Documentation

Complete Guide to Integrating PolicyCortex with Google Cloud Platform

Complete guide for integrating PolicyCortex with Google Cloud Platform services. Monitor and govern GCP projects, resources, and organization policies.

PolicyCortex GCP Integration: Documentation & Setup Guide

Quick Setup

Service Account Setup

Create a service account with appropriate IAM roles to monitor and govern GCP resources.

Create GCP Service Accountbash
# Create service account for PolicyCortex
gcloud iam service-accounts create policycortex-sa \
  --display-name="PolicyCortex Service Account"

# Grant necessary IAM roles
gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
  --member="serviceAccount:policycortex-sa@YOUR_PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/viewer"

gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
  --member="serviceAccount:policycortex-sa@YOUR_PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/security.securityReviewer"

# Create and download key file
gcloud iam service-accounts keys create policycortex-key.json \
  --iam-account=policycortex-sa@YOUR_PROJECT_ID.iam.gserviceaccount.com

Supported GCP Services

Storage

  • • Cloud Storage
  • • Persistent Disks
  • • Filestore

Compute

  • • Compute Engine
  • • GKE Clusters
  • • App Engine

Security

  • • Cloud KMS
  • • Security Command Center
  • • Identity & Access Management

Database

  • • Cloud SQL
  • • Firestore
  • • BigQuery

Networking

  • • VPC Networks
  • • Cloud Load Balancing
  • • Cloud CDN

Operations

  • • Cloud Monitoring
  • • Cloud Logging
  • • Cloud Trace

Common GCP Policies

Example Policy Configuration

GCP Storage Encryption Policyyaml
# Ensure all Cloud Storage buckets have encryption enabled
policy:
  name: "gcp-storage-encryption-required"
  description: "Ensure Cloud Storage buckets use customer-managed encryption"
  resource_type: "storage.googleapis.com/Bucket"

  rules:
    - condition: "resource.encryption.defaultKmsKeyName == null"
      effect: "DENY"
      message: "Cloud Storage bucket must use customer-managed encryption key"

  compliance_mapping:
    - framework: "SOC2"
      control: "CC6.1"
    - framework: "ISO27001"
      control: "A.10.1.1"

  remediation:
    auto_fix: true
    actions:
      - enable_cmek_encryption