Google Cloud

#What Antimetal does with Google Cloud

• Query Cloud Monitoring metrics to find when and where behavior changed
• Search Cloud Logging for the error behind an alert
• Follow Cloud Trace spans across services
• Read Error Reporting groups to see which failures are new and which are recurring
• Inspect resource metadata and configuration through Cloud Asset Inventory

#Connecting Google Cloud

There are 2 ways to connect Google Cloud. Follow whichever path matches your deployment; you only need one.

GCP Console

Prerequisites

• A GCP account with permissions to create service accounts
• Access to IAM & Admin settings
• Admin access to the projects you want to monitor

1. Create the service account

   In the Google Cloud Console, open the project where you do your monitoring work and go to IAM & Admin > Service Accounts. Click + CREATE SERVICE ACCOUNT and name it antimetal-monitoring. Click CREATE AND CONTINUE, then copy the service account email.

2. Grant permissions to each project

   For every project you want monitored, go to IAM & Admin > IAM > + GRANT ACCESS, enter the service account email as the principal, and assign Monitoring Viewer, Logs Viewer, Cloud Trace User, Error Reporting Viewer, and Cloud Asset Viewer.

3. Generate the JSON key

   Open the antimetal-monitoring service account, go to the Keys tab, and click ADD KEY > Create new key with JSON format.

4. Configure the Antimetal integration

   Upload or paste the contents of the JSON key file, then specify the project IDs you granted permissions to.

Terraform / IaC

Prerequisites

• Permission to manage IAM bindings in the projects you want to monitor

1. Create the service account and permissions

   Create the service account in your monitoring project and add IAM bindings for each monitored project granting roles/cloudasset.viewer, roles/errorreporting.viewer, roles/monitoring.viewer, roles/logging.viewer, and roles/cloudtrace.user.

2. Generate a JSON key

   Create a JSON key for the service account, through IaC output or manually in the console.

3. Configure the Antimetal integration

   Upload or paste the JSON key in the Antimetal UI and specify the project IDs you granted permissions to.

#Permissions and access

Antimetal uses a read-only service account across the projects you specify. No write operations are performed.

All tenant data is processed in isolated environments. See security and compliance for details.