GCP Project Setup

GCP Projects can be added to Heeler independently if desired. This can be ideal for testing purposes or if there's a third party project that you want added for visibility purposes. Similar to connecting an entire GCP Organization, it is recommended that a dedicated project be added for Workload Identity Federation. Doing this ensures isolation and adheres to industry standard best practices. The new project, typically named heeler-security will hold a single service account that will have read-only permission to view resources inside the individual project(s) that will be onboarded to the Heeler platform.

1. Create a new project, e.g., heeler-security

gcloud projects create heeler-security

1. To simplify the remaining gcloud commands, set the newly created project as default

gcloud config set project heeler-security

1. Enable the APIs that Heeler uses to communicate with GCP

gcloud services enable \
    cloudresourcemanager.googleapis.com \
    iam.googleapis.com \
    iamcredentials.googleapis.com \
    pubsub.googleapis.com \
    sqladmin.googleapis.com \
    sts.googleapis.com

1. Create a new service account that Heeler will use to pull inventory data, e.g., heeler-collector

gcloud iam service-accounts create heeler-collector \
    --description="Service account used to collect inventory across GCP" \
    --display-name="Heeler Security Collector"

1. Get the ID of the project you wish to onboard to Heeler

gcloud projects list

PROJECT_ID                      NAME                        PROJECT_NUMBER
acme-project                    acme-project                592XXXXXXXXX
hooli-project                   hooli-project               593XXXXXXXXX
pied-piper-testing              pied-piper-testing          594XXXXXXXXX
gavin-belson-sandbox            gavin-belson-sandbox        595XXXXXXXXX

1. Grab the email from the newly created service account

gcloud iam service-accounts list

DISPLAY NAME                    EMAIL                                              DISABLED
Heeler Security Collector Demo  [email protected]     False

1. Use the project ID to add the Heeler-required predefined IAM Roles to the newly created service account using the email from the previous step, e.g., [email protected]

gcloud projects add-iam-policy-binding hooli-project  \
    --member=serviceAccount:[email protected] \
    --role=roles/artifactregistry.reader

gcloud projects add-iam-policy-binding hooli-project  \
    --member=serviceAccount:[email protected] \
    --role=roles/iam.securityReviewer

gcloud projects add-iam-policy-binding hooli-project  \
    --member=serviceAccount:[email protected] \
    --role=roles/resourcemanager.folderViewer

gcloud projects add-iam-policy-binding hooli-project  \
    --member=serviceAccount:[email protected] \
    --role=roles/resourcemanager.organizationViewer

gcloud projects add-iam-policy-binding hooli-project  \
    --member=serviceAccount:[email protected] \
    --role=roles/iam.serviceAccountTokenCreator

GKE Cluster Access:

If you are using GKE with GKE DNS endpoints enabled, Heeler needs an additional permission container.clusters.connect. You can create a custom role with this permission, or use the Google-managed roles/container.viewer.

gcloud projects add-iam-policy-binding hooli-project  \
    --member=serviceAccount:[email protected] \
    --role=roles/container.viewer

If you are using GKE clusters without publicly accessible endpoints and you use authorized networks instead of DNS endpoints, you need to add the Heeler outbound IPs as authorized networks:

• 44.221.229.40

• 52.73.231.96

1. Create the Workload Identity Pool

gcloud iam workload-identity-pools create heeler-aws-pool \
    --description="Workload Identity Pool for Heeler on AWS." \
    --display-name="Heeler AWS Pool" \
    --location="global"

1. Create Workload Identity Provider

gcloud iam workload-identity-pools \
    providers create-aws heeler-aws-provider  \
    --account-id=168777450829 \
    --description="Workload Identity Provider for Heeler on AWS" \
    --display-name="Heeler AWS Provider" \
    --attribute-mapping="google.subject=assertion.arn,attribute.account=assertion.account" \
    --location="global" \
    --workload-identity-pool="heeler-aws-pool"

1. Login to the GCP Console in order to finalize the configuration and download the Workload Credentials in the following steps:

https://console.cloud.google.com/iam-admin/workload-identity-pools/pool/heeler-aws-pool?hl=en&inv=1&invt=Abh69A&project=heeler-security

1. Click on Grant Access at the top and on the overlay window select Grant access using Service Account impersonation. Then select the available service account Heeler Security Collector and select account as the attribute with a value of 168777450829. Once you click on save you will be prompted to save

1. Click on Save and then click on Connected Service Accounts on the top right. Select Download Config and select the provider Heeler AWS Provider.

Heeler Configuration

Once the resources are created and configured in GCP, you need to add their information to Heeler. Open the URL https://app.heeler.com/administration/connections/cloud_accounts or just click on the settings icon at the top right and then click on Connections > Cloud Accounts.

Click on Add Cloud Account and then select Google Cloud Platform. Enter:

1. Project Name (e.g. Hooli Project)

2. Workload Identity Configuration, which was downloaded in the prior step

3. Project ID from the step five, e.g., hooli-project

Click Save. If everything is configured properly within GCP you should see a success message and inventory collection will immediately begin in the background. Please note that for the first round of collection it could take some time based on the size of the GCP project.