> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# GCP
> Connect GCP to CodeAnt for Cloud Security Posture Management (CSPM)
### GCP Authentication
CodeAnt's GCP scanner needs read-only access to the project you want to scan. The recommended way to grant that access is a dedicated **service account** with a minimal set of roles plus a small custom role for one extra permission the predefined roles don't cover.
At a glance, the service account needs:
| Role | Why it is needed |
| - | - |
| `roles/viewer` | Read project metadata and most resource configurations. |
| `roles/serviceusage.serviceUsageConsumer` | Inspect which APIs/services are enabled on the project. |
| `CodeAntRole` (custom) | Adds `storage.buckets.getIamPolicy`, which is required to evaluate bucket-level IAM and is not granted by `roles/viewer`. |
You'll then download a JSON key for the service account and paste it into CodeAnt.
CodeAnt scans one project per saved credential. To scan multiple projects, grant the service account the same roles in each project (attaching it at the folder or organization level does this in one step), then save each **Project ID** with its key in CodeAnt.
#### 1. Enable the IAM API
The role and service-account steps below (and the scanner itself) depend on Google's IAM API. Run this once in [Cloud Shell](https://shell.cloud.google.com), replacing `` with the ID shown in the project picker at the top of the console:
```bash theme={"theme":"css-variables"}
gcloud services enable iam.googleapis.com --project
```
CodeAnt authenticates with the service account's JSON key, so quota is billed to the key's own project automatically. You only need `gcloud auth application-default set-quota-project` (or the `GOOGLE_CLOUD_QUOTA_PROJECT` environment variable) when running tooling locally with your own user credentials.
#### 2. Create the custom `CodeAntRole`
The custom role exists only to add a single granular permission that `roles/viewer` does not include.
1. In the Google Cloud Console go to **IAM and admin → Roles** and click **+ Create custom role**.
2. Fill in the role details:
* **Title:** `CodeAntRole`
* **ID:** `codeant_role`
* **Description:** `Custom role used by CodeAnt CSPM to read bucket IAM policies.`
* **Role launch stage:** `General Availability`
3. Click **+ Add permissions**, filter the picker by role **Storage Admin**, find `storage.buckets.getIamPolicy`, tick it, and click **Add**.
4. Click **Create** to save the role.
Prefer `gcloud`? You can create the same role from your terminal:
```bash theme={"theme":"css-variables"}
PROJECT_ID=
gcloud iam roles create codeant_role --project $PROJECT_ID \
--title="CodeAntRole" \
--description="Custom role used by CodeAnt CSPM to read bucket IAM policies." \
--permissions="storage.buckets.getIamPolicy" \
--stage=GA
```
#### 3. Create the service account
1. Navigate to **IAM and admin → Service accounts** and click **+ Create service account**.
2. Use these details:
* **Service account name:** `codeant-cspm`
* **Service account ID:** `codeant-cspm` (the email becomes `codeant-cspm@.iam.gserviceaccount.com`)
* **Description:** `Service account used by CodeAnt CSPM to scan this project.`
3. Click **Create and continue** to move to the permissions step.
#### 4. Grant the roles
On the **Permissions (optional)** step, attach all three roles to the service account. Each lives in a different part of the role picker:
* `CodeAntRole` - click **Select a role**, then **Quick access → Custom**
* `Viewer` - click **+ Add another role**, then **Basic**
* `Service Usage Consumer` - click **+ Add another role**, then type it into the picker's search box (it is under the *Service Usage* product)
Click **Continue**, then **Done**.
The same bindings via `gcloud`:
```bash theme={"theme":"css-variables"}
PROJECT_ID=
SA=codeant-cspm
SA_EMAIL="${SA}@${PROJECT_ID}.iam.gserviceaccount.com"
gcloud iam service-accounts create $SA --project $PROJECT_ID \
--description="Service account used by CodeAnt CSPM to scan this project." \
--display-name="CodeAnt CSPM"
for ROLE in \
"projects/${PROJECT_ID}/roles/codeant_role" \
"roles/viewer" \
"roles/serviceusage.serviceUsageConsumer"; do
gcloud projects add-iam-policy-binding $PROJECT_ID \
--member="serviceAccount:${SA_EMAIL}" \
--role="$ROLE"
done
```
#### 5. Generate a JSON key
1. Open the service account you just created, switch to the **Keys** tab, click **Add key → Create new key**.
2. Choose **JSON** and click **Create**. The key file is downloaded to your machine - store it somewhere safe; it can't be re-downloaded.
Via `gcloud`:
```bash theme={"theme":"css-variables"}
PROJECT_ID=
SA_EMAIL="codeant-cspm@${PROJECT_ID}.iam.gserviceaccount.com"
gcloud iam service-accounts keys create ./codeant-cspm.json \
--iam-account="${SA_EMAIL}"
```
The JSON key grants full access as the service account. Treat it like a password: never commit it to source control, and rotate or delete it when it's no longer needed.
### Connect GCP to CodeAnt
1. In the CodeAnt UI, navigate to **Settings → Cloud Security → GCP**. The setup wizard walks through the same steps as this guide.
2. On the **Connect your project** step, enter the **Project ID**, paste the full contents of the JSON key, and click **Save**.
The Project ID is inside the service account email you just created - `codeant-cspm@.iam.gserviceaccount.com`. It is also shown in the project picker at the top of the Google Cloud console, next to the project's display name (the machine-style id, not the name itself).
### Start a Scan
* Go to **Cloud Security → Start a New Scan** and pick your GCP connection.
* Scans typically complete within 15–20 minutes, after which findings appear in the dashboard.
Agentless VM Scanning is **not supported for GCP**. See [VM Scanning](/cloud_security/vm-scanning) for the providers it currently covers.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.