mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-23 12:31:54 +00:00
Andoni Alonso
122 lines
3.8 KiB
Markdown
122 lines
3.8 KiB
Markdown
# Getting Started With GCP on Prowler
|
|
|
|
## Prowler App
|
|
|
|
### Step 1: Get the GCP Project ID
|
|
|
|
1. Go to the [GCP Console](https://console.cloud.google.com/)
|
|
2. Locate the Project ID on the welcome screen
|
|
|
|
|
|
|
|
### Step 2: Access Prowler Cloud or Prowler App
|
|
|
|
1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](../prowler-app.md)
|
|
2. Go to "Configuration" > "Cloud Providers"
|
|
|
|
|
|
|
|
3. Click "Add Cloud Provider"
|
|
|
|
|
|
|
|
4. Select "Google Cloud Platform"
|
|
|
|
|
|
|
|
5. Add the Project ID and optionally provide a provider alias, then click "Next"
|
|
|
|
|
|
|
|
### Step 3: Set Up GCP Authentication
|
|
|
|
Choose the preferred authentication mode before proceeding:
|
|
|
|
**User Credentials (Application Default Credentials)**
|
|
|
|
* Quick scan as current user
|
|
* Uses Google Cloud CLI authentication
|
|
* Credentials may time out
|
|
|
|
**Service Account Key File**
|
|
|
|
* Authenticates as a service identity
|
|
* Stable and auditable
|
|
* Recommended for production
|
|
|
|
For detailed instructions on how to set up authentication, see [Authentication](./authentication.md).
|
|
|
|
6. Once credentials are configured, return to Prowler App and enter the required values:
|
|
|
|
For "Service Account Key":
|
|
|
|
- `Service Account Key JSON`
|
|
|
|
For "Application Default Credentials":
|
|
|
|
- `client_id`
|
|
- `client_secret`
|
|
- `refresh_token`
|
|
|
|
|
|
|
|
7. Click "Next", then "Launch Scan"
|
|
|
|
|
|
|
|
---
|
|
|
|
## Prowler CLI
|
|
|
|
### Credentials Lookup Order
|
|
|
|
Prowler follows the same credential search process as [Google authentication libraries](https://cloud.google.com/docs/authentication/application-default-credentials#search_order), checking credentials in this order:
|
|
|
|
1. [`GOOGLE_APPLICATION_CREDENTIALS` environment variable](https://cloud.google.com/docs/authentication/application-default-credentials#GAC)
|
|
2. [`CLOUDSDK_AUTH_ACCESS_TOKEN` + optional `GOOGLE_CLOUD_PROJECT`](https://cloud.google.com/sdk/gcloud/reference/auth/print-access-token)
|
|
3. [User credentials set up by using the Google Cloud CLI](https://cloud.google.com/docs/authentication/application-default-credentials#personal)
|
|
4. [Attached service account (e.g., Cloud Run, GCE, Cloud Functions)](https://cloud.google.com/docs/authentication/application-default-credentials#attached-sa)
|
|
|
|
???+ note
|
|
The credentials must belong to a user or service account with the necessary permissions.
|
|
For detailed instructions on how to set the permissions, see [Authentication > Required Permissions](./authentication.md#required-permissions).
|
|
|
|
???+ note
|
|
Prowler will use the enabled Google Cloud APIs to get the information needed to perform the checks.
|
|
|
|
### Configure GCP Credentials
|
|
|
|
To authenticate with GCP, use one of the following methods:
|
|
|
|
```console
|
|
gcloud auth application-default login
|
|
```
|
|
|
|
or set the credentials file path:
|
|
|
|
```console
|
|
export GOOGLE_APPLICATION_CREDENTIALS="/path/to/credentials.json"
|
|
```
|
|
|
|
These credentials must belong to a user or service account with the necessary permissions to perform security checks.
|
|
|
|
For more authentication details, see the [Authentication](./authentication.md) page.
|
|
|
|
### Project Specification
|
|
|
|
To scan specific projects, specify them with the following command:
|
|
|
|
```console
|
|
prowler gcp --project-ids <project-id-1> <project-id-2>
|
|
```
|
|
|
|
### Service Account Impersonation
|
|
|
|
For service account impersonation, use the `--impersonate-service-account` flag:
|
|
|
|
```console
|
|
prowler gcp --impersonate-service-account <service-account-email>
|
|
```
|
|
|
|
More details on authentication methods in the [Authentication](./authentication.md) page.
|