Google Cloud Platform (GCP)

Setup

To setup the GCP integration, navigate to the Integrations > Add integration > Google Cloud Platform and click Continue.

Troubleshooting

One or more users named in the policy do not belong to a permitted customer

You may see this error when you grant Oneleet’s principal the Service Account Token Creator role on your service account. It has two causes:

• Your organization restricts which identities can be granted IAM roles, using the iam.allowedPolicyMemberDomains organization policy. An Organization Policy Administrator needs to add Oneleet’s customer ID, C00pls1l8, to the allowed list. Policy changes can take up to 15 minutes to propagate.
• The principal doesn’t exist. Grant access to the principal shown on the setup screen, not one you copied during an earlier setup.

If you remove the Google Cloud integration, Oneleet stops using its principal. When you add the integration again, check that the principal on the setup screen matches the one you granted access to.

API key monitors show “No applicable assets”

Oneleet reads your API keys through the API Keys API. If the API is disabled in your project, the API key monitors have nothing to check.

Enable the API in your project, then rerun the monitors:

gcloud services enable apikeys.googleapis.com --project=YOUR_PROJECT_ID

You can also enable it in the Google Cloud Console under APIs & Services > Library > API Keys API.

Error 400: admin_policy_enforced

Encountering the Error 400: admin_policy_enforced error while connecting Google Workspace indicates that your organization’s policies are restricting access to your account data.

To fix this issue:

• Go to Google Admin and navigate to Security > Access and data control > API Controls > Manage Third Party App Access
• Click on Configure new app and choose OAuth app name or client ID
• Use the following Client ID for the verified Oneleet app:
  • 487371732991-7o3p4g81rmvdj7vj8sh9kh4rqfk5hhgc.apps.googleusercontent.com
• Set it as Trusted and click Configure at the bottom right
• Once these steps are completed, attempt to link Google Workspace again

Google Cloud VPC Setup

What is a VPC?

Virtual Private Clouds are virtual networks in GCP. They’re most commonly used to allow services to communicate with each other. VPCs allow you to control access to services and resources you host on GCP, and the firewall and routing systems prevent unauthorized network access.

Basic VPC Setup Guide

1. Open the Google Cloud Console.
2. Open “VPC networks” from the search bar.
3. Click “Create VPC Network” from the title bar.
4. Name your VPC (name can only contain letters, numbers, and -)
5. Add a new subnet
   • Subnets are a complex subject, for this guide just make sure the IP range isn’t already used within your organization / network.
   • Name your subnet something relevant to the VPC. Example: VPC-NAME-1
   • Select your preferred GCP region. Example: us-central1
   • Pick an IPv4 range, these will be the IP addresses assigned to services in the VPC. Make sure the range is available in your network. If you’re unfamiliar CIDR notation, 10.25.0.0/24 would be 10.25.0.0 to 10.25.0.255.
6. Enable “Flow logs” for additional security.
7. Click “Create” to complete the process.

Now you will be able to assign services to your VPC from the configuration UI of those services.