---
title: "Integrate Google Cloud Platform (GCP) with Red Canary"
slug: "integrate-google-cloud-platform-gcp-with-red-canary"
updated: 2026-09-09T16:09:40Z
published: 2026-09-09T16:09:40Z
canonical: "docs.redcanary.com/integrate-google-cloud-platform-gcp-with-red-canary"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrate Google Cloud Platform (GCP) with Zscaler MDR

Integrating Google Cloud Platform (GCP) with Zscaler MDR provides enhanced threat detection and response capabilities for cloud environments. You can gain deeper visibility into cloud activities, identify potential threats faster, and mitigate risks more effectively. To integrate Google Cloud Platform (GCP) with Zscaler MDR, follow the procedure below from beginning to end. Once all steps are completed successfully, the data should be ingested into Zscaler MDR within ~20 minutes.

> [!NOTE]
> **Note**
> 
> You can integrate GCP with Zscaler MDR at an **organization** or **project** level. Steps are provided for both organizational and project-level integrations.

> [!WARNING]
> Account Limits
> 
> Zscaler MDR restricts all cloud integrations to 2,000 accounts or external services in a single subdomain. Please contact your Customer Success Manager if you anticipate hitting this limit.

## Prerequisites

- You must be subscribed to the Zscaler MDR Cloud Control Plane license
- To set up the integration, you need one of the following administrative roles (the Editor and Owner roles usually include these permissions):
  - Organization Administrator or Organization Role Administrator
  - Role Administrator or IAM Admin
- To create the organization-level Log Sink that sends logs to Zscaler MDR, you need one of the following roles (the Owner role usually includes these permissions):
  - Logging Admin
  - Logs Configuration Writer

> [!NOTE]
> **If you use a Domain Restricted Sharing Policy or your Organization was created after May 3, 2024:**
> 
> You’ll need to update your GCP Organization policies to give Zscaler MDR the necessary access. Please follow the **Console** steps under the *Setting the organization policy* section in Google’s [Restricting identities by domain](https://cloud.google.com/resource-manager/docs/organization-policy/restricting-domains#setting_the_organization_policy) documentation, noting the following values and caveats:
> 
> 
> 
> **Step 9**: Use these values:
> 
> - Display Name: `redcanary.com`
> - DIRECTORY_CUSTOMER_ID: `C02jg03ap`
> 
> **Step 10**: This should be skipped unless you’re adding multiple Organizations to your Domain Restricted Sharing policy.
> 
> **Step 12**: This should be skipped because setting tag constraints could interfere with the Zscaler MDR GCP integration.
> 
> 
> 
> If you have any issues or concerns, please reach out to the Zscaler MDR Support team.Integration Resources

## Integration Resources

Throughout this integration, you will create resources within your GCP environment. These resources enable Zscaler MDR to acquire your logs and monitor your systems.

- **Pub/Sub topic**. This topic, named **red-canary-log-export**, receives all published messages.
- **Pub/Sub topic subscription**. A **red-canary-log-ingest** subscription is attached to the ‘red-canary-log-export’ topic and is consumed by Zscaler MDR.
- A Google Logging Sink named **red-canary-log-sink** receives all messages from the GCP Logging Service and publishes them on the **red-canary-log-export** topic. This Sink will receive messages from all the children’s projects at an organizational level.
- A new custom role named **red_canary_ingestor** provides the necessary permissions for the Zscaler MDR Integration.
- A new policy binding assigns the **red_canary_ingestor** role to the region-appropriate Zscaler MDR service account for your organization or project:

EU01: serviceAccount:red-canary-gcp-log-ingest@rc-nest-emea-prod-1.iam.gserviceaccount.com

IND01: serviceAccount:red-canary-gcp-log-ingest@rc-nest-apj-prod-1.iam.gserviceaccount.com

NEST0: red-canary-gcp-log-ingest@red-canary-platform-production.iam.gserviceaccount.com
- A second binding policy assigns the built-in **roles/pubsub.subscriber** role to the Zscaler MDR service account, enabling Zscaler MDR to subscribe to the subscription.

