Connect your Google Cloud project to Annie to unlock real-time infrastructure mapping, monitoring, and dependency insights—exactly the same capabilities as our AWS integration, but using GCP-native security primitives.

Security First: All the roles listed below provide read-only access to your infrastructure. Anyshift cannot access secrets, passwords, API keys, or any other sensitive data stored in your GCP project.

Query retained GCP evidence

After connecting a project, you can inspect the inventory and change evidence collected for it with the Annie CLI:

annie graph cloud-resources --provider gcp --type COMPUTE_INSTANCES --max-age 24h
annie graph cloud-events --provider gcp --since 24h
annie graph cloud-events --provider gcp --operation operation-123 --diff

Cloud resources report their lifecycle, observation freshness, and stored IaC provenance. Cloud events distinguish provider audit evidence, snapshot-derived changes, and reconciliation deletes. A provider operation ID groups GCP-native activity; an Anyshift correlation ID groups the broader retained event story. Cloud-event browsing is bounded by default: Annie reports the events shown plus pagination state without calculating an exact full-window total. Add --exact-stats only when you explicitly need the exact total and event-type breakdown, which can take longer on large projects. Audit event categories are normalized from the GCP operation: instance insert/delete operations are lifecycle, compute_instances_set_metadata is configuration, and iam_service_accounts_set_iam_policy is identity. Current producers exclude mutations rejected by GCP because they did not change provider state. Their absence from cloud-event results does not prove that no rejected calls occurred. A retained legacy row can still report failed; an accepted event without enough outcome evidence remains unknown, never inferred as success. Rejected-call rates can be useful security or automation-health signals, but they are not change events or causal roots. Any future rejection detector will remain outside event-story correlation. An empty filtered CLI page is a successful evidence result and says that no matching cloud events or resources were found. An ambiguous resource is not selected automatically; add provider, scope, region, type, or the exact native ID and retry. Coverage depends on enabled APIs, granted read permissions, regions, resource families, and event retention. Snapshot and reconciliation evidence is not an immediate provider notification. Missing actor, status, freshness, or provenance evidence remains unknown. Anyshift does not turn it into a success, stale verdict, unmanaged verdict, Terraform drift verdict, or causal claim.

Required Roles and Permissions

Setup Options

Quick Setup
Recommended Setup

Minimal Setup with roles/viewerUsing only the roles/viewer role provides basic access but with limitations. Anyshift will be able to scan core GCP resources like Compute Engine, Cloud SQL, GKE, Logging, Monitoring, and Pub/Sub.However, many specialized services will not be accessible.

Essential Roles for Comprehensive ScanningFor full infrastructure visibility, add these roles beyond roles/viewer:

Role	Service	What We Scan
`roles/apigateway.viewer`	API Gateway	APIs, gateways, and configurations
`roles/artifactregistry.reader`	Artifact Registry	Container images and packages
`roles/bigquery.dataViewer` + `roles/bigquery.jobUser`	BigQuery	Datasets, tables, and query jobs
`roles/certificatemanager.viewer`	Certificate Manager	SSL/TLS certificates
`roles/cloudbuild.builds.viewer`	Cloud Build	Build configurations and history
`roles/cloudfunctions.viewer`	Cloud Functions	Serverless functions
`roles/cloudkms.viewer`	Cloud KMS	Encryption key metadata (not the keys themselves)
`roles/composer.environmentAndStorageObjectViewer`	Cloud Composer	Airflow environments
`roles/datacatalog.viewer`	Data Catalog	Data discovery and metadata
`roles/dataflow.viewer`	Dataflow	Stream and batch processing jobs
`roles/dataproc.viewer`	Dataproc	Hadoop/Spark clusters
`roles/dns.reader`	Cloud DNS	DNS zones and records
`roles/redis.viewer`	Memorystore	Redis and Memcached instances
`roles/storage.objectViewer`	Cloud Storage	Buckets and object metadata
`roles/workflows.viewer`	Workflows	Workflow definitions and executions
`roles/iam.roleViewer`	IAM	Roles and permissions
`roles/iam.serviceAccountViewer`	IAM	Service accounts and keys
`roles/iam.workloadIdentityPoolViewer`	IAM	Workload identity pools

Complete Role List for Maximum Coverage

View all available roles that Anyshift can utilize for comprehensive infrastructure scanning:

Services Requiring Additional Roles

These services need specific roles beyond roles/viewer:

