you provided, and onboard details from the account to Dome9. This could take a few minutes, depending on the number of entities in your account.

    Onboard a number of Google projects and folders to Dome9

    You can onboard a number of projects in an account, in a bulk operation, using the GCP console and the Dome9 console.

    1. Log in to the Google Cloud management portal.
    2. Click APIs & Services of one specific project under the organization.
    3. Click Enable APIs & Services.
    4. Search for Compute Engine API and verify it is enabled.

    Repeat steps 3 and 4 for all projects to be onboarded. The remaining steps, below, can be done for any one of the projects in the account.

    1. Search for Cloud Resource Manager API and enable it. 
    2. Click APIs & Services under the navigation menu, then click on Credentials.
    3. Click the Credentials tab.
    4. Click 'Create Credentials'.
    5. Select 'Service account key'.
    6. Under 'Service account' drop down menu choose New service account.
    7. Under 'Service account name', name the service Dome9-Connect.
    8. Under Role, Select Project -> Viewer and IAM -> Security Reviewer.
    9. Make sure that key type is set to JSON.
    10. Click Create.
    11. Download and save the JSON file with the key.
    12. In the GCP console, navigate to IAM & admin, and then select Manage resources (at the bottom of the navigation pane, on the left).
       
    13. Select the projects and folders that you would like to add to Dome9.
    14. On the right, in the Add members field on the PERMISSIONS tab, enter the email address that was used to create the Dome9-Connect service account in steps 10-14 (available in Service accounts).
    15. In the Select a role dropdown, select Project -> Viewer and IAM -> Security Reviewer.
    16. Click Add.
    17. Download and unpack the Dome9 V2_API repository.
    18. Install latest version of NPM (8.x) in your environment.
    19. In the tools folder run the following commands:
    npm install
    node gcpOrgAdder.js -p ./<Json file> -i <Dome9 API ID> -s <Dome9 API  secret>