## **Step 1: Collect information required for integration**

To integrate your Organization with Zscaler MDR, you’ll need to collect a few pieces of information:

- Organization ID
- Provisioning Project ID
- Provisioning Project Number

1. In the Zscaler MDR portal, click **Integrations**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(70).png?sv=2026-02-06&spr=https&st=2026-10-28T00%3A11%3A38Z&se=2026-10-28T01%3A11%3A38Z&sr=c&sp=r&sig=dnrkPchZ1PAggyGXJIEWUHyuAlgVjoSbByVX8%2BjgAks%3D)
2. From the Integrations section, locate and then click **Google Cloud Platform**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(71).png?sv=2026-02-06&spr=https&st=2026-10-28T00%3A11%3A38Z&se=2026-10-28T01%3A11%3A38Z&sr=c&sp=r&sig=dnrkPchZ1PAggyGXJIEWUHyuAlgVjoSbByVX8%2BjgAks%3D)
3. Enter a name for your new GCP integration.
4. Choose the scope of your integration by selecting **Organization** or **Project**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(72).png?sv=2026-02-06&spr=https&st=2026-10-28T00%3A11%3A38Z&se=2026-10-28T01%3A11%3A38Z&sr=c&sp=r&sig=dnrkPchZ1PAggyGXJIEWUHyuAlgVjoSbByVX8%2BjgAks%3D)

### Organization

1. If you selected Organization, enter your **Organization ID**.
  1. To locate your Organization ID, navigate to your [GCP cloud console](https://console.cloud.google.com/iam-admin/audit) and then select your Organization from the resource browser.
  2. Copy your Organization ID, and then paste it into Zscaler MDR.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(73).png?sv=2026-02-06&spr=https&st=2026-10-28T00%3A11%3A38Z&se=2026-10-28T01%3A11%3A38Z&sr=c&sp=r&sig=dnrkPchZ1PAggyGXJIEWUHyuAlgVjoSbByVX8%2BjgAks%3D)
2. Enter your Provisioning Project ID.

> [!NOTE]
> **Note**: The Provisioning Project can be any Project within your Organization; you can use an existing Project or create a new one. This setup provisions a Pub/Sub Topic and Subscription within this Project to use as the destination for log routing.
  1. To locate your Provisioning Project ID, navigate to your [GCP cloud console](https://console.cloud.google.com/iam-admin/audit) and select your Project in the resource explorer.
  2. Copy your **Project ID**, and then paste it into Zscaler MDR.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(74).png?sv=2026-02-06&spr=https&st=2026-10-28T00%3A11%3A38Z&se=2026-10-28T01%3A11%3A38Z&sr=c&sp=r&sig=dnrkPchZ1PAggyGXJIEWUHyuAlgVjoSbByVX8%2BjgAks%3D)
3. From Zscaler MDR, enter any Excluded Projects; this step is optional.

> [!NOTE]
> **Note**: Excluded Projects is a comma-separated list of project ID(s) that will be excluded from the Zscaler MDR scan.
4. From Zscaler MDR, click **Next**.

### Project

1. If you selected Project, enter your **Project ID**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(75).png?sv=2026-02-06&spr=https&st=2026-10-28T00%3A11%3A38Z&se=2026-10-28T01%3A11%3A38Z&sr=c&sp=r&sig=dnrkPchZ1PAggyGXJIEWUHyuAlgVjoSbByVX8%2BjgAks%3D)
  1. To locate your Provisioning Project ID, navigate to your [GCP cloud console](https://console.cloud.google.com/iam-admin/audit) and then select your Project in the resource explorer.
  2. Copy your **Project ID**, and then paste it into Zscaler MDR.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(76).png?sv=2026-02-06&spr=https&st=2026-10-28T00%3A11%3A38Z&se=2026-10-28T01%3A11%3A38Z&sr=c&sp=r&sig=dnrkPchZ1PAggyGXJIEWUHyuAlgVjoSbByVX8%2BjgAks%3D)
2. From Zscaler MDR, click **Next**.

## **Step 2: Enable Data Access Logs**

Enabling Data Access logs ensures Zscaler MDR can monitor activity in your GCP environment.

