Page Comparison

Note:

...

Before doing sync with GCP you should have done the sync of G Suite, Otherwise, you will miss on the users which get access through G Suite groups. How to sync your organization G Suite checkout link <LINK_TO_GSUITE_DOC>

...

To do this operation you need to be an admin with Zilla ( Specifically SuperAdmin role ) & admin access with your organization's Google Cloud Platform - GCP ( Specifically, Access Approval Approver equivalent or more privileged role than that ) application.

Steps to get required configs

• You will get your Google organization on the top bar of GCP dashboard as marked by the red arrow in the screenshot below. Users & Groups in this primary domain organization will be synced.

  Image Added

• To authenticate the integration, you will need either Zilla managed service account’s credentials or your own service account’s credentials.

In the case of Zilla managed service account:

• If you want to go with Zilla managed service account based authentication, please reach out to the Zilla support team to get the service account email, support@zillasecurity.com.

• After getting the email, create a custom role for Zilla with the below command in Cloud shell.

  Code Block
  gcloud iam roles create zilla_security_role --organization=<your-org-id> --permissions=resourcemanager.organizations.get,resourcemanager.organizations.getIamPolicy,iam.roles.get,iam.roles.list,resourcemanager.projects.get,resourcemanager.projects.getIamPolicy,resourcemanager.projects.list,iam.serviceAccounts.list

• Assign this role to Zilla managed service account with the below command in Cloud shell.

  Code Block
  gcloud organizations add-iam-policy-binding <your-org-id> --member serviceAccount:<zilla-managed-service-account-email> --role organizations/<your-org-id>/roles/zilla_security_role --condition=None

• Private key and email of the service account will be set by the Zilla support team.

In the case of your own service account:

• If you want to use your own service account to authenticate the integration, please create one under any of your projects and grant the permissions below.

  Code Block
  resourcemanager.organizations.get resourcemanager.organizations.getIamPolicy iam.roles.get iam.roles.list resourcemanager.projects.get resourcemanager.projects.getIamPolicy resourcemanager.projects.list iam.serviceAccounts.list

• Private key and emails of the service account will be used in a later step.

Setup GCP Application Integration on Zilla

• Login to Zilla with your admin credentials,.

...

• You will see your Zilla applications tab, Locate Applications tab (if not, click Applications in the left menu bar), click Add Application button at in the top right top , click it,corner.

...

• You will see Add Application screen with Search Library tab where you may see GCP entry at the top or you may need to type gcp as search text, You will see an entry for Google Cloud Platform with A window with a search bar appears, type in GCP in the search bar. Google Cloud Platform app entry will appear at the top of the list, click Add to Applications button on to the right side, click it, .

...

• A dialog appears, add the required field Instance Name & you can choose to fill in optional fields for Owner & criticality. Click Fill in the form with appropriate details and then click on Add to Applications button.

  Image RemovedImage Added

• The GCP instance will get added to your Applications, You can see it appear there. Click on the Google Cloud Platform app instance name ,you just added.

...

• You will see a detailed GCP Application page. On the top right top, you will see click Sync now button click it, .

...

• A dialog appears, Enable enable API Integration.

...

• Upon enabling the API Integration a configuration option appear,

...

• Your google domain enter the name of your google primary domain for example if your gmail is john.doe@example.com enter example.com as your domain here, Most likely it will appear on the top bar of GCP dashboard as marked by the red arrow in the below screenshot,

...

• Upon filling in the Your google domain information, Click the Next button.

...

• Next, you will see a small dialog In the next step, you may be asked to log in to Google Cloud Platform - 1, and then sync will start automatically. Click Next

• You will be redirected to Google to do OAuth consent for following permission, Click Allow

...

• Fill in Your google domain, Private key of the service account and Email of the service account from the earlier steps. In case of Zilla managed service account, private key and email of service account configs will be set by the Zilla support team.

• Set Use service account based authentication to Yes.

• Optional: Comma separated list of project ID prefixes to skip projects (e.g. sys, sandbox): projects can be excluded from the sync by specifying the project ID prefix or entire project ID.

• Click Sync Now.

...

• Click Next.

...

• You will see sync is in progress,

...

• On sync completion a toast dialog appears

...

• . Click Done.

...

• After sync completion, check the Sync summary. Click Close.

...

• You are done, now you can visit various tabs of the Application Details page for Google Cloud Platform app instance on Zilla, to see what application data is brought in by sync. e.g. Accounts tab will have details of user accounts that are brought in.If you see some errors or need further assistance, please contact Zilla Support.