Google Cloud
Antimetal connects to Google Cloud with a read-only service account so it can investigate across your GCP projects. Once connected it queries traces, logs, metrics, error groups, and resource configuration for every project you grant it.
What Antimetal does with Google Cloud
- Query Cloud Monitoring metrics to find when and where behavior changed
- Search Cloud Logging for the error behind an alert
- Follow Cloud Trace spans across services
- Read Error Reporting groups to see which failures are new and which are recurring
- Inspect resource metadata and configuration through Cloud Asset Inventory
Connecting Google Cloud
GCP Console
Prerequisites
- A GCP account with permissions to create service accounts
- Access to IAM & Admin settings
- Admin access to the projects you want to monitor
In the Google Cloud Console, open the project where you do your monitoring work and go to IAM & Admin > Service Accounts. Click + CREATE SERVICE ACCOUNT and name it
antimetal-monitoring. Click CREATE AND CONTINUE, then copy the service account email.For every project you want monitored, go to IAM & Admin > IAM > + GRANT ACCESS, enter the service account email as the principal, and assign
Monitoring Viewer,Logs Viewer,Cloud Trace User,Error Reporting Viewer, andCloud Asset Viewer.Open the
antimetal-monitoringservice account, go to the Keys tab, and click ADD KEY > Create new key with JSON format.Upload or paste the contents of the JSON key file, then specify the project IDs you granted permissions to.
Terraform / IaC
Prerequisites
- Permission to manage IAM bindings in the projects you want to monitor
Create the service account in your monitoring project and add IAM bindings for each monitored project granting
roles/cloudasset.viewer,roles/errorreporting.viewer,roles/monitoring.viewer,roles/logging.viewer, androles/cloudtrace.user.Create a JSON key for the service account, through IaC output or manually in the console.
Upload or paste the JSON key in the Antimetal UI and specify the project IDs you granted permissions to.
Follow whichever path matches your deployment — you only need one.
Permissions and access
Antimetal uses a read-only service account across the projects you specify. No write operations are performed.
| Role | Access |
|---|---|
| Monitoring Viewer | Read access to metrics and monitoring data |
| Logs Viewer | Read access to Cloud Logging data |
| Cloud Trace User | Read access to distributed tracing data |
| Error Reporting Viewer | Read access to error groups and events |
| Cloud Asset Viewer | Read access to cloud resource metadata and configurations |
All tenant data is processed in isolated environments. See security and compliance for details.
Related integrations
Need help?
Contact us via Slack or at support@antimetal.com.