Google Cloud Platform Integration

Overview

The Google Cloud Platform (GCP) integration connects your GCP projects to Fencer for cloud infrastructure scanning and security monitoring. It supports two integration modes: Scan for discovering and assessing cloud resources, and Monitor for ingesting GCP logs into the SIEM for detection and threat hunting.

Both modes authenticate using a GCP service account key (JSON), and each can be configured independently per project.

Prerequisites

• A GCP project with the resources you want to scan or monitor.
• A GCP service account with the appropriate IAM roles (see below for each mode).
• The Administrator role in your Fencer organization.
• A valid Fencer subscription. Monitor connections also need a plan that includes Security Monitoring.

How it works

Scan mode uses the GCP Cloud Asset API to enumerate resources across your project — including Compute instances, Cloud SQL databases, GKE clusters, Cloud Storage buckets, BigQuery datasets, and many more. Fencer runs infrastructure security checks against the discovered resources and reports misconfigurations as vulnerabilities. The scan also discovers container images running in GKE workloads and can scan them for vulnerabilities. When Artifact Registry discovery is enabled for your organization, it also discovers the newest tagged image of each image in each Artifact Registry Docker repository in the regions you scan, unless an image with the same name is already running in GKE. Enable the Artifact Registry API (artifactregistry.googleapis.com) for that lookup. Fencer also syncs the project’s IAM members and service accounts into identity management, and rescans the project daily, or weekly on plans without daily scheduled scans.

Monitor mode ingests GCP logs into Fencer’s SIEM pipeline. When you connect a monitor integration, Fencer creates a log sink in your GCP project that routes logs to Fencer over Pub/Sub. From there, logs are processed for detection rules and made available for threat hunting.

Usage / Configuration

Connecting a GCP Scan integration

1. In Fencer, go to Admin > Integrations and click the GCP - Google Cloud Platform (Scan) card under Available Integrations, then click Continue.
2. A setup guide is shown beside the form, with tabs for Manual Setup, CLI Instructions (runs setup-fencer-gcp-service-account.sh), Terraform, and Pulumi. The CLI script and the modules create the service account, the role, and the key for you.
3. With Manual Setup, enable these APIs on your GCP project:
   • IAM API (iam.googleapis.com)
   • Cloud Asset API (cloudasset.googleapis.com)
   • Cloud Resource Manager API (cloudresourcemanager.googleapis.com)
   • Service Usage API (serviceusage.googleapis.com)
   • Access Context Manager API (accesscontextmanager.googleapis.com) — optional, needed for Context-Aware Access scanning
   • Artifact Registry API (artifactregistry.googleapis.com), when Artifact Registry discovery is enabled for your organization
4. Create a custom role with FencerScannerRole as both its title and ID, adding the permissions the guide lists.
5. Create a service account (for example fencer-scanner), grant it FencerScannerRole, and download a JSON key for it from its Keys tab.
6. In the form, optionally enter Your name or alias for this GCP connection (optional) (defaults to the project ID), choose the Environment (Production, Development, Test, or Mixed), and upload the key as the Credentials Key JSON File.
7. Choose whether to Scan registry images and Scan container images (both on by default), and which Regions to scan.
8. Click Connect. Fencer validates the credentials, checks that the required roles and APIs are in place, then creates the cloud account and triggers an initial infrastructure scan, architecture discovery, and an identity sync.

After connecting, your GCP resources appear under Posture > Infrastructure in Fencer.

Connecting a GCP Monitor integration

Batch data sources are deprecated

Fencer is deprecating batch data sources, which load logs from a Cloud Storage bucket, and moving to streaming ingestion. To use streaming for your GCP logs, contact us.

1. Go to Admin > Integrations and click the GCP - Google Cloud Platform (Monitor) card.
2. Select the Log Source Type you want to ingest, then click Continue. Supported types are:
   • GCP Cloud Audit Logs
   • GCP VPC Flow Logs
   • GCP Cloud Storage Access Logs
   • GCP Firewall Rule Logs
   • GCP Cloud Armor Logs
   • GCP Cloud DNS Logs
   • GCP Cloud SQL Logs
3. Follow the guide beside the form (Manual Setup or CLI Instructions, which runs a Cloud Shell script for the chosen log type). Create a service account and grant it the roles/logging.configWriter and roles/serviceusage.serviceUsageConsumer roles. These allow Fencer to create a log sink in your project.
4. Upload the service account key as Service Account Key (JSON).
5. Optionally fill in Data Source Name (optional) and Connection name (optional).
6. Click Connect. Fencer validates the credentials, then provisions the monitoring pipeline in the background.

Note

Provisioning runs asynchronously, so data appears in threat hunting only after it has finished.

Editing a connection

On Admin > Integrations, click Edit on a scan connection to update its name, environment, credentials JSON (leave it empty to keep the stored key), and container scanning options, then click Save changes. The regions to scan are edited in the card below the form. For a monitor connection, expand the card and click Edit Data Source to update the data source name, connection name, or key.

Disconnecting

Removing a scan connection (Remove) soft-deletes the associated cloud account and integration record. Removing a monitor data source (Remove Data Source) removes the log sink from your GCP project and cleans up the data source. If a monitor connection has multiple data sources, only the specific data source is removed; the connection itself is deleted only when its last data source is removed.

Examples

Setting up Cloud Audit Log monitoring

1. In the GCP Console, create a service account called fencer-monitor in your project.
2. Grant roles/logging.configWriter and roles/serviceusage.serviceUsageConsumer to the service account.
3. Download the JSON key.
4. In Fencer, go to Admin > Integrations and click the GCP - Google Cloud Platform (Monitor) card.
5. Select GCP Cloud Audit Logs as the log source type and click Continue.
6. Upload the JSON key and click Connect.
7. After provisioning completes, go to Operations > Threat Hunting to query your GCP audit events.

Troubleshooting

• “Service account … is missing FencerScannerRole on project …” (or ”… is missing these roles on project …” for a monitor key) — Ensure the service account has the FencerScannerRole custom role (or the legacy predefined roles the message lists, if you set up before the custom role was available). Visit the IAM Admin page for your project to verify role assignments.
• ”… is not enabled on project …” — Enable the API the message names from the APIs & Services page in the GCP Console.
• “Google Cloud refused this key for service account …” — The key may have been deleted or disabled. Create a new JSON key and upload it.
• “Credentials file is missing project_id.” — The uploaded JSON file must be a service account key that includes a project_id field. Ensure you downloaded the correct key type.
• “An integration for this project already exists.” — The project is already connected; edit the existing connection instead.
• Monitor data not appearing — Provisioning is asynchronous. If data still doesn’t appear after a while, check that the log sink was created in your GCP project under Logging > Log Router.

Related pages

• Integrations Overview
• Cloud Infrastructure Scanning
• Security Monitoring (SIEM)
• GCP Log Sources
• Threat Hunting