GCP Permissions

GCP access is granted as a custom role, or as predefined read only roles that cover the same API methods. Log collectors read Cloud Logging. When those logs are archived to Cloud Storage, the collector also needs bucket and object read on the archive buckets.

Ventra collectors need read only access across 27 service areas. Each area maps to one or more collectors in Acquire, and the full action list lives in the downloadable policy files below.

• Project snapshot (1 actions)
• IAM snapshot (5 actions)
• Cloud Audit admin (2 actions)
• Cloud Audit system (2 actions)
• Cloud Audit data (2 actions)
• Login events (2 actions)
• Logging posture (3 actions)
• VPC flow logs (3 actions)
• Firewall logs (2 actions)
• Cloud NAT (2 actions)
• Network posture (5 actions)
• Cloud load balancing (2 actions)
• Cloud CDN (2 actions)
• API Gateway (2 actions)
• Cloud DNS (2 actions)
• Cloud Armor (3 actions)
• VM logs (2 actions)
• GCE and disks (3 actions)
• Cloud Functions (2 actions)
• GKE audit (3 actions)
• Cloud Storage access (2 actions)
• BigQuery audit (2 actions)
• Cloud SQL (2 actions)
• Secret Manager (2 actions)
• Security Command Center (1 actions)
• Cloud Monitoring (3 actions)
• Log export — Cloud Storage (3 actions)

Download the plain text permission list for client review. The kit ships a narrowed copy under the iam folder, scoped to the collectors you selected.