Faddom can discover your GCP environment without installing anything on your VMs. This guide will walk you through setting this up for a GCP subscription.
Note: If you require use of an HTTP proxy with authentication in order to allow the Faddom server access to the GCP API, this is not currently supported by GCP. You can read more about this here.
How to Add Permissions
Faddom requires the following permissions to perform discovery.
compute.instances.list
compute.instances.get
compute.subnetworks.list
compute.forwardingRules.list
compute.targetHttpProxies.list
compute.urlMaps.list
compute.backendServices.list
compute.instanceGroups.list
Instances monitoring.timeSeries.list
So Faddom can read the flow logs, it additionally needs the logging.logEntries.list
Alternatively, you can use the predefined roles
roles/compute.viewer - Compute Engine read-only access
roles/monitoring.viewer - Monitoring metrics read access
roles/logging.viewer - Logging (flow logs) read access
Find the email address associated with the Service Account by navigating to GCP Console > Service Accounts
To add the permissions, you need to go to your GCP Console > IAM and select Grant Access
Creating a Service Account Key
To be able to read the data and collect information from your GCP account, you will need to provide Faddom with a Service Account Key file. Follow the steps below to create one -
In the Google Cloud console, go to the Service accounts page. The remaining steps will appear automatically in the Google Cloud console.
Select the project/s you wish to map in Faddom. You can have one key per project or map multiple projects with one Service Account Key.
Click the email address of the service account that you want to create a key for
Click the Keys tab
Click the Add-key drop-down menu, then select Create new key
Select JSON as the Key type and click Create
Clicking Create downloads a service account key file. After you download the key file, you cannot download it again.
Creating Traffic Flows
To be able to receive the traffic, you will need to set up the traffic flows by using the following procedure -
In the Google Cloud console, go to the VPC networks page.
Click the subnet that you want to update.
Click Edit
For Flow logs, select On.
Click Save
For more information, you can refer to the GCP documentation VPC Flow Logs and Use VPC Flow Logs
Connecting Faddom to GCP
Go to Settings > Data Source > GCP
Provide the Project IDs. If running discovery for multiple projects, please ensure the project IDs are comma-separated, upload the Key file created in the above step, and click on Run Discovery
After a few moments, Faddom will list all the subnets in the project, select which you want to receive flow logs for, and select Done. You can hover over the name of the project to see the full name if needed.
You will then be taken back to the Data Sources screen once this step is complete
Collect Disk Space
For Faddom to report on free disk space, you need to install the GCP Ops Agent for each server you wish to have the data for. For instructions on doing this, please follow the GCP guide Installing the Ops Agent on individual VMs