AI Platform: roles/aiplatform.viewer, roles/notebooks.viewer
API Gateway: roles/apigateway.viewer
Artifact Registry: roles/artifactregistry.reader
BigQuery: roles/bigquery.dataViewer, roles/bigquery.jobUser, roles/bigquery.metadataViewer
Certificate Manager: roles/certificatemanager.viewer
Cloud Billing: roles/billing.viewer, roles/billing.budgets.viewer
Cloud Build: roles/cloudbuild.builds.viewer
Cloud Functions: roles/cloudfunctions.viewer
Cloud KMS: roles/cloudkms.viewer
Composer: roles/composer.environmentAndStorageObjectViewer
Data Catalog: roles/datacatalog.viewer
Dataflow: roles/dataflow.viewer
Dataproc: roles/dataproc.viewer
DNS: roles/dns.reader
IAM: roles/iam.roleViewer, roles/iam.serviceAccountViewer, roles/iam.workloadIdentityPoolViewer
Memorystore/Redis: roles/redis.viewer
Storage: roles/storage.objectViewer
Workflows: roles/workflows.viewer

Services Covered by `roles/viewer`

These services are already accessible with the basic viewer role:

Cloud SQL
Compute Engine (including networks)
Container/GKE
Firestore
Logging
Monitoring
Pub/Sub
Service Networking

Setup Guide

Option 1: Service-account key

Step 1 · Create a read-only service account

Terraform

resource "google_service_account" "anyshift" {
  account_id   = "anyshift-readonly"
  display_name = "Read-only service account for Anyshift"
}

# Option 1: Quick setup with basic viewer role
resource "google_project_iam_member" "anyshift_viewer" {
  project = var.project_id
  role    = "roles/viewer"
  member  = "serviceAccount:${google_service_account.anyshift.email}"
}

# Option 2: Comprehensive setup with all recommended roles
locals {
  anyshift_roles = [
    "roles/viewer",
    "roles/apigateway.viewer",
    "roles/artifactregistry.reader",
    "roles/bigquery.dataViewer",
    "roles/bigquery.jobUser",
    "roles/certificatemanager.viewer",
    "roles/cloudbuild.builds.viewer",
    "roles/cloudfunctions.viewer",
    "roles/cloudkms.viewer",
    "roles/composer.environmentAndStorageObjectViewer",
    "roles/datacatalog.viewer",
    "roles/dataflow.viewer",
    "roles/dataproc.viewer",
    "roles/dns.reader",
    "roles/redis.viewer",
    "roles/storage.objectViewer",
    "roles/workflows.viewer",
    "roles/iam.roleViewer",
    "roles/iam.serviceAccountViewer",
    "roles/iam.workloadIdentityPoolViewer"
  ]
}

resource "google_project_iam_member" "anyshift_comprehensive" {
  for_each = toset(local.anyshift_roles)
  project  = var.project_id
  role     = each.value
  member   = "serviceAccount:${google_service_account.anyshift.email}"
}

Console

Go to IAM & Admin → Service Accounts → Create Service Account
Name: anyshift-readonly, Description: “Read-only service account for Anyshift” → Create
Go to IAM & Admin → IAM → Grant Access
Add the service account email and assign roles: For Quick Setup:
- Viewer (Basic role)
For Recommended Setup, also add:
- API Gateway Viewer
- Artifact Registry Reader
- BigQuery Data Viewer
- BigQuery Job User
- Certificate Manager Viewer
- Cloud Build Viewer
- Cloud Functions Viewer
- Cloud KMS Viewer
- Cloud Composer Viewer
- Data Catalog Viewer
- Dataflow Viewer
- Dataproc Viewer
- DNS Reader
- Memorystore Redis Viewer
- Storage Object Viewer
- Workflows Viewer
- IAM Role Viewer
- IAM Service Account Viewer
- IAM Workload Identity Pool Viewer
Tip: Use the filter box to quickly find roles. You can select multiple roles before clicking Save.
Go back to Service Accounts, click on your anyshift-readonly account
Go to Keys tab → Add Key → Create new key → JSON → Create
Download and securely store the JSON key file

Step 2 · Add the service account in Anyshift

Go to Integrations → GCP → Add Service Account and upload the JSON file containing the credentials.

Option 2: Workload Identity (coming soon)

We are working to add support for Workload Identity Federation.This will allow you to grant Anyshift access without managing service account keys, using GCP’s native identity federation capabilities.

Get Started

Product

Manage

GCP Integration

Query retained GCP evidence

Required Roles and Permissions

Setup Options

Services Requiring Additional Roles

Services Covered by `roles/viewer`

Setup Guide

Step 1 · Create a read-only service account

Step 2 · Add the service account in Anyshift

Try Anyshift

Create an account

Request a demo

​Query retained GCP evidence

​Required Roles and Permissions

​Setup Options

​Services Requiring Additional Roles

​Services Covered by roles/viewer

​Setup Guide

​Step 1 · Create a read-only service account

​Step 2 · Add the service account in Anyshift

​Try Anyshift

Create an account

Request a demo

Query retained GCP evidence

Required Roles and Permissions

Setup Options

Services Requiring Additional Roles

Services Covered by `roles/viewer`

Setup Guide

Step 1 · Create a read-only service account

Step 2 · Add the service account in Anyshift

Try Anyshift