Error while adding GCP account (permission denied)

[FAllard]

Hi,

I am trying out RedLock using the trial and I am having issues trying to configure my GCP project. I followed the instructions carefully at https://docs.paloaltonetworks.com/redlock/redlock-admin/connect-your-cloud-platform-to-redlock/onboa...

I got permissions error. I even tried temporarily to add Project Owner and I still get the following error.

Any idea?

[kchen]

Could you post a screenshot of your Service Account's list of permissions?  Did you make sure to create a Custom Role that allows storage bucket access?

[FAllard]

See below. As you can see, I added a lot more roles in an attempt to make it work...

[kchen]

Not too sure what else it could be.  Ran a few tests to try different scenarios (key deleted from Service Account), but I could only get that message to reproduce if the Service Account did not have the necessary permissions on the project you are trying to onboard.  The only thing I can think of is that the permissions are added to a different project than the Service Account.  Is that the case here?

[FAllard]

I am not sure what you mean by that "the permissions are added to a different project than the Service Account". The permissions are added to a Service Account that is part of a project. I import the Service Account Key (JSON) which contains the project information. Nowhere in RedLock I specify a project or do I assign permissions in the project outside of the service account.

[lpingali]

Just as a check, if you remove the extra permissions you added, does it throw the 'Permission denied" error again? Keeping only the 3 required permissions:

1. ProjectViewer 
2. CustomRedLock Viewer 
3. Compute EngineCompute Security Admin

[FAllard]

That's the first thing I tried since I followed the instructions. I tried again and I get the same error. See my service account roles below: