Google Cloud Platform

Workload Identity Federation - CLI (Recommended)

The most secure method. Uses WIF to allow Draftt’s AWS-based infrastructure to authenticate to your GCP environment without long-lived credentials.

Enter project details

In Draftt, go to Integrations > GCP > Add. Select either Organization or Project scope. Enter your GCP Project ID and (if organization scope) your Organization ID.

Enable required APIs

Enable the Cloud Resource Manager and IAM Credentials APIs in your project:

gcloud services enable cloudresourcemanager.googleapis.com --project=YOUR_PROJECT_ID
gcloud services enable iamcredentials.googleapis.com --project=YOUR_PROJECT_ID

Create a Workload Identity Pool

Create a WIF pool for Draftt:

gcloud iam workload-identity-pools create draftt-pool \
  --project=YOUR_PROJECT_ID \
  --location=global \
  --display-name="Draftt Pool"

Add an AWS provider to the pool

Configure the pool to trust Draftt’s AWS account (339712924365):

gcloud iam workload-identity-pools providers create-aws draftt-aws-provider \
  --project=YOUR_PROJECT_ID \
  --location=global \
  --workload-identity-pool=draftt-pool \
  --account-id=339712924365

Create a service account

Create a service account that Draftt will impersonate:

gcloud iam service-accounts create draftt-sa \
  --project=YOUR_PROJECT_ID \
  --display-name="Draftt Service Account"

Grant read-only roles

Assign the required read-only roles at the organization or project level:

# For organization scope:
gcloud organizations add-iam-policy-binding YOUR_ORG_ID \
  --member="serviceAccount:draftt-sa@YOUR_PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/viewer"

gcloud organizations add-iam-policy-binding YOUR_ORG_ID \
  --member="serviceAccount:draftt-sa@YOUR_PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/browser"

gcloud organizations add-iam-policy-binding YOUR_ORG_ID \
  --member="serviceAccount:draftt-sa@YOUR_PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

For project scope, replace gcloud organizations add-iam-policy-binding YOUR_ORG_ID with gcloud projects add-iam-policy-binding YOUR_PROJECT_ID.

Allow AWS role to impersonate the service account

Bind the WIF provider to the service account:

gcloud iam service-accounts add-iam-policy-binding \
  draftt-sa@YOUR_PROJECT_ID.iam.gserviceaccount.com \
  --project=YOUR_PROJECT_ID \
  --role="roles/iam.workloadIdentityUser" \
  --member="principalSet://iam.googleapis.com/projects/YOUR_PROJECT_NUMBER/locations/global/workloadIdentityPools/draftt-pool/attribute.aws_role/arn:aws:sts::339712924365:assumed-role/DrafttGCPRole"

Generate credentials configuration

Generate the credentials JSON file that Draftt needs:

gcloud iam workload-identity-pools create-cred-config \
  projects/YOUR_PROJECT_NUMBER/locations/global/workloadIdentityPools/draftt-pool/providers/draftt-aws-provider \
  --service-account=draftt-sa@YOUR_PROJECT_ID.iam.gserviceaccount.com \
  --aws \
  --output-file=draftt-credentials.json

Upload credentials to Draftt

Back in the Draftt setup dialog, upload the generated draftt-credentials.json file and click Create.

Workload Identity Federation - UI

Same WIF approach as the CLI method, but configured through the GCP Console UI instead of the command line. Follow the guided steps in the Draftt setup dialog, which walks you through creating the pool, provider, and service account in the GCP Console.

Service Account Keys

For environments where WIF is not available. Creates a traditional service account key pair.

In Draftt, go to Integrations > GCP > Add and select the Service Account Keys tab
Create a service account in your GCP project with the required read-only roles (roles/viewer, roles/browser, roles/iam.securityReviewer)
Generate a JSON key for the service account
Upload the JSON key file in the Draftt setup dialog and click Create

Service account keys are long-lived credentials. Workload Identity Federation is the recommended approach as it avoids storing secrets.

OVERVIEW

CLOUD INFRASTRUCTURE

CLOUD RESOURCES

CMDB

TICKETING & COLLABORATION

Google Cloud Platform

Prerequisites

Setup Methods

What Draftt Reads

Verifying Your Connection

Troubleshooting

OVERVIEW

CLOUD INFRASTRUCTURE

CLOUD RESOURCES

CMDB

TICKETING & COLLABORATION

​Prerequisites

​Setup Methods

​What Draftt Reads

​Verifying Your Connection

​Troubleshooting

Prerequisites

Setup Methods

What Draftt Reads

Verifying Your Connection

Troubleshooting