Overview
LowerPlane connects to Google Cloud Platform using a service account with read-only IAM roles. This provides visibility into your GCP security posture without any write access.Services Monitored
| GCP Service | What LowerPlane Collects |
|---|---|
| Security Command Center | Security findings and vulnerability reports |
| Cloud Asset Inventory | Complete resource inventory across all projects |
| IAM | Service accounts, roles, and policy bindings |
| Cloud Logging | Audit log configuration and export settings |
| Cloud Storage | Bucket IAM and encryption settings |
| Compute Engine | Firewall rules and instance configurations |
| GKE | Kubernetes cluster security settings |
Step 1: Open Google Cloud Console
Go to https://console.cloud.google.com/ and select your project from the top dropdown.Step 2: Create Service Account
- Navigate to IAM & Admin
- Select Service Accounts
- Click Create Service Account
- Name:
lowerplane-readonly - Description:
Read-only service account for LowerPlane compliance monitoring
Step 3: Assign Read-Only Roles
Add the following roles to the service account:| Role | Purpose |
|---|---|
Viewer (roles/viewer) | Read-only access to all resources in the project |
Security Reviewer (roles/iam.securityReviewer) | Read IAM policies and service account details |
Security Center Findings Viewer (roles/securitycenter.findingsViewer) | Read Security Command Center findings (if enabled) |
Step 4: Create Service Account Key
- Open the service account you created
- Go to the Keys tab
- Click Add Key
- Select Create new key
- Key type: JSON
Step 5: Enable Required APIs
Navigate to APIs & Services then Library and enable the following APIs:| API | Purpose |
|---|---|
| Cloud Resource Manager API | List projects and organizations |
| Cloud Asset API | Inventory all resources |
| Security Command Center API | Security findings (if available on your plan) |
| IAM API | Service account and policy details |
| Cloud Logging API | Audit log configuration |
Step 6: Connect in LowerPlane
- Go to Integrations in LowerPlane
- Find Google Cloud and click Connect
- Upload the JSON key file or paste its contents
- Click Connect
Multi-Project Setup
For organizations with multiple GCP projects:- Single project: Create the service account in that project with the roles above
- Multiple projects: Create the service account in one project, then grant the Viewer role in each additional project
- Organization-level: Create the service account and grant the Viewer role at the organization level for visibility across all projects
Automated Tests
When GCP is connected, LowerPlane automatically creates and runs tests including:- Organization policy constraints are enforced
- VPC firewall rules do not allow unrestricted access
- Cloud Storage buckets are not publicly accessible
- Cloud Storage bucket encryption is enabled
- Service account keys are rotated within 90 days
- Audit logging is configured for all services
- Binary authorization is enabled for GKE clusters