1. From Zscaler MDR, select **I need to enable Data Access Logs**.
  1. To complete this process, navigate to your [GCP Audit Logs](https://console.cloud.google.com/iam-admin/audit).
  2. Select your Organization or Project from the resource browser.
  3. Click **Set Default Configuration**.
  4. Select **Admin Read**, **Data Read**, and **Data Write**.
  5. Click **Save**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(77).png?sv=2026-02-06&spr=https&st=2026-10-28T00%3A11%3A38Z&se=2026-10-28T01%3A11%3A38Z&sr=c&sp=r&sig=dnrkPchZ1PAggyGXJIEWUHyuAlgVjoSbByVX8%2BjgAks%3D)
2. From Zscaler MDR, select **I’ve enabled Data Access logs**.

> [!NOTE]
> **Note**: To prevent unnecessary charges from GCP, ensure to opt out of data storage. GCP automatically directs logs to a default storage sink for storage. For our purposes, we require only the routing of these logs, not their storage.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(78).png?sv=2026-02-06&spr=https&st=2026-10-28T00%3A11%3A38Z&se=2026-10-28T01%3A11%3A38Z&sr=c&sp=r&sig=dnrkPchZ1PAggyGXJIEWUHyuAlgVjoSbByVX8%2BjgAks%3D)
3. Click **Next**.

## **Step 3: Configure Telemetry routing to Zscaler MDR**

Zscaler MDR provides setup files to provision resources in your GCP environment to enable the integration process.

The integration process can be completed in two different ways:

- [Bash](https://redcanary.document360.io/doc/docs/integrate-google-cloud-platform-gcp-with-red-canary#bash:~:text=or%20Terraform.-,Bash,-Click%20setup%20files)
- [Terraform](https://redcanary.document360.io/doc/docs/integrate-google-cloud-platform-gcp-with-red-canary#bash:~:text=Click%20Save.-,Terraform,-If%20you%20selected)

From Zscaler MDR, choose the scope of your integration by selecting **Bash** or **Terraform**.

### Bash

1. Click **setup files** to download the files that Zscaler MDR has provided.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(79).png?sv=2026-02-06&spr=https&st=2026-10-28T00%3A11%3A38Z&se=2026-10-28T01%3A11%3A38Z&sr=c&sp=r&sig=dnrkPchZ1PAggyGXJIEWUHyuAlgVjoSbByVX8%2BjgAks%3D)
2. Unzip the files you downloaded in the previous step.
3. Navigate to your [GCP Cloud Shell](https://console.cloud.google.com/welcome?cloudshell=true), and then click **Activate Cloud Shell**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(80).png?sv=2026-02-06&spr=https&st=2026-10-28T00%3A11%3A38Z&se=2026-10-28T01%3A11%3A38Z&sr=c&sp=r&sig=dnrkPchZ1PAggyGXJIEWUHyuAlgVjoSbByVX8%2BjgAks%3D)
4. Upload the setup files to your [GCP Cloud Shell](https://console.cloud.google.com/welcome?cloudshell=true).

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(81).png?sv=2026-02-06&spr=https&st=2026-10-28T00%3A11%3A38Z&se=2026-10-28T01%3A11%3A38Z&sr=c&sp=r&sig=dnrkPchZ1PAggyGXJIEWUHyuAlgVjoSbByVX8%2BjgAks%3D)
5. Use the following command to grant execution permissions to the setup file:
  1. **For Organization**

`chmod +x organization_provisioning.sh`
  2. **For Project**

`chmod +x project_provisioning.sh`
6. Initiate the setup files with the following command to allocate the necessary resources for this integration:
  1. **For Organization**

`./organization_provisioning.sh --organization-id ORGANIZATION_ID --provisioning-project-id PROVISIONING_PROJECT_ID`
  2. **For Project**

`./project_provisioning.sh --provisioning-project-id PROJECT_ID`
7. If you receive an Authorization confirmation pop-up, click **Authorize**.
8. From Zscaler MDR, select **I’ve completed the provisioning steps**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(82).png?sv=2026-02-06&spr=https&st=2026-10-28T00%3A11%3A38Z&se=2026-10-28T01%3A11%3A38Z&sr=c&sp=r&sig=dnrkPchZ1PAggyGXJIEWUHyuAlgVjoSbByVX8%2BjgAks%3D)
9. Click **Save**.

