Skip to main content

​
About Google Cloud Platform

Google Cloud Platform (GCP) is Google’s cloud — projects, IAM, Compute Engine, Cloud Storage, and every other Google Cloud service. The Serval integration lets workflows reach any GCP API through Serval’s authenticated proxy, and it ships two ready-to-install workflows for granting and revoking project IAM roles. Three built-in health checks confirm that authentication works, that the connection can see your projects, and that it can read IAM policy. Authentication: A Google Cloud service account key (JSON) that you create and control. Serval acts as that service account; what workflows can do is bounded by the IAM roles you grant it. Data sync: On-demand only. Nothing is synced into Serval on a schedule — workflows call Google Cloud at run time, and Serval mints short-lived access tokens automatically for each request.

​
What the GCP integration enables

Anything defined in the Google Cloud API reference can be accessed through Serval.

​
Get your credentials

You will create a dedicated service account, grant it the IAM roles your workflows need, and download a JSON key for it. Google’s official guide is Create service accounts.
1

Open Service Accounts

Sign in to the Google Cloud Console, select the project that should own the service account, and go to IAM & Admin → Service Accounts.
2

Create the service account

Click Create service account. Name it (for example, “serval-integration”), optionally add a description, and click Create and continue.
3

Grant IAM roles

Grant the roles your workflows need. For the built-in health checks and IAM workflows on this project, Viewer (roles/viewer) plus Project IAM Admin (roles/resourcemanager.projectIamAdmin) is a good starting point. To manage other projects, grant the service account roles on those projects too (their IAM page → Grant access, using the service account’s email).
The connection can only do what these roles allow. Granting broad roles like Owner gives Serval workflows the same reach — prefer the narrowest roles that cover your use cases.
4

Create a JSON key

Open the new service account, go to Keys → Add key → Create new key, choose JSON, and click Create. The key file downloads once — store it securely and delete local copies after connecting.
5

Enable the APIs your workflows call

At minimum, enable the Cloud Resource Manager API in the service account’s project (used by the health checks and IAM workflows). Enable any other APIs your workflows will call (Compute Engine, Cloud Storage, …) in the projects that own those resources.

​
Connect in Serval

1

Click Connect

Open the Google Cloud Platform integration in Serval and click Connect.
2

Paste the key

Optionally name the connection (it defaults to the service account’s project ID), paste the full contents of the downloaded JSON key file, and submit.
3

Validation

Serval validates the key against Google before saving — a disabled, deleted, or malformed key is rejected immediately with Google’s reason.
4

Run the health checks

Run the built-in health checks to confirm the connection can see your projects and read IAM policy.
For Google Workspace administration (users, groups, Drive, Gmail, Calendar), use the Google Workspace integration instead — those APIs require domain-wide delegation, which this integration does not use.

​
Rotating the key

Create a new JSON key for the same service account in Google Cloud IAM, then edit the connection in Serval and paste the new key. The connection’s identity is the service account’s email, so a replacement key must belong to the same service account — connecting a different service account is a new connection. After Serval accepts the new key, delete the old key in Google Cloud IAM.