Skip to main content

Connect a GCP Account (CloudCADI hosted on Azure)

Prerequisites​

Before you start

Open CloudCADI's GCP onboarding page and note down the three values shown there - Issuer, Subject, and Audience. You'll copy these into GCP in the steps below.

CloudCADI GCP prerequisite values

  1. In the GCP Console, go to IAM & Admin.

  2. Select Workload Identity Federation from the left panel, then click Create pool.

    Open Workload Identity Federation and create a pool

  3. Enter a name for the identity pool (e.g. CloudCADI-gcp-connect) and click Continue.

    Name the identity pool

  4. Under Add a provider to pool, select OpenID Connect (OIDC).

    Select OpenID Connect as the provider

  5. Fill in the provider details, using the values noted from CloudCADI's UI:

    • Issuer (URL): https://sts.windows.net/{TENANT_ID}/
    • Allowed audiences: https://management.azure.com

    Click Continue.

    Enter issuer URL and allowed audience

  6. Under attribute mapping, map google.subject to assertion.sub, then click Save.

    { "google.subject": "assertion.sub" }

    Configure attribute mapping and save

  7. Once the pool is created, click Grant access.

    Grant access to the pool

  8. Select Grant access using service account impersonation, then select an existing service account (or create one and select it). Under Select principals, choose subject and paste the Subject value from CloudCADI's UI, then click Save.

    Grant access via service account impersonation

  9. Assign the View Service Accounts role to that service account.

    Assign the View Service Accounts role

  10. Under Connected service accounts, click Download.

    Open Connected service accounts and click Download

  11. Select the provider and click Download config - this downloads a credential configuration file.

    Select the provider and download the config file

  12. Back in CloudCADI, enter the GCP Organization ID and the Service Account you used, paste the contents of the downloaded file into WIF credential configuration (JSON), then click Save & Validate.

    Enter organization ID, service account, and WIF config in CloudCADI

Auto and Manual Onboarding​

Once the prerequisites above are complete, projects can be onboarded either automatically or manually.

Auto​

  1. Use the CLI command to assign the three required roles, or manually assign them at the organization level.

    Grant required roles via CLI or manually

  2. Click Next - all projects under that organization with billing and pricing export enabled are fetched.

  3. Select the projects to onboard and click Done. The selected projects are onboarded.

    Select projects to onboard

Manual​

  1. Enter the project details and click Next.
Before you start

For enabling Detailed Usage Cost and Pricing exports and obtaining the fully qualified BigQuery table names, refer to the GCP Billing Export documentation.

Enter project and billing export details

  1. Review the configuration and click Done.

    Review configuration and finish