Google Cloud Platform

Workload Identity Federation - CLI (Recommended)

You can select any project under the organization. However the project must have the relevant admin APIs enabled.

Enter GCP project details

In Draftt, enter your Project ID, Project Number, and Organization ID.

Enable necessary APIs

Make sure that both the IAM Service Account Credentials API and Cloud Resource Manager API are enabled:

gcloud services enable \
    cloudresourcemanager.googleapis.com \
    --project="$PROJECT_ID"

gcloud services enable \
    iamcredentials.googleapis.com \
    --project="$PROJECT_ID"

Create a Workload Identity Pool

Create the identity pool that accepts identities from AWS:

gcloud iam workload-identity-pools create \
    "draftt-wif-integration" \
    --project="$PROJECT_ID" \
    --location "global" \
    --display-name "Draftt WIF integration"

Add the Draftt AWS Provider to the Pool

Define AWS as a trusted identity provider. The AWS account ID (339712924365) is Draftt’s production account, which hosts the draftt-fetcher service used to fetch data from your GCP project.

gcloud iam workload-identity-pools providers create-aws \
    "draftt-wif-aws-integration" \
    --workload-identity-pool="draftt-wif-integration" \
    --account-id="339712924365" \
    --attribute-mapping="attribute.aws_role=assertion.arn.contains('assumed-role') ? assertion.arn.extract('{account_arn}assumed-role/') + 'assumed-role/' + assertion.arn.extract('assumed-role/{role_name}/') : assertion.arn, google.subject=assertion.arn" \
    --project="$PROJECT_ID" \
    --location="global"

Create a GCP Service Account

Create the service account that AWS roles will impersonate:

gcloud iam service-accounts create \
    "draftt-wif-int-readonly" \
    --project="$PROJECT_ID" \
    --display-name="Draftt WIF ReadOnly Integration"

Grant permissions to the Service Account

Assign read-only permissions to the service account at the organization level:

gcloud organizations add-iam-policy-binding $ORGANIZATION_ID \
    --member="serviceAccount:draftt-wif-int-readonly@$PROJECT_ID.iam.gserviceaccount.com" \
    --role="roles/viewer"

gcloud organizations add-iam-policy-binding $ORGANIZATION_ID \
    --member="serviceAccount:draftt-wif-int-readonly@$PROJECT_ID.iam.gserviceaccount.com" \
    --role="roles/browser"

gcloud organizations add-iam-policy-binding $ORGANIZATION_ID \
    --member="serviceAccount:draftt-wif-int-readonly@$PROJECT_ID.iam.gserviceaccount.com" \
    --role="roles/iam.securityReviewer"

Allow AWS Role to act as the GCP Service Account

Authorize Draftt’s AWS role (arn:aws:sts::339712924365:assumed-role/draftt-fetcher) to impersonate the GCP service account:

gcloud iam service-accounts add-iam-policy-binding \
    "draftt-wif-int-readonly@$PROJECT_ID.iam.gserviceaccount.com" \
    --role="roles/iam.workloadIdentityUser" \
    --member="principalSet://iam.googleapis.com/projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/draftt-wif-integration/attribute.aws_role/arn:aws:sts::339712924365:assumed-role/draftt-fetcher" \
    --project="$PROJECT_ID"

Generate Credentials JSON

Create a non-sensitive JSON credentials configuration file that links the workload identity pool, provider, and service account together:

gcloud iam workload-identity-pools create-cred-config \
    --aws "projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/draftt-wif-integration/providers/draftt-wif-aws-integration" \
    --service-account="draftt-wif-int-readonly@$PROJECT_ID.iam.gserviceaccount.com" \
    --output-file="draftt_gcp_wiff_integration_credentials.json" \
    --project="$PROJECT_ID"

Unlike a service account key, a credential configuration file does not contain a private key and does not need to be kept confidential.

Upload the JSON file to Draftt

Upload the downloaded JSON file in the Draftt setup dialog to complete the integration.

Workload Identity Federation - UI

Select either Organization Level or Project Level scope.

You can select any project under the organization. However the project must have the relevant admin APIs enabled.

Create a GCP Service Account

Go to Service Accounts and click Create service account.Use the following values:

Service account name: draftt-wif-int-readonly
Service account ID: draftt-wif-int-readonly
Description: A read only service account for Draftt integration

Grant this service account the following roles at the organization level in the IAM console:

Viewer
Browser
iam.securityReviewer

Create a Workload Identity Pool

Go to Workload Identity Pool and click Create pool.Use the following values:

Pool name: draftt-wif-integration
Pool ID: draftt-wif-integration
Description: Workload Identity Pool for Draftt.io integration

Click Continue and select AWS in the Provider section. Use the following values:

Provider name: draftt-wif-aws-integration
Provider ID: draftt-wif-aws-integration
AWS Account ID: 339712924365

GCP will automatically create provider attributes that enable configuring the AWS ARN as a GCP identity. Click Save and wait for GCP to create the pool.

Grant Draftt permissions to impersonate the service account

Click Grant access. In the left panel, choose Grant access using service account impersonation.Choose the service account created in Step 1.Under Select principals, choose the aws_role attribute name and enter Draftt’s fetcher role:

arn:aws:sts::339712924365:assumed-role/draftt-fetcher

Click Save.In the Configure your application window, choose draftt-wif-aws-integration as the provider and download the JSON config file. This file does not include any secrets.

Upload the JSON file to Draftt

Upload the downloaded JSON file in the Draftt setup dialog to complete the integration.

Service Account Keys

Name your integration

In Draftt, fill in the Integration Name field. Select either Organization Level or Project Level scope.

Create a GCP Service Account

Go to your Google Cloud service account and at the project level select Create Service Account.Enter the Service account details and select Create and Continue.Attach the following roles at the organization level:

Viewer
Browser
iam.securityReviewer

Generate a JSON key

At the project level, select Service Accounts and select the Draftt service account.Select Keys > Manage Keys > Add Key > Create new key.Select JSON > Create. A JSON file will be downloaded to your machine.

Upload the JSON file to Draftt

Upload the downloaded JSON file in the Draftt setup dialog to complete the integration.

OVERVIEW

CLOUD INFRASTRUCTURE

CLOUD RESOURCES

CMDB

TICKETING & COLLABORATION

Google Cloud Platform

Prerequisites

Setup Methods

What Draftt Reads

Verifying Your Connection

Troubleshooting

OVERVIEW

CLOUD INFRASTRUCTURE

CLOUD RESOURCES

CMDB

TICKETING & COLLABORATION

​Prerequisites

​Setup Methods

​What Draftt Reads

​Verifying Your Connection

​Troubleshooting

Prerequisites

Setup Methods

What Draftt Reads

Verifying Your Connection

Troubleshooting