Skip to main content

​
Purpose

The Google Cloud Platform integration connects AirMDR to Google Cloud APIs by using a dedicated service account. After the connection is configured, AirMDR can retrieve supported security and operational information from the selected Google Cloud organization and projects. AirMDR provides two configuration methods:
Recommended: Use the “Use a Script” method to reduce manual configuration. Use Do It Yourself when your organization requires changes to be performed manually through the Google Cloud Console.

​
Pre-requisites

User Organization must define Owner or Security Admin role (roles/owner or roles/securitycenter.admin) in your GCP organization.
User must have Organization Admin permissions to enable services at the organization level.
  1. Select your organization, and enter keyword “Security” in the search bar.
  2. Select the Security Command Center.
    GCPSCC3 1
  3. Click on “GET THE SECURITY COMMAND CENTER”.
  4. Make sure Service Tier is Premium (Paid) for your organization.

    SCC Editions: Standard vs. Premium Feature support (For reference)
AirMDR uses a Google Cloud service account JSON key to authenticate with Security Command Center.

​
Required Authentication Details

The Service_account_json field must contain the complete JSON object, not only the service-account email or key ID.
Never use actual service-account credentials in documentation, screenshots, tickets, email, chat, or source-code repositories.

​
Runtime access model

The AirMDR service account uses read-only permissions for the currently documented skills. It does not require permission to modify Google Cloud resources.The script performs temporary read/write setup actions because it creates the service account, assigns roles, enables services where applicable, and generates a service-account key.
The service account must have permission to read Security Command Center findings from the target organization.Recommended minimum role:Additional roles may be required depending on the customer’s GCP hierarchy, organization policies, and AirMDR use case.
Use least-privilege access. Assign only the permissions required for AirMDR to retrieve Security Command Center findings.
The following permissions are required only by the administrator running the script or completing the manual setup. They are not runtime permissions for the AirMDR service account.

​
Method 1: Use a Script Setup Steps

Use this method to automate the service-account and IAM configuration steps.
1

Obtain the Google Cloud Organization ID

The Organization ID already exists in Google Cloud and must be entered before the script is generated.
  1. Sign in to the Google Cloud Console.
  2. Open the project selector in the top navigation bar.
  3. Select the required organization.
  4. Open the organization settings or Manage resources page.
  5. Locate Organization ID.
  6. Copy the numeric value.
    Do not enter the organization name, domain, project name, or project number in the Organization_id field.
2

Open the GCP connection form in AirMDR

  1. Sign in to AirMDR.
  2. In the left navigation pane, select Integrations.
  3. Search for Google Cloud Provider.
  4. Open the integration.
  5. Select the Connections tab.
  6. Click + Create.
  7. Enter a unique instance name.
    Example: example-org-gcp
  8. Select Use a Script.
3

Generate and download the script

  1. Under Select the script language you want to use, select Python or Terraform.
  2. Enter the following information:
  3. Review the entered Organization ID and Project ID.
  4. Click the Download icon.
    The selected script (Python or Terraform) is downloaded to your computer.
Security recommendation: Review the downloaded script before running it. Confirm that the organization, project, service-account ID, APIs, and IAM roles match the approved configuration.
4

Open Google Cloud Shell

  1. Open Google Cloud Shell.
  2. Confirm that you are signed in with the approved Google Cloud administrator account.
  3. Verify that the correct project is active.
    You can optionally check the active project by running: gcloud config get-value project
5

Upload the script

Upload the downloaded script by using one of the following methods:
  • Drag the file from your computer and drop it into the Cloud Shell terminal window.
    (OR)
  • Select the three-dot menu at the top of the Cloud Shell pane, and then select Upload.
The uploaded file is placed in the Cloud Shell home directory.Confirm that the file is available: 
6

Run the script

Run the uploaded Python script:
If the downloaded file has a different name, replace script.py with the actual filename:
The account running the script must have permission to perform every operation included in the script. Using a script reduces manual steps but does not remove Google Cloud permission requirements.
7

Review the script output

After the script completes:
  1. Confirm that it reports successful service-account creation and IAM role assignment.
  2. Copy the Service_account_json generated by the script.
  3. Copy or confirm the Organization_id shown in the output.
  4. Do not close the terminal until the required values have been entered in AirMDR.
    The Organization ID is not newly generated. The script returns or confirms the Organization ID supplied during script creation.
8

Provide the credentials in AirMDR

  1. Return to the AirMDR connection form.
  2. In Service_account_json, paste the complete JSON credentials generated by the script.
  3. In Organization_id, enter the numeric Organization ID.
  4. Expand Advanced Configuration only if additional settings are required.
  5. Click Save.
  6. Validate the connection.

