Connect & Integrate Google Cloud

Last updated: May 7, 2026

Introduction

This guide covers using YeshID’s Google Cloud integration to connect your Google Cloud organization.

Once connected, YeshID imports:

  • IAM users

  • IAM groups

  • Service accounts

  • Projects

  • Project access grants

If configured, YeshID can also import:

  • Service account keys

  • Google Group memberships

Steps

  1. Sign in to Google Cloud Console
    Go to https://console.cloud.google.com and make sure you are in the correct Google Cloud organization.

  2. Create a dedicated service account
    Create a dedicated Google Cloud service account for YeshID in any GCP project you control.
    You do not need to create the service account in every project you want to import.

  3. Grant organization-level roles
    Grant the YeshID service account these IAM roles at the organization level:
    Required:

    • Cloud Asset Viewer (roles/cloudasset.viewer)

    • Service Usage Consumer (roles/serviceusage.serviceUsageConsumer)

  4. Optional:

    • Service Account Viewer (roles/iam.serviceAccountViewer) if you want YeshID to import service account keys

  5. Enable required APIs in the service account’s project
    In the project that owns the service account, enable:
    Required:

    • Cloud Asset API

    • IAM API

  6. Optional:

    • Cloud Identity API if you want YeshID to import group memberships

  7. Create a JSON key for the service account
    Create a new JSON key for the service account and download the file.
    You will paste this key into YeshID as:

    • Service Account Key JSON

  8. Copy your organization ID
    In Google Cloud Console, find your numeric Organization ID.
    In YeshID, this is entered as:

    • Organization ID

  9. Optional: enable group membership import
    If you want YeshID to import Google Group memberships, also do the following in Google Admin:

    • Enable the Cloud Identity API

    • Assign the Groups Reader admin role to the YeshID service account here.

  10. Connect the integration in YeshID
    In YeshID, open the Google Cloud integration and enter:

    • Service Account Key JSON

    • Organization ID

  11. Save the integration.

  12. Run a sync
    Start a sync in YeshID.
    YeshID will import Google Cloud IAM data for projects under the organization you provided.

FAQ

Does this integration work on one project only?

No. This integration is organization-scoped.

YeshID scans IAM data for the Google Cloud organization you provide and imports projects discovered under that organization.

Do I need to grant roles on every project?

No. Grant the required roles at the organization level.

Do I need Service Account Viewer?

Only if you want YeshID to import service account keys.
If you only want users, groups, service accounts, projects, and access grants, it is optional.

Why are my groups imported without members?

Group membership import requires additional setup:

  • the Cloud Identity API must be enabled

  • the YeshID service account must have the Groups Reader admin role in Google Admin

What if I do not have a Google Cloud organization?

This integration currently expects a Google Cloud Organization ID.
If you only have standalone projects and no organization resource, this integration is not a fit in its current form.

Does the service account need to live in a specific project?

No. It can live in any project you control, as long as:

  • the required APIs are enabled in that project

  • the service account has the required organization-level roles