Docs · Connect your tools
Connect Google Cloud Platform
StackWeaver reads, and never changes, one Google Cloud project you choose, through a read-only service account you create yourself. This guide says what is read, which permissions the service account needs, how to create one, and how to remove it.
Last reviewed: 6 November 2026 · Describes what is live in production on that date. A result is evidence of what the provider returned at a time, nothing more.
1. What it collects
Once a day StackWeaver calls Google Cloud's API with the service account you provide, for one project you choose. Each result is kept as an Evidence Object with a SHA-256 fingerprint (platform), including results that fail.
| Check (as shown in the portal) | What it looks at |
|---|---|
| IAM policy open to the public internet | Whether any IAM binding on the project grants a role to allUsers or allAuthenticatedUsers |
| Firewall rules open to 0.0.0.0/0 | Whether any firewall rule allows ingress from the whole internet on a sensitive port |
| Cloud Storage buckets with public access | Whether any storage bucket in the project grants access to allUsers or allAuthenticatedUsers |
| Admin Activity and Data Access audit logs enabled | Whether Cloud Audit Logs are enabled for admin read, data read and data write |
2. What it does not do
- It does not read the contents of any bucket, service, or resource beyond the IAM and configuration settings above.
- It cannot change any setting: every API call it makes is read-only, and the service account it uses carries read permissions only.
- It does not say your project meets any standard. A result is what Google Cloud returned at a certain time.
- It only reads the one project you choose, never your whole organization.
3. The access it needs
Four read-only IAM permissions (Google Cloud), each used by one or more checks, granted through a custom IAM role with nothing else attached.
| Permission | Used for |
|---|---|
| resourcemanager.projects.getIamPolicy | IAM policy bindings open to the public internet, and the project's audit logging configuration |
| compute.firewalls.list | Firewall rules open to 0.0.0.0/0 |
| storage.buckets.list | Listing the project's Cloud Storage buckets |
| storage.buckets.getIamPolicy | Cloud Storage buckets with public access |
Who can connect. In StackWeaver, a workspace owner or admin saves the service account key. On Google Cloud's side, the service account is created by whoever has IAM admin access to your project; Google does not tell StackWeaver who that person is or what role they hold, so give the service account only the permissions above and nothing else.
4. Connect steps
- In Google's developer console, go to IAM & Admin, Roles, Create Role, and add exactly the four permissions listed above and nothing else.
- Go to IAM & Admin, Service Accounts, Create Service Account, and grant it the custom role you just created, scoped to the one project you want StackWeaver to check.
- Create a JSON key for that service account and download it.
- In StackWeaver, open Evidence, the Google Cloud Platform section, and paste the project id together with the full JSON key.
- Press Test connection. StackWeaver records the result.
5. Reading the results
| Label | What it means |
|---|---|
| Pass | The provider returned data that meets the threshold at that time |
| Fail | The provider returned data that does not meet the threshold |
| Not enabled | There was nothing to check |
| Could not check | StackWeaver could not read the data, or the permission is missing |
6. Disconnect and revoke
- In StackWeaver, press Disconnect on the Google Cloud Platform section. StackWeaver deletes the stored key.
- In Google's developer console, delete the service account (or its key) yourself — StackWeaver has no way to revoke a service account key on your behalf.
What remains. Past evidence stays in your workspace as the audit trail. Disconnecting does not delete it.
7. Troubleshooting
| Message | What to do |
|---|---|
| Google Cloud did not accept the access token | The service account key is wrong, has been deleted, or the approval was withdrawn |
| Google Cloud would not let StackWeaver read this project's IAM policy | The service account is missing one of the four permissions above, or has not been granted them on this specific project |
| Could not reach Google Cloud | A temporary network or API error; press Test connection again |
Still stuck? Use the contact page.
Sources and method
Statements about GitHub and Okta link to their own documentation. Statements about StackWeaver link to the page that says them, or are recorded in a claims ledger with the file in StackWeaver's repository that they come from. See oureditorial policy. Spotted an error? Use the contact page.