> ## Documentation Index
> Fetch the complete documentation index at: https://docs.draftt.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Cloud Platform

Connect your GCP projects or organization to Draftt to govern your cloud infrastructure. Draftt uses Workload Identity Federation (WIF) to securely access your GCP resources with read-only permissions.

## Prerequisites

* GCP project or organization with permissions to create service accounts, IAM roles, and Workload Identity pools
* Google Cloud CLI (`gcloud`) installed and authenticated
* Access to the Draftt dashboard (**Integrations > GCP**)

## Setup Methods

Draftt supports three installation methods. Workload Identity Federation via CLI is recommended.

<AccordionGroup>
  <Accordion title="Workload Identity Federation - CLI (Recommended)">
    <Note>
      You can select any project under the organization. However the project must have the relevant admin APIs enabled.
    </Note>

    <Steps>
      <Step title="Enter GCP project details">
        In Draftt, enter your **Project ID**, **Project Number**, and **Organization ID**.
      </Step>

      <Step title="Enable necessary APIs">
        Make sure that both the IAM Service Account Credentials API and Cloud Resource Manager API are enabled:

        ```bash theme={null}
        gcloud services enable \
            cloudresourcemanager.googleapis.com \
            --project="$PROJECT_ID"
        ```

        ```bash theme={null}
        gcloud services enable \
            iamcredentials.googleapis.com \
            --project="$PROJECT_ID"
        ```
      </Step>

      <Step title="Create a Workload Identity Pool">
        Create the identity pool that accepts identities from AWS:

        ```bash theme={null}
        gcloud iam workload-identity-pools create \
            "draftt-wif-integration" \
            --project="$PROJECT_ID" \
            --location "global" \
            --display-name "Draftt WIF integration"
        ```
      </Step>

      <Step title="Add the Draftt AWS Provider to the Pool">
        Define AWS as a trusted identity provider. The AWS account ID (`339712924365`) is Draftt's production account, which hosts the `draftt-fetcher` service used to fetch data from your GCP project.

        ```bash theme={null}
        gcloud iam workload-identity-pools providers create-aws \
            "draftt-wif-aws-integration" \
            --workload-identity-pool="draftt-wif-integration" \
            --account-id="339712924365" \
            --attribute-mapping="attribute.aws_role=assertion.arn.contains('assumed-role') ? assertion.arn.extract('{account_arn}assumed-role/') + 'assumed-role/' + assertion.arn.extract('assumed-role/{role_name}/') : assertion.arn, google.subject=assertion.arn" \
            --project="$PROJECT_ID" \
            --location="global"
        ```
      </Step>

      <Step title="Create a GCP Service Account">
        Create the service account that AWS roles will impersonate:

        ```bash theme={null}
        gcloud iam service-accounts create \
            "draftt-wif-int-readonly" \
            --project="$PROJECT_ID" \
            --display-name="Draftt WIF ReadOnly Integration"
        ```
      </Step>

      <Step title="Grant permissions to the Service Account">
        Assign read-only permissions to the service account at the organization level:

        ```bash theme={null}
        gcloud organizations add-iam-policy-binding $ORGANIZATION_ID \
            --member="serviceAccount:draftt-wif-int-readonly@$PROJECT_ID.iam.gserviceaccount.com" \
            --role="roles/viewer"
        ```

        ```bash theme={null}
        gcloud organizations add-iam-policy-binding $ORGANIZATION_ID \
            --member="serviceAccount:draftt-wif-int-readonly@$PROJECT_ID.iam.gserviceaccount.com" \
            --role="roles/browser"
        ```

        ```bash theme={null}
        gcloud organizations add-iam-policy-binding $ORGANIZATION_ID \
            --member="serviceAccount:draftt-wif-int-readonly@$PROJECT_ID.iam.gserviceaccount.com" \
            --role="roles/iam.securityReviewer"
        ```
      </Step>

      <Step title="Allow AWS Role to act as the GCP Service Account">
        Authorize Draftt's AWS role (`arn:aws:sts::339712924365:assumed-role/draftt-fetcher`) to impersonate the GCP service account:

        ```bash theme={null}
        gcloud iam service-accounts add-iam-policy-binding \
            "draftt-wif-int-readonly@$PROJECT_ID.iam.gserviceaccount.com" \
            --role="roles/iam.workloadIdentityUser" \
            --member="principalSet://iam.googleapis.com/projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/draftt-wif-integration/attribute.aws_role/arn:aws:sts::339712924365:assumed-role/draftt-fetcher" \
            --project="$PROJECT_ID"
        ```
      </Step>

      <Step title="Generate Credentials JSON">
        Create a non-sensitive JSON credentials configuration file that links the workload identity pool, provider, and service account together:

        ```bash theme={null}
        gcloud iam workload-identity-pools create-cred-config \
            --aws "projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/draftt-wif-integration/providers/draftt-wif-aws-integration" \
            --service-account="draftt-wif-int-readonly@$PROJECT_ID.iam.gserviceaccount.com" \
            --output-file="draftt_gcp_wiff_integration_credentials.json" \
            --project="$PROJECT_ID"
        ```

        <Note>
          Unlike a service account key, a credential configuration file does not contain a private key and does not need to be kept confidential.
        </Note>
      </Step>

      <Step title="Upload the JSON file to Draftt">
        Upload the downloaded JSON file in the Draftt setup dialog to complete the integration.
      </Step>
    </Steps>
  </Accordion>

  <Accordion title="Workload Identity Federation - UI">
    Select either **Organization Level** or **Project Level** scope.