### Terraform

1. If you selected Terraform, click **setup files** to download the files that Zscaler MDR has provided.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(83).png?sv=2026-02-06&spr=https&st=2026-10-28T00%3A11%3A38Z&se=2026-10-28T01%3A11%3A38Z&sr=c&sp=r&sig=dnrkPchZ1PAggyGXJIEWUHyuAlgVjoSbByVX8%2BjgAks%3D)
2. Integrate the Terraform template downloaded in the previous step into your Infrastructure as Code (IaaC) pipeline. Follow your pipeline’s standard process for deploying Terraform templates.
  1. It’s essential to edit the terraform files by replacing all instances of information contained in ‘<>’ with the necessary information. This step is crucial as it ensures the correct configuration for the organization or project-level integration. This process includes: - The Project ID of your provisioning Project - The region where resources will be created in your provisioning Project - Organization ID or Project ID - Project Number

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(84).png?sv=2026-02-06&spr=https&st=2026-10-28T00%3A11%3A38Z&se=2026-10-28T01%3A11%3A38Z&sr=c&sp=r&sig=dnrkPchZ1PAggyGXJIEWUHyuAlgVjoSbByVX8%2BjgAks%3D)
  2. Add the Terraform template to your IAC.
  3. From your command line, enter the code below: `terraform plan`

> [!NOTE]
> **Note**: When you plan your terraform, ensure that there are no unexpected errors, resources being created, or resources being deployed.
  4. From your command line, enter the code below: `terraform apply`
3. From Zscaler MDR, select **I’ve completed the provisioning steps**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(86).png?sv=2026-02-06&spr=https&st=2026-10-28T00%3A11%3A38Z&se=2026-10-28T01%3A11%3A38Z&sr=c&sp=r&sig=dnrkPchZ1PAggyGXJIEWUHyuAlgVjoSbByVX8%2BjgAks%3D)
4. Click **Save**.

## **Ingest Details**

Zscaler MDR ingests Google Cloud Platform (GCP) Audit logs from GCP environments. Additionally, Zscaler MDR integrates with GCP to scan your environment regularly to discover new projects and resources.

### Environments covered

- Google Cloud Platform

### Ingest details (GCP Cloud Audit Logs)

Zscaler MDR ingests the following type of activity from GCP Cloud Audit Logs:

- Admin Activity
- Data Access
- Policy Denied
- System Events

Currently, Zscaler MDR doesn’t collect Security Command Center alerts from GCP.

Finally, Zscaler MDR integrates with GCP to scan your environment regularly to discover new projects and resources. This integration is established via the Cloud Asset API and the IAM Custom Role configured during onboarding, enabling Zscaler MDR to read your GCP environment. The API method used is SearchAllResources, which requires the cloudasset.assets.searchAllResources permission, ensuring comprehensive visibility into your projects and resources.

## FAQ

---

### 

#### What permissions are Zscaler MDR asking for?

The ingest role is created with bindings to the following GCP predefined IAM roles:

| Roles | **Conditions** | Why does Zscaler MDR need this? |
| --- | --- | --- |
| **Attached to Zscaler MDR Ingest:** |
| `roles/logging.configWriter` | `resource.name == google_logging_sink.sink.id` | Allows Zscaler MDR to manage the Log Router Sink configuration for the Log Sink created for Telemetry Routing in [Step 3](/doc/docs/integrate-google-cloud-platform-gcp-with-red-canary#step-3-configure-telemetry-routing-to-red-canary) of the Integration Guide |
| `roles/pubsub.subscriber` | `subscription == pubsub_subsciption.id` | Allows Zscaler MDR to read from the subscription |
| **Attached to GCP Log Sink:** |
| `roles/pubsub.publisher` |  | Allows the Log Sink to publish messages to the topic |

