diff --git a/docs/images/app-connections/gcp/create-gcp-impersonation-method.png b/docs/images/app-connections/gcp/create-gcp-impersonation-method.png new file mode 100644 index 000000000..8d06e0d8b Binary files /dev/null and b/docs/images/app-connections/gcp/create-gcp-impersonation-method.png differ diff --git a/docs/images/app-connections/gcp/create-instance-service-account.png b/docs/images/app-connections/gcp/create-instance-service-account.png new file mode 100644 index 000000000..4a18e2ad2 Binary files /dev/null and b/docs/images/app-connections/gcp/create-instance-service-account.png differ diff --git a/docs/images/app-connections/gcp/create-service-account-credential.png b/docs/images/app-connections/gcp/create-service-account-credential.png new file mode 100644 index 000000000..acab54c31 Binary files /dev/null and b/docs/images/app-connections/gcp/create-service-account-credential.png differ diff --git a/docs/images/app-connections/gcp/create-service-account.png b/docs/images/app-connections/gcp/create-service-account.png new file mode 100644 index 000000000..cc26e04a2 Binary files /dev/null and b/docs/images/app-connections/gcp/create-service-account.png differ diff --git a/docs/images/app-connections/gcp/gcp-app-impersonation-connection.png b/docs/images/app-connections/gcp/gcp-app-impersonation-connection.png new file mode 100644 index 000000000..8f67478b9 Binary files /dev/null and b/docs/images/app-connections/gcp/gcp-app-impersonation-connection.png differ diff --git a/docs/images/app-connections/gcp/select-gcp-connection.png b/docs/images/app-connections/gcp/select-gcp-connection.png new file mode 100644 index 000000000..3b28869f9 Binary files /dev/null and b/docs/images/app-connections/gcp/select-gcp-connection.png differ diff --git a/docs/images/app-connections/gcp/service-account-grant-access.png b/docs/images/app-connections/gcp/service-account-grant-access.png new file mode 100644 index 000000000..d0e0df52b Binary files /dev/null and b/docs/images/app-connections/gcp/service-account-grant-access.png differ diff --git a/docs/images/app-connections/gcp/service-account-overview.png b/docs/images/app-connections/gcp/service-account-overview.png new file mode 100644 index 000000000..4e94d31f1 Binary files /dev/null and b/docs/images/app-connections/gcp/service-account-overview.png differ diff --git a/docs/images/app-connections/gcp/service-account-permission-overview.png b/docs/images/app-connections/gcp/service-account-permission-overview.png new file mode 100644 index 000000000..789085cfe Binary files /dev/null and b/docs/images/app-connections/gcp/service-account-permission-overview.png differ diff --git a/docs/images/app-connections/gcp/service-account-secret-sync-permission.png b/docs/images/app-connections/gcp/service-account-secret-sync-permission.png new file mode 100644 index 000000000..f3bf0d28c Binary files /dev/null and b/docs/images/app-connections/gcp/service-account-secret-sync-permission.png differ diff --git a/docs/integrations/app-connections/gcp.mdx b/docs/integrations/app-connections/gcp.mdx new file mode 100644 index 000000000..c443e61ae --- /dev/null +++ b/docs/integrations/app-connections/gcp.mdx @@ -0,0 +1,88 @@ +--- +title: "GCP Connection" +description: "Learn how to configure a GCP Connection for Infisical." +--- + +Infisical supports [service account impersonation](https://cloud.google.com/iam/docs/service-account-impersonation) to connect with your GCP projects. + + + Using the GCP integration on a self-hosted instance of Infisical requires configuring a service account on GCP and + configuring your instance to use it. + + + + ![Service Account Page](/images/app-connections/gcp/service-account-overview.png) + + + Create a new service account that will be used to impersonate other GCP service accounts for your app connections. + ![Service Account Page](/images/app-connections/gcp/create-instance-service-account.png) + + + Download the JSON key file for your service account. This will be used to authenticate your instance with GCP. + ![Service Account Page](/images/app-connections/gcp/create-service-account-credential.png) + + + 1. Copy the entire contents of the downloaded JSON key file. + 2. Set it as a string value for the `INF_APP_CONNECTION_GCP_SERVICE_ACCOUNT_CREDENTIAL` environment variable. + 3. Restart your Infisical instance to apply the changes. + 4. You can now use GCP integration with service account impersonation. + + + + + +## Configure Service Account for Infisical + + + + ![Service Account Page](/images/app-connections/gcp/service-account-overview.png) + + + Create a new service account with an ID that follows this requirement: + + Your service account ID must start with the first two sections of your Infisical organization ID. + + Example: + - Infisical organization ID: `df92581a-0fe9-42b5-b526-0a1e88ec8085` + - Required service account ID prefix: `df92581a-0fe9` + + ![Create Service Account](/images/app-connections/gcp/create-service-account.png) + + + + + Add the required permissions for secret syncs: + ![Assign Service Account Permission](/images/app-connections/gcp/service-account-secret-sync-permission.png) + + + + + On the newly created service account, assign the `Service Account Token Creator` role to the Infisical instance's service account. This allows the instance to impersonate this service account. + ![Service Account Page](/images/app-connections/gcp/service-account-grant-access.png) + + + + +## Setup GCP Connection in Infisical + + + + Navigate to the **App Connections** tab on the **Organization Settings** + page. ![App Connections + Tab](/images/app-connections/general/add-connection.png) + + + Select the **GCP Connection** option from the connection options modal. + ![Select GCP + Connection](/images/app-connections/gcp/select-gcp-connection.png) + + + Select the **Service Account Impersonation** method and click **Connect to + GCP**. ![Connect via GCP + impersonation](/images/app-connections/gcp/create-gcp-impersonation-method.png) + + + Your **GCP Connection** is now available for use. ![Impersonation GCP + Connection](/images/app-connections/gcp/gcp-app-impersonation-connection.png) + + diff --git a/docs/mint.json b/docs/mint.json index 2fc9f515c..9c728b319 100644 --- a/docs/mint.json +++ b/docs/mint.json @@ -351,7 +351,8 @@ "group": "Connections", "pages": [ "integrations/app-connections/aws", - "integrations/app-connections/github" + "integrations/app-connections/github", + "integrations/app-connections/gcp" ] } ] @@ -798,7 +799,8 @@ "pages": [ "api-reference/endpoints/app-connections/list", "api-reference/endpoints/app-connections/options", - { "group": "AWS", + { + "group": "AWS", "pages": [ "api-reference/endpoints/app-connections/aws/list", "api-reference/endpoints/app-connections/aws/available", @@ -809,7 +811,8 @@ "api-reference/endpoints/app-connections/aws/delete" ] }, - { "group": "GitHub", + { + "group": "GitHub", "pages": [ "api-reference/endpoints/app-connections/github/list", "api-reference/endpoints/app-connections/github/available", @@ -827,7 +830,8 @@ "pages": [ "api-reference/endpoints/secret-syncs/list", "api-reference/endpoints/secret-syncs/options", - { "group": "AWS Parameter Store", + { + "group": "AWS Parameter Store", "pages": [ "api-reference/endpoints/secret-syncs/aws-parameter-store/list", "api-reference/endpoints/secret-syncs/aws-parameter-store/get-by-id", @@ -840,7 +844,8 @@ "api-reference/endpoints/secret-syncs/aws-parameter-store/remove-secrets" ] }, - { "group": "GitHub", + { + "group": "GitHub", "pages": [ "api-reference/endpoints/secret-syncs/github/list", "api-reference/endpoints/secret-syncs/github/get-by-id",