> ## Documentation Index
> Fetch the complete documentation index at: https://docs.serval.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Cloud Platform

> Connect Google Cloud Platform to Serval so workflows can manage projects, IAM role grants, and any other GCP resource on demand.

## About Google Cloud Platform

Google Cloud Platform (GCP) is Google's cloud — projects, IAM, Compute Engine, Cloud Storage, and every other Google Cloud service. The Serval integration lets workflows reach any GCP API through Serval's authenticated proxy, and it ships two ready-to-install workflows for granting and revoking project IAM roles. Three built-in health checks confirm that authentication works, that the connection can see your projects, and that it can read IAM policy.

**Authentication:** A Google Cloud service account key (JSON) that you create and control. Serval acts as that service account; what workflows can do is bounded by the IAM roles you grant it.

**Data sync:** On-demand only. Nothing is synced into Serval on a schedule — workflows call Google Cloud at run time, and Serval mints short-lived access tokens automatically for each request.

## What the GCP integration enables

| Capability                                         | Description                                                                                                                                                                                                                                           |
| -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| GCP API requests from workflows                    | Workflows can make any read or write call to Google Cloud APIs — Cloud Resource Manager, IAM, Compute Engine, Cloud Storage, and any other service on a googleapis.com endpoint.                                                                      |
| Grant GCP Project IAM Role (installable workflow)  | Grants an IAM role (predefined like `roles/viewer`, or custom) to a user, group, or service account on a project. If the principal already holds the role, the workflow reports success with no action taken. Requires installer approval by default. |
| Revoke GCP Project IAM Role (installable workflow) | Removes an IAM role from a user, group, or service account on a project. If the principal does not hold the role, the workflow reports success with no action taken. Requires installer approval by default.                                          |
| Health checks                                      | Three built-in checks — "Test GCP Connection", "List Accessible GCP Projects", and "Read Project IAM Policy" — verify that the integration can authenticate, see your projects, and read IAM policy.                                                  |

Anything defined in the [Google Cloud API reference](https://cloud.google.com/apis/docs/overview) can be accessed through Serval.

## Get your credentials

You will create a dedicated service account, grant it the IAM roles your workflows need, and download a JSON key for it. Google's official guide is [Create service accounts](https://cloud.google.com/iam/docs/service-accounts-create).

<Steps>
  <Step title="Open Service Accounts">
    Sign in to the [Google Cloud Console](https://console.cloud.google.com), select the project that should own the service account, and go to **IAM & Admin → Service Accounts**.
  </Step>

  <Step title="Create the service account">
    Click **Create service account**. Name it (for example, "serval-integration"), optionally add a description, and click **Create and continue**.
  </Step>

  <Step title="Grant IAM roles">
    Grant the roles your workflows need. For the built-in health checks and IAM workflows on this project, **Viewer** (`roles/viewer`) plus **Project IAM Admin** (`roles/resourcemanager.projectIamAdmin`) is a good starting point. To manage other projects, grant the service account roles on those projects too (their **IAM** page → **Grant access**, using the service account's email).

    <Warning>
      The connection can only do what these roles allow. Granting broad roles like Owner gives Serval workflows the same reach — prefer the narrowest roles that cover your use cases.
    </Warning>
  </Step>

  <Step title="Create a JSON key">
    Open the new service account, go to **Keys → Add key → Create new key**, choose **JSON**, and click **Create**. The key file downloads once — store it securely and delete local copies after connecting.
  </Step>

  <Step title="Enable the APIs your workflows call">
    At minimum, enable the **Cloud Resource Manager API** in the service account's project (used by the health checks and IAM workflows). Enable any other APIs your workflows will call (Compute Engine, Cloud Storage, ...) in the projects that own those resources.
  </Step>
</Steps>

## Connect in Serval

<Steps>
  <Step title="Click Connect">
    Open the Google Cloud Platform integration in Serval and click **Connect**.
  </Step>

  <Step title="Paste the key">
    Optionally name the connection (it defaults to the service account's project ID), paste the full contents of the downloaded JSON key file, and submit.
  </Step>

  <Step title="Validation">
    Serval validates the key against Google before saving — a disabled, deleted, or malformed key is rejected immediately with Google's reason.
  </Step>

  <Step title="Run the health checks">
    Run the built-in health checks to confirm the connection can see your projects and read IAM policy.
  </Step>
</Steps>

<Note>
  For Google Workspace administration (users, groups, Drive, Gmail, Calendar), use the [Google Workspace](/sections/integrations/google-workspace) integration instead — those APIs require domain-wide delegation, which this integration does not use.
</Note>

## Rotating the key

Create a new JSON key for the same service account in Google Cloud IAM, then edit the connection in Serval and paste the new key. The connection's identity is the service account's email, so a replacement key must belong to the same service account — connecting a different service account is a new connection. After Serval accepts the new key, delete the old key in Google Cloud IAM.