    <Note>
      You can select any project under the organization. However the project must have the relevant admin APIs enabled.
    </Note>

    <Steps>
      <Step title="Create a GCP Service Account">
        Go to [Service Accounts](https://console.cloud.google.com/iam-admin/serviceaccounts) and click **Create service account**.

        Use the following values:

        * **Service account name:** `draftt-wif-int-readonly`
        * **Service account ID:** `draftt-wif-int-readonly`
        * **Description:** `A read only service account for Draftt integration`

        Grant this service account the following roles at the organization level in the IAM console:

        * `Viewer`
        * `Browser`
        * `iam.securityReviewer`
      </Step>

      <Step title="Create a Workload Identity Pool">
        Go to [Workload Identity Pool](https://console.cloud.google.com/iam-admin/workload-identity-pools) and click **Create pool**.

        Use the following values:

        * **Pool name:** `draftt-wif-integration`
        * **Pool ID:** `draftt-wif-integration`
        * **Description:** `Workload Identity Pool for Draftt.io integration`

        Click **Continue** and select **AWS** in the Provider section. Use the following values:

        * **Provider name:** `draftt-wif-aws-integration`
        * **Provider ID:** `draftt-wif-aws-integration`
        * **AWS Account ID:** `339712924365`

        GCP will automatically create provider attributes that enable configuring the AWS ARN as a GCP identity. Click **Save** and wait for GCP to create the pool.
      </Step>

      <Step title="Grant Draftt permissions to impersonate the service account">
        Click **Grant access**. In the left panel, choose **Grant access using service account impersonation**.

        Choose the service account created in Step 1.

        Under **Select principals**, choose the `aws_role` attribute name and enter Draftt's fetcher role:

        ```
        arn:aws:sts::339712924365:assumed-role/draftt-fetcher
        ```

        Click **Save**.

        In the **Configure your application** window, choose `draftt-wif-aws-integration` as the provider and download the JSON config file. This file does not include any secrets.
      </Step>

      <Step title="Upload the JSON file to Draftt">
        Upload the downloaded JSON file in the Draftt setup dialog to complete the integration.
      </Step>
    </Steps>
  </Accordion>

  <Accordion title="Service Account Keys">
    <Steps>
      <Step title="Name your integration">
        In Draftt, fill in the **Integration Name** field. Select either **Organization Level** or **Project Level** scope.
      </Step>

      <Step title="Create a GCP Service Account">
        Go to your Google [Cloud service account](https://console.cloud.google.com/iam-admin/serviceaccounts) and at the project level select **Create Service Account**.

        Enter the **Service account** details and select **Create and Continue**.

        Attach the following roles at the organization level:

        * `Viewer`
        * `Browser`
        * `iam.securityReviewer`
      </Step>

      <Step title="Generate a JSON key">
        At the project level, select **Service Accounts** and select the Draftt service account.

        Select **Keys > Manage Keys > Add Key > Create new key**.

        Select **JSON > Create**. A JSON file will be downloaded to your machine.
      </Step>

      <Step title="Upload the JSON file to Draftt">
        Upload the downloaded JSON file in the Draftt setup dialog to complete the integration.
      </Step>
    </Steps>
  </Accordion>
</AccordionGroup>

## What Draftt Reads

Draftt's service account is **read-only**. It cannot create, modify, or delete any resources in your GCP environment.

The required roles provide access to resource metadata across compute (Compute Engine, GKE, Cloud Run, Cloud Functions), storage (Cloud Storage, Filestore), databases (Cloud SQL, Spanner, Memorystore), networking (VPC, Load Balancing, Cloud CDN), and security (IAM, Secret Manager, KMS).

## Verifying Your Connection

After setup, return to **Integrations > GCP** in Draftt. Each connected project or organization shows a status:

* **Healthy** - All required access is in place. Draftt is collecting data as expected.
* **Unhealthy** - Something is wrong with the service account or permissions. Verify the WIF configuration and IAM role bindings.

## Troubleshooting

**WIF authentication fails:** Confirm the AWS account ID (`339712924365`) matches in the provider configuration. Verify the service account email and project number are correct in the credential config.

**Missing resources in inventory:** Check that the service account has `roles/viewer` and `roles/browser` at the correct scope (organization vs. project). New connections may take one scan cycle to fully populate.

**API not enabled errors:** Ensure both `cloudresourcemanager.googleapis.com` and `iamcredentials.googleapis.com` are enabled in your project.