GCP Authentication

Ventra reaches Google Cloud with a service account that carries read only access, or with Application Default Credentials present on the Ventra host. Save the identity once as a connection, then reuse it for platform runs and kits.

MethodWhat you provideWhen to use
Service Account KeyA service account JSON keyMost engagements. Ventra keeps the key encrypted on the server
Application Default CredentialsNothing inside VentraThe Ventra host already carries collector credentials through the metadata server or a mounted key
  1. Create a service account called ventra collector and a custom role with the read only methods, or bind the predefined read only roles.
  2. Grant the role on every project in scope, or bind once at the folder or organization level.
  3. Enable the Cloud Logging, Cloud Resource Manager, and Security Command Center APIs wherever you plan to collect.
  4. For the Service Account Key method, create a JSON key if your policy permits keys.
  5. Open Configuration, Authentication, add a connection, and select Google Cloud Platform.
  6. On Provider details, set the project ID. For several projects, list them separated by commas.
  7. On Authenticate, paste or upload the service account key, or choose Application Default Credentials.
  8. Run Validate connection to confirm Ventra can reach the project.

Prefer a dedicated collector service account over a human Google account. Rotate or delete the key when the engagement ends.

Deploy with infrastructure as code

or
  • Terraform code: Service account, custom role, and project IAM bindings.

Policy references