From d9ace56e432845f85394f2db1f53d7862af22c58 Mon Sep 17 00:00:00 2001 From: Pepe Fagoaga Date: Wed, 21 Oct 2026 15:52:48 +0200 Subject: [PATCH] docs(googleworkspace): link required APIs, handle key creation policy (#13108) --- .../googleworkspace/authentication.mdx | 40 +++++++++++++++---- 1 file changed, 32 insertions(+), 8 deletions(-) diff --git a/docs/user-guide/providers/googleworkspace/authentication.mdx b/docs/user-guide/providers/googleworkspace/authentication.mdx index 049b4fb4ae..73c2ccd95d 100644 --- a/docs/user-guide/providers/googleworkspace/authentication.mdx +++ b/docs/user-guide/providers/googleworkspace/authentication.mdx @@ -35,21 +35,21 @@ The project is only used to host the Service Account — it does not need to hav ### Step 2: Enable Required APIs -In the [Google Cloud Console](https://console.cloud.google.com), select the target project and navigate to **APIs & Services → Library**. Search for and enable each of the following APIs: +In the [Google Cloud Console](https://console.cloud.google.com), select the target project and enable each of the following APIs: -| API | Required For | -|-----|--------------| -| **Admin SDK API** | Directory service checks (users, roles, domains) | -| **Cloud Identity API** | All service checks except Directory (domain-level application policies) | +| API | Service Name | Required For | +|-----|--------------|--------------| +| **[Admin SDK API](https://console.cloud.google.com/apis/library/admin.googleapis.com)** | `admin.googleapis.com` | Directory service checks (users, roles, domains) | +| **[Cloud Identity API](https://console.cloud.google.com/apis/library/cloudidentity.googleapis.com)** | `cloudidentity.googleapis.com` | All service checks except Directory (domain-level application policies) | For each API: -1. Search for the API name in the library -2. Click the API result +1. Open the link above, or navigate to **APIs & Services → Library** and search for the API name +2. Confirm the target project is selected in the project picker 3. Click **Enable** -Both APIs must be enabled in the same GCP project that hosts the Service Account. All service checks except Directory will return no findings if the Cloud Identity API is not enabled. +Both APIs must be enabled in the same GCP project that hosts the Service Account. All service checks except Directory will return no findings if the Cloud Identity API is not enabled. The Identity and Access Management (IAM) API (`iam.googleapis.com`) is a different API: enabling it does not replace the Cloud Identity API. ### Step 3: Create a Service Account @@ -77,6 +77,30 @@ The Service Account does not need any GCP IAM roles. Its access to Google Worksp This JSON key grants access to your Google Workspace organization. Never commit it to version control, share it in plain text, or store it in an insecure location. +#### Service Account Key Creation Is Disabled + +Organizations created on or after May 3, 2024 enforce the [Secure by Default](https://docs.cloud.google.com/resource-manager/docs/secure-by-default-organizations) organization policy `iam.managed.disableServiceAccountKeyCreation`, and the **Add key** dialog shows "Service account key creation is disabled". To create the key, a user with the Organization Policy Administrator role (`roles/orgpolicy.policyAdmin`) on the organization must turn off enforcement for the project that hosts the Service Account: + +1. In the Google Cloud Console, select the project and navigate to **IAM & Admin → Organization Policies** +2. Open **Disable service account key creation** (`iam.managed.disableServiceAccountKeyCreation`) and click **Manage policy** +3. Select **Override parent's policy**, click **Add a rule**, set **Enforcement** to **Off**, and click **Set policy** +4. Return to the Service Account **Keys** tab and create the key + +Alternatively, override the policy with the Google Cloud CLI: + +```yaml policy.yaml +name: projects/PROJECT_ID/policies/iam.managed.disableServiceAccountKeyCreation +spec: + rules: + - enforce: false +``` + +```console +gcloud org-policies set-policy policy.yaml +``` + +The constraint only blocks new key creation. Keys that already exist keep working, so enforcement can be restored once the key has been downloaded. + ### Step 5: Configure Domain-Wide Delegation in Google Workspace 1. Navigate to the [Google Workspace Admin Console](https://admin.google.com)