Google Cloud

gcloud config set project YOUR_PROJECT_ID

cat > ./lowerplane-setup.sh << 'SCRIPT'
#!/bin/bash
# LowerPlane GCP Setup — run in Google Cloud Shell
# Creates a service account, assigns roles, enables APIs, and downloads the key.
#
# Usage:
#   For single project:  just run the script
#   For multiple projects: edit EXTRA_PROJECTS below

SA="lowerplane-service-account"
KEY_FILE="$HOME/lowerplane-key.json"
CURRENT_PROJECT="$(gcloud config get-value project 2>/dev/null)"

# ── Validate project ─────────────────────────────────────────────────
if [ -z "$CURRENT_PROJECT" ] || [ "$CURRENT_PROJECT" = "(unset)" ]; then
echo ""
echo "  ✗ No GCP project is set. Run one of the following first:"
echo ""
echo "    gcloud config set project YOUR_PROJECT_ID"
echo ""
echo "  List your projects with: gcloud projects list"
echo ""
exit 1
fi

# Verify the project actually exists and is accessible
if ! gcloud projects describe "$CURRENT_PROJECT" > /dev/null 2>&1; then
echo ""
echo "  ✗ Project '$CURRENT_PROJECT' not found or not accessible."
echo "    Check the project ID and your permissions."
echo ""
exit 1
fi

# Add additional project IDs here (space-separated) to grant cross-project access
EXTRA_PROJECTS=""
PROJECTS=("$CURRENT_PROJECT" $EXTRA_PROJECTS)

SA_EMAIL="$SA@$CURRENT_PROJECT.iam.gserviceaccount.com"

echo ""
echo "═══════════════════════════════════════════"
echo "  LowerPlane GCP Integration Setup"
echo "═══════════════════════════════════════════"
echo "  Service Account: $SA"
echo "  Primary Project: $CURRENT_PROJECT"
echo "  SA Email:        $SA_EMAIL"
[ -n "$EXTRA_PROJECTS" ] && echo "  Additional:       $EXTRA_PROJECTS"
echo ""

# ── 1. Create service account ────────────────────────────────────────
echo "→ Step 1/4: Creating service account..."
if gcloud iam service-accounts describe "$SA_EMAIL" \
--project="$CURRENT_PROJECT" > /dev/null 2>&1; then
echo "  ✓ Already exists"
else
if gcloud iam service-accounts create "$SA" \
  --project="$CURRENT_PROJECT" \
  --display-name="LowerPlane" \
  --description="Read-only service account for LowerPlane compliance monitoring"; then
echo "  ✓ Created"
else
echo "  ✗ Failed to create service account. Check your permissions."
exit 1
fi
fi
echo ""

# ── 2. Assign roles to each project ─────────────────────────────────
echo "→ Step 2/4: Assigning IAM roles..."
ROLES=(
roles/viewer
roles/iam.securityReviewer
roles/compute.viewer
roles/monitoring.editor
)

for PROJECT in "${PROJECTS[@]}"; do
echo "  Project: $PROJECT"
for ROLE in "${ROLES[@]}"; do
if gcloud projects add-iam-policy-binding "$PROJECT" \
    --member="serviceAccount:$SA_EMAIL" \
    --role="$ROLE" \
    --quiet --no-user-output-enabled 2>/dev/null; then
  echo "    ✓ $ROLE"
else
  echo "    ✗ $ROLE (may need org-level access)"
fi
done
done
echo ""

# ── 3. Enable required APIs ──────────────────────────────────────────
echo "→ Step 3/4: Enabling APIs..."

APIS=(
cloudresourcemanager.googleapis.com
compute.googleapis.com
iam.googleapis.com
logging.googleapis.com
monitoring.googleapis.com
storage-component.googleapis.com
container.googleapis.com
sqladmin.googleapis.com
)

FAILED_APIS=()

for API in "${APIS[@]}"; do
echo -n "  Enabling $API... "
if gcloud services enable "$API" \
  --project="$CURRENT_PROJECT" \
  --quiet; then
echo "✓"
else
echo "✗"
FAILED_APIS+=("$API")
fi
done

echo ""

if [ ${#FAILED_APIS[@]} -eq 0 ]; then
echo "  ✓ All APIs enabled"
else
echo "  ⚠ Failed to enable the following APIs:"
for API in "${FAILED_APIS[@]}"; do
echo "     - $API"
done
fi

# ── 4. Create and download key ───────────────────────────────────────
echo "→ Step 4/4: Creating service account key..."

# Remove stale key file from a previous run
[ -f "$KEY_FILE" ] && rm -f "$KEY_FILE"

if gcloud iam service-accounts keys create "$KEY_FILE" \
--iam-account="$SA_EMAIL" \
--project="$CURRENT_PROJECT" 2>/dev/null; then
echo "  ✓ Key saved to $KEY_FILE"
else
echo "  ✗ Failed to create key. Verify the service account exists and you"
echo "    have the iam.serviceAccountKeys.create permission."
exit 1
fi

# Trigger browser download in Cloud Shell (no-op outside Cloud Shell)
cloudshell download "$KEY_FILE" 2>/dev/null || true

echo ""
echo "═══════════════════════════════════════════"
echo "  ✓ Setup complete!"
echo "═══════════════════════════════════════════"
echo ""
echo "  Next steps:"
echo "  1. Copy the key file contents:"
echo "     cat $KEY_FILE"
echo "  2. Go to LowerPlane → Integrations → GCP → Connect"
echo "  3. Enter project ID: $CURRENT_PROJECT"
[ -n "$EXTRA_PROJECTS" ] && echo "     (additional: $EXTRA_PROJECTS)"
echo "  4. Paste the full JSON key contents"
echo "  5. Click Connect"
echo ""
echo "  ⚠  Store the key securely. Delete it after pasting into LowerPlane:"
echo "     rm $KEY_FILE"
SCRIPT

chmod +x ./lowerplane-setup.sh
./lowerplane-setup.sh

cat ~/lowerplane-key.json

rm ~/lowerplane-key.json ./lowerplane-setup.sh