Connecting a GCP account

Connecting Google Cloud is real in Cushy. It uses workload identity federation so Cushy can impersonate a read-only service account without any exported service-account key.

How the trust works

You configure a workload identity pool that trusts Cushy's federated identity and grants it permission to read your project's assets. Cushy then uses Cloud Asset Inventory to discover resources read-only. As with AWS, there are no long-lived secrets — you grant a federation you can revoke.

Connect

1. 1
   Start a connection

   On Cloud accounts (/clouds), choose Google Cloud and provide your project id (and project number).

2. 2
   Run the setup script

   Use the provided `gcloud` script to create the workload identity pool, the read-only service account, and the bindings that let Cushy impersonate it.

3. 3
   Verify

   Click Verify connection. On success the status becomes healthy and, as with any first healthy connection, the cutover fires and a first sync begins.

Advanced connection parameters

Open Advanced / real connection on the connect form to override the workload-identity pool id, provider id, and the connector service-account email (all default to the cloud-control names shown inline), and to record the regions to discover. These are stored in the connection's encrypted payload and are woven into the generated gcloud script so the commands you run match the connection exactly. A malformed pool/provider id or service-account email is rejected with a 400.

Cushy's trust anchors

The generated gcloud script pins your workload-identity pool to Cushy's OIDC issuer. Managers see the resolved issuer inline on the connect form, and the script renders the real issuer URL — onboarding is fully driven from the connect UI.

Health, duplicates and disconnect

GCP connections follow the same status vocabulary and the same verification semantics as AWS: exact missing permissions on a 409, transient errors as 503, duplicate connections rejected with the existing id, and non-destructive disconnect. To fully de-provision, remove the workload identity federation config in your project.