Docs » Connect to your cloud service provider » Connect to Google Cloud Platform » GCP authentication, permissions and supported regions

GCP authentication, permissions and supported regions 🔗

Prerequisites 🔗

You must be an administrator of your Splunk Observability Cloud organization to create a GCP connection.

Authenticate your Google account 🔗

Authenticate using Service Account Keys 🔗

Alternatively you can use your service account keys to integrate your GCP services with Splunk Observability Cloud. Before you proceed read Google’s official announcement on GCP permission policies at Introducing stronger default Org Policies for our customers .

To authenticate using your service account keys go to the GCP console and follow these steps:

  1. From the sidebar, select IAM & admin, then Service Accounts.

  2. Go to Create Service Account at the top of the screen, complete the following fields, and select CREATE.

    • Service account name. Enter Splunk.

    • Service account ID. This field autofills after you enter Splunk for Service account name.

    • Service account description. Enter the description for your service account.

  3. Select a role to grant this Service account access to the selected project, then select CONTINUE.

  4. Activate Key type JSON, and select CREATE. A new service account key JSON file is then downloaded to your computer. You will need this key to authenticate in the Import Service Account Key step in Splunk Observability Cloud.

  5. In a new window or tab, go to Cloud Resource Manager API , and activate the Cloud Resource Manager API. You need to activate this API so Splunk Observability Cloud can use it to validate permissions on the service account keys.

For more information, refer to GCP’s docs on Service account keys .

GCP role permissions 🔗

You can use GCP’s Viewer role as it comes with the permissions you need for most scenarios.

Alternatively you can create a more restrictive role using the permissions in the table:

Permission

Required?

Included in GCP’s Viewer role?

compute.instances.list

Yes, if the Compute Engine service is activated

Yes

compute.machineTypes.list

Yes, if the Compute Engine service is activated

Yes

container.clusters.list

Yes, if the Kubernetes (GKE) service is activated

Yes

container.nodes.list

Yes, if the Kubernetes (GKE) service is activated

Yes

container.pods.list

Yes, if the Kubernetes (GKE) service is activated

Yes

monitoring.metricDescriptors.get

Yes

Yes

monitoring.metricDescriptors.list

Yes

Yes

monitoring.timeSeries.list

Yes

Yes

resourcemanager.projects.get

Yes, if you want to sync project metadata (such as labels)

Yes

serviceusage.services.use

Yes, if you either want to activate the use of a quota from the project where metrics are stored or sync cloud sql metadata

No, but included in roles/serviceusage.serviceUsageConsumer

spanner.instances.list

Yes, if the Spanner service is activated

Yes

storage.buckets.list

Yes, if the Spanner service is activated

Yes

cloudsql.databases.list

Yes, if the cloud sql service is activated

Yes

cloudsql.instances.list

Yes, if the cloud sql service is activated

Yes

pubsub.topics.list

Yes, if the pub/sub service is activated

Yes

pubsub.subscriptions.list

Yes, if the pub/sub service is activated

Yes

run.jobs.list

Yes, if the cloud run service is activated

Yes

run.revisions.list

Yes, if the cloud run service is activated

Yes

cloudasset.assets.searchAllResources

Yes, if the cloud run service is activated

Yes

cloudfunctions.functions.list

Yes, if the cloud functions service is activated

Yes

Supported regions 🔗

Splunk Observability Cloud supports all GCP regions.

This page was last updated on Feb 03, 2025.