GCP Agentless Scanning Setup

[SKodi]

Hi,

Has anyone tried onboarding GCP account for agentless scanning? During the setup it is asking for GCP Service account and API token details but we can only generate json keys for service accounts. Any idea how to get this setup done?

Thanks.

[USheikh]

Hi SKodi,

Based on the error, it looks like the account does not have sufficient permissions.

Can you verify using the downloaded the permission template if the account has the permission?

To understand more about the downloaded template files and how they are used, refer to https://docs.paloaltonetworks.com/prisma/prisma-cloud/22-06/prisma-cloud-compute-edition-admin/confi...

[SKodi]

Hi Umer,

compute.zones.list is mentioned in the included permissions on the downloaded permission template.

[musiddiqui]

Hi SKodi,

I hope you are doing well. As the scope of this issue is going beyond the chat messages, can you please open a support ticket and one of the TAC Engineers will be able to assist you?

Regards,

[kfirdaus]

Hi SKodi,

It appears to be related to missing permissions for Google managed service accounts. Can you please check IAM policies for your project and verify if the permissions are listed?

[musiddiqui]

Hi SKodi,

I hope you are doing well. To answer your question about the template, Prisma Cloud validates the specified credentials and the download raises an error if the credentials are incorrect. To understand more about the downloaded template files and how they are used, refer to the permission templates. 

Please let me know if you have any other questions.