​
Method 2: Do It Yourself Setup Steps

This section explains how to collect the two required values for AirMDR:
  • service_account_json
  • organization_id
1

Open Google Cloud Console

  1. Sign in to the Google Cloud Console.
  2. In the ribbon, click on your project name.
  3. From the top project selector, select the project that will be used for the AirMDR integration.
    Confirm that you are working under the correct organization and project.
    The selected project is where the service account and API configuration will be managed.
2

Enable Security Command Center API

  1. In Google Cloud Console, open the navigation menu.
  2. Go to APIs & Services.
  3. Select Library.
  4. Search for Security Command Center API.
  5. Open the API page.
  6. Click Enable.
3

Create a Service Account

  1. In Google Cloud Console, open the navigation menu.
  2. Go to IAM & Admin.
  3. Select Service Accounts.
  4. Click Create Service Account.
  5. Enter the following details:
  6. Click Create and Continue.
  7. Skip role assignment (Permissions and Principals with access) at this step if the role will be assigned at the organization level.
  8. Click Done.
4

Generate the Service Account JSON Key

  1. Search the service account created for AirMDR.
    For example: airmdr-integration-gcp(as shown)
    GCP14 1
  2. Open the Keys tab.
  3. Click Add Key drop-down.
    GCP13 1
  4. Select Create new key.
  5. Select JSON as the key type.
    GCP12
  6. Click Create.
    Permission updates for service accounts may take a few minutes to propagate. If access is not granted immediately, wait a few minutes and try again.
  7. The JSON file is downloaded automatically.
    The downloaded file is the service_account_json required in AirMDR.
    Example JSON Structure:
    GCP16
    Store the JSON key securely. Do not share it over email, chat, or unsecured channels.
5

Assign IAM Role to the Service Account

  1. In Google Cloud Console, go to IAM & Admin.
  2. Select IAM.
    Make sure the correct organization is selected.
    GCPSCC7 3
  3. Click Grant Access.
    GCPSCC6 1
  4. In Add Principals → New principals, enter the service account email.
    Example: airmdr-integration-gcp@example-project.iam.gserviceaccount.com
  5. In Assign Roles → Select a role, search for and select:
    • Security Center Findings Viewer (roles/securitycenter.viewer) → Grants read access
      Make sure the correct Organisation is selected under Resource.
      For example: airmdr.com (Reference only as shown below)
  6. Skills and Required IAM Roles
    To view the details of Input Parameters and Output for the respective skills
  7. Click Save.
    GCP11 1
When finished, you should have a service account named airmdr-agent, credentials for this service account in a JSON file saved to your host.
6

Get the Organization ID

  1. In Google Cloud Console, open the project selector at the top.
    GCPSCC7 2
  2. Select the required organization.
  3. Click the three-dot menu or More option.
  4. Select Settings.
  5. Locate the Organization ID field.
  6. Copy the numeric organization ID.
    Example: 123456789012
    This value is the organization_id required in AirMDR.

​
Configure GCP Security Command Center API in AirMDR Integrations Dashboard

  1. Navigate to AirMDR, provide the credentials and click Login
  2. Navigate to the AirMDR Integrations Dashboard in the left navigation pane and select Integrations.
  3. Use the search option, enter the keyword “Google Cloud Provider”, select the Connections tab, and click + Create button.
  4. Enter an unique name to the Instance (e.g., your org name-GCP) to easily identify the user connection by AirMDR.
  5. Enter the application credentials like Service_account_json and Organization_id in the Authentication Details field params, and click Save.

​
Additional Information

Where to MonitorSample Success Log
Sample Error Log
Recommended Log Levels
Follow these recommendations to maintain a secure and compliant Google Cloud Security Command Center (GCP SCC) integration with AirMDR.✅ Do
  • Use a dedicated Service Account for the AirMDR integration.
  • Grant only the minimum IAM permissions required (principle of least privilege).
  • Store the Service Account JSON securely in an encrypted secrets manager or credential vault.
  • Rotate Service Account keys periodically according to your organization’s security policy.
  • Enable Multi-Factor Authentication (MFA) for privileged Google Cloud accounts.
  • Regularly review IAM roles and remove unnecessary permissions.
  • Monitor Google Cloud Audit Logs for authentication and permission changes.
  • Validate the integration after updating IAM roles or rotating credentials.
  • Keep the Security Command Center API enabled and accessible.
  • Immediately revoke compromised or unused Service Account keys.
❌ Don’t
  • Don’t share the Service Account JSON file over email, chat, or unsecured channels.
  • Don’t commit Service Account keys to source code repositories.
  • Don’t assign excessive permissions such as Owner or Editor unless absolutely necessary.
  • Don’t reuse the same Service Account across multiple unrelated applications.
  • Don’t leave unused Service Account keys active.
  • Don’t disable audit logging for Service Account activities.
  • Don’t expose Organization IDs or sensitive credentials in public documentation or screenshots.
  • Don’t hardcode credentials in scripts or configuration files.
  • Don’t ignore authentication or permission-related errors during integration validation.
  • Don’t skip periodic access reviews and credential rotation.
  • 📧 Contact AirMDR Support through your designated support channel.
  • 🔁 Rotate credentials regularly.
  • 🔄 Reconnect in AirMDR when secrets are changed.
Data ExchangedSecurity Considerations
  • Authentication is performed using a Google Cloud service account.
  • API communication uses Google Cloud HTTPS endpoints.
  • Store the service account JSON securely.
  • Rotate the JSON key based on the organization’s credential rotation policy.
  • Revoke unused keys immediately.
Ports and Endpoints