Additionally, the following permissions are necessary for Zscaler MDR to perform specific actions, such as listing resources, getting sinks, monitoring the sink, getting subscriptions on a pub-sub topic, and listing things with the resource manager:

| Permission | Why does Zscaler MDR need this? |
| --- | --- |
| `cloudasset.assets.searchAllResources` | Allows Zscaler MDR to search information about your GCP Organization to enumerate projects and resources as they are added for monitoring, as well as License calculation purposes |
| `monitoring.timeSeries.list` | Allows Zscaler MDR to read filtered Cloud Monitoring measurements |
| `pubsub.topics.get` | Allows Zscaler MDR to see information about the ingest topic |
| `pubsub.topics.getIamPolicy` | Allows Zscaler MDR to validate that the permissions for managing the ingest topics is correctly configured |
| `pubsub.subscriptions.get` | Allows Zscaler MDR to see information about the subscription to the ingest topic for purposes of ingesting data |
| `resourcemanager.projects.get` | Allows Zscaler MDR to read GCP Project information to enumerate resources as they are added for monitoring, as well as License calculation purposes |
| `resourcemanager.projects.list` | Allows Zscaler MDR to list GCP Projects in the organization to enumerate resources as they are added for monitoring, as well as License calculation purposes |
| **For project scoped integrations only:** |
| `resourcemanager.projects.getIamPolicy` | Allows Zscaler MDR to validate access to the required permissions across the approved projects |
| **For organization scoped integrations only:** |
| `resourcemanager.folders.get` | Allows Zscaler MDR to read GCP Folder information to enumerate resources, and projects within an Organization organized by folders as they are added for monitoring, as well as License calculation purposes |
| `resourcemanager.folders.list` | Allows Zscaler MDR to list GCP Folders in the organization to enumerate resources, and projects within an Organization organized by folders as they are added for monitoring, as well as License calculation purposes |
| `resourcemanager.organizations.list` | Allows Zscaler MDR to list GCP Organizations in your account to enumerate projects and resources as they are added for monitoring, as well as License Calculation purposes |
| `resourcemanager.organizations.getIamPolicy` | Allows Zscaler MDR to validate access to the required permissions across the integrated organziation |

#### Is the roles/logging.configWriter required?

Yes, this role is required for Zscaler MDR to be able to manage the configuration for the Log Sink that’s used to route telemetry. Zscaler MDR is **only** able to manage the configuration for the Log Sink used in the integration.

#### How long does it take for the integration to show as Active after setup?

The integration will be created and set as “Provisioning”. Once it is sending telemetry to Zscaler MDR, the status will automatically update to “Active”. This process may take around 20 minutes.

#### Why does Zscaler MDR need to access the Log Sink resource in my GCP environment?

Zscaler MDR requires this access to manage the inclusive and exclusive filtering of logs for the Integration’s Log Sink. Zscaler MDR will then adjust the Log Sink’s filters to prioritize the routing of data that is useful for security analysis while balancing the amount of data egress from a customer’s environment.

#### What changes will Zscaler MDR make to my GCP environment with this access?

Zscaler MDR will only focus on making changes to the Integration’s Log Sink and its inclusive and exclusive filtering configuration to determine which logs are routed to Zscaler MDR.

#### What scope of access is granted to Zscaler MDR by the IAM Role Binding?

The access granted to Zscaler MDR is limited to the Log Sink used by the Integration to route logs to Zscaler MDR. This access is configured using a conditional role binding that only grants Zscaler MDR access to Log Sinks matching the expected resource naming pattern for the Integration.

- **Organization-level Integration** organizations/<YOUR_ORGANIZATION_ID>/sinks/red-canary-log-sink
- **Project-level Integration** projects/<YOUR_PROJECT_ID>/sinks/red-canary-log-sink

#### Why must I set my permissions to “Admin Read, Data Read, and Data Write?”

To emphasize the importance of Data Access logs, we have implemented a validation process that requires their enablement during Integration creation. This ensures that customers cannot proceed without activating this critical security measure.

#### What’s the cost of hosting the GCP Pub/Sub as part of this integration?

All environments are different and your expected data volumes will change the price significantly. To estimate costs, you can go to Google’s [Pub/Sub pricing page](https://cloud.google.com/pubsub/pricing) and work through your specific details.