Integrate Google Cloud IAM with Google SecOps

This document explains how to integrate Google Cloud Identity and Access Management with Google Security Operations.

Use cases

The Google Cloud IAM integration supports the following use cases:

• Automated service account lifecycle management: Automatically create, enable, or disable service accounts during onboarding and offboarding processes to ensure access is granted only when necessary.

• Rapid identity incident response: Immediately delete or disable compromised service accounts and roles during a security incident to prevent unauthorized access to cloud resources.

• Identity governance and enrichment: Enrich User entities in Google SecOps with detailed service account metadata, such as display names and project IDs, to provide analysts with immediate context during investigations.

• Policy auditing and enforcement: Retrieve and audit access control policies to ensure they align with the principle of least privilege, and programmatically set new policies to remediate unauthorized changes.

• Role-based access control (RBAC) management: Create and manage custom IAM roles with specific permission sets across your organization to maintain granular control over cloud environment access.

Before you begin

Before you configure the Google Cloud IAM integration in Google SecOps, complete the following prerequisite steps:

1. Create a custom IAM role: Define a role with the specific permissions required to manage service accounts and roles.

2. Create a service account: Create the identity that the integration uses to perform actions.

3. Select an authentication method: Choose between the recommended Workload Identity or a service account JSON key.

Create and configure a custom IAM role

To maintain the principle of least privilege, complete the following steps to create a custom role containing only the specific permissions necessary for this integration:

1. In the Google Cloud console, go to IAM & Admin > Roles.

2. Click Create Role.

3. Provide a Title, Description, and ID.

4. Set the Role launch stage to General Availability.

5. Click Add Permissions and add the following specific permissions:

   • iam.serviceAccounts.list
   • iam.serviceAccounts.create
   • iam.serviceAccounts.get
   • iam.serviceAccounts.getIamPolicy
   • iam.serviceAccounts.setIamPolicy
   • iam.serviceAccounts.disable
   • iam.serviceAccounts.enable
   • iam.serviceAccounts.delete
   • iam.roles.list
   • iam.roles.get
   • iam.roles.create
   • iam.roles.delete

6. Click Create.

Create a service account

The integration uses a service account to authenticate and execute IAM actions within your project.

To create a service account, complete the following steps:

1. In the Google Cloud console, go to IAM & Admin > Service Accounts.

2. Click Create Service Account.

3. Enter a name and description, then click Create and Continue.

4. In the Grant this service account access to project section, assign the custom role you created in the previous step to this service account. Click Done.

Select an authentication method

Google SecOps supports two authentication paths for this integration:

• Option 1: Workload Identity (recommended): This method uses short-lived tokens using service account impersonation. It is more secure as it eliminates the need for long-lived JSON keys.

• Option 2: Service account JSON key: This method uses a static key file. Use this only if a Workload Identity is not available in your environment.

Authenticate using a Workload Identity (recommended)

To use a Workload Identity, you must authorize your Google SecOps instance to impersonate the service account you created.

1. In Google SecOps, go to Content Hub > Response Integrations.

2. Select the Google Cloud IAM integration.

3. Enter your service account email in the Workload Identity Email field.

4. Click Save and then click Test. The test is expected to fail initially.

5. Click close_small next to the failed test to view the error message.

6. Search for the unique email address (formatted as gke-init-python@... or soar-python@...) found near the end of the error message. Copy this address.

Grant impersonation permissions

Once you have retrieved the unique identity for your Google SecOps instance, you must authorize it to access your Google Cloud resources. This step enables service account impersonation, allowing the platform to generate short-lived tokens and act on your behalf without the need for static keys.

1. In the Google Cloud console, go to IAM & Admin > Service Accounts.

2. Select the service account you created for this integration.

3. Go to the Permissions tab and click Grant Access.

4. Paste the unique email address you copied into the New principals field.

5. Assign the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator). Click Save.

Authenticate using a JSON key

If using a Workload Identity isn't available in your environment, you can authenticate the integration using a service account JSON key. This method relies on a static, long-lived secret file to establish the connection between the platform and your Google Cloud resources.

1. In the Google Cloud console, go to IAM & Admin > Service Accounts and select your service account.

2. Go to the Keys tab.

3. Click Add Key > Create new key.

4. Select JSON as the key type and click Create. The file downloads to your computer.

5. Copy the entire content of the JSON file.

6. When you configure this integration in the platform, paste the content into the Service Account Json File Content field.

Integration parameters

The Google Cloud IAM integration requires the following parameters:

For instructions about how to configure an integration in Google SecOps, see Configure integrations.

You can make changes at a later stage, if needed. After you configure an integration instance, you can use it in playbooks. For more information about how to configure and support multiple instances, see Supporting multiple instances.

Actions

For more information about actions, see Respond to pending actions from Your Workdesk and Perform a manual action.

Ping

Test connectivity to the Identity and Access Management service with parameters provided at the integration configuration page in the Google Security Operations Marketplace tab.

Parameters

N/A

Run On

This action doesn't run on entities.

Action Results

Script Result

Case Wall

Enrich Entities

Enrich Google SecOps User entities with service accounts information from Identity and Access Management. Action expects Identity and Access Management service account email as a Google SecOps User entity.

Run On

This action runs on the User entity.

Action Results

Script Result

JSON Result

{
           "name": "projects/silver-shift-275007/serviceAccounts/dmitrystestsa@silver-shift-275007.iam.gserviceaccount.com",
           "projectId": "silver-shift-275007",
           "uniqueId": "104627053409757134782",
           "email": "dmitrystestsa@silver-shift-275007.iam.gserviceaccount.com",
           "displayName": "dmitrys Test SA displayName",
           "etag": "MDEwMjE5MjA=",
           "description": "Service account description",
           "oauth2ClientId": "104627053409757134782"
}

Entity Enrichment

Case Wall

List Service Accounts

List Identity and Access Management service accounts based on the specified search criteria. Note that action is not working on Google SecOps entities.

Parameters

Run On

This action doesn't run on entities.

Action Results

Script Result

JSON Result

{
   "accounts": [
       {
           "name": "projects/silver-shift-275007/serviceAccounts/dmitrystestsa@silver-shift-275007.iam.gserviceaccount.com",
           "projectId": "silver-shift-275007",
           "uniqueId": "104627053409757134782",
           "email": "dmitrystestsa@silver-shift-275007.iam.gserviceaccount.com",
           "displayName": "dmitrys Test SA displayName",
           "etag": "MDEwMjE5MjA=",
           "description": "Service account description",
           "oauth2ClientId": "104627053409757134782"
       }

Case Wall

Create Service Account

Create an Identity and Access Management Service Account.

Parameters

Run On

This action doesn't run on entities.

Action Results

Script Result

JSON Result

{
   "name": "projects/silver-shift-275007/serviceAccounts/dmitrystestsa@silver-shift-275007.iam.gserviceaccount.com",
   "projectId": "silver-shift-275007",
   "uniqueId": "104627053409757134782",
   "email": "dmitrystestsa@silver-shift-275007.iam.gserviceaccount.com",
   "displayName": "dmitrys Test SA displayName",
   "etag": "MDEwMjE5MjA=",
   "description": "Service account description",
   "oauth2ClientId": "104627053409757134782"
}

Case Wall

Get Service Account IAM Policy

Gets the access control policy for the service account. Action expects Identity and Access Management service account email as a Google SecOps User entity. Note that policy may be empty if no policy is assigned to the service account.

Run On

This action runs on the User entity.

Action Results

Script Result

JSON Result

{
   "version": 1,
   "etag": "BwXBuNg8cMA=",
   "bindings": [
       {
           "role": "roles/iam.securityReviewer",
           "members": [
               "user:dmitrys@siemplify.co"
           ]
       }
   ]
}

Case Wall

Set Service Account IAM Policy

Sets the access control policy on the specified service account. Action expects Identity and Access Management service account email as a Google SecOps account entity. Note that policy provided in action replaces any existing policy.

Parameters

Run On

This action runs on the Account entity.

Action Results

Script Result

JSON Result

{
   "version": 1,
   "etag": "BwXBuNg8cMA=",
   "bindings": [
       {
           "role": "roles/iam.securityReviewer",
           "members": [
               "user:dmitrys@siemplify.co"
           ]
       }
   ]
}

Case Wall

Disable Service Account

Disable service account. Action expects Identity and Access Management service account email as a Google SecOps User entity.

Run On

This action runs on the User entity.

Action Results

Script Result

Case Wall

Enable Service Account

Enable service account. Action expects Identity and Access Management service account email as a Google SecOps User entity.

Run On

This action runs on the User entity.

Action Results

Script Result

Case Wall

Delete Service Account

Delete service account. Action expects Identity and Access Management service account email as a Google SecOps User entity.

Run On

This action runs on the User entity.

Action Results

Script Result

Case Wall

List Roles

List Identity and Access Management roles based on the specified search criteria. Note that action is not working on Google SecOps entities.

Parameters

Run On

The action doesn't run on entities.

Action Results

Script Result

JSON Result

{
   "roles": [
       {
           "name": "roles/accessapproval.approver",
           "title": "Access Approval Approver",
           "description": "Ability to view or act on access approval requests and view configuration",
           "stage": "BETA",
           "etag": "AA=="
       },
       {
           "name": "roles/accessapproval.configEditor",
           "title": "Access Approval Config Editor",
           "description": "Ability update the Access Approval configuration",
           "stage": "BETA",
           "etag": "AA=="
       }
   ]
}

Case Wall

Create Role

Create an Identity and Access Management Role.

Parameters

Run On

The action doesn't run on entities.

Example For Role Policy JSON

{
   "name": "projects/silver-shift-275007/roles/iam_test_role_api",
   "title": "iam_test_role_api",
   "description": "test role",
   "includedPermissions": [
       "storagetransfer.projects.getServiceAccount"
   ],
   "stage": "GA",
   "etag": "BwXBu1RHiPw="
}

Action Results

Script Result

JSON Result

{
   "name": "projects/silver-shift-275007/roles/iam_test_role_api",
   "title": "iam_test_role_api",
   "description": "test role",
   "includedPermissions": [
       "storagetransfer.projects.getServiceAccount"
   ],
   "stage": "GA",
   "etag": "BwXBu1RHiPw="
}

Case Wall

Delete Role

Delete an Identity and Access Management Role.

Parameters

Run On

This action doesn't run on entities.

Action Results

Script Result

JSON Result

{
   "name": "projects/silver-shift-275007/roles/iam_test_role_api",
   "title": "iam_test_role_api",
   "description": "test role",
   "includedPermissions": [
       "storagetransfer.projects.getServiceAccount"
   ],
   "stage": "GA",
   "etag": "BwXDDgKFx7M=",
   "deleted": true
}

Case Wall

Need more help? Get answers from Community members and Google SecOps professionals.