mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
103 lines
4.8 KiB
Plaintext
103 lines
4.8 KiB
Plaintext
---
|
|
title: "GCP Connection"
|
|
description: "Learn how to configure a GCP Connection for Infisical."
|
|
---
|
|
|
|
Infisical supports [service account impersonation](https://cloud.google.com/iam/docs/service-account-impersonation) to connect with your GCP projects.
|
|
|
|
<Accordion title="Self-Hosted Instance">
|
|
Using the GCP integration on a self-hosted instance of Infisical requires configuring a service account on GCP and
|
|
configuring your instance to use it.
|
|
|
|
<Steps>
|
|
<Step title="Enable the IAM Service Account Credentials API">
|
|
|
|
</Step>
|
|
<Step title="Navigate to IAM & Admin > Service Accounts in Google Cloud Console">
|
|
|
|
</Step>
|
|
<Step title="Create a Service Account">
|
|
Create a new service account that will be used to impersonate other GCP service accounts for your app connections.
|
|
|
|
|
|
Press "DONE" after creating the service account.
|
|
</Step>
|
|
<Step title="Generate Service Account Key">
|
|
Download the JSON key file for your service account. This will be used to authenticate your instance with GCP.
|
|
|
|
</Step>
|
|
<Step title="Configure Your Instance">
|
|
1. Copy the entire contents of the downloaded JSON key file.
|
|
2. Set it as a string value for the `INF_APP_CONNECTION_GCP_SERVICE_ACCOUNT_CREDENTIAL` environment variable.
|
|
3. Restart your Infisical instance to apply the changes.
|
|
4. You can now use GCP integration with service account impersonation.
|
|
</Step>
|
|
</Steps>
|
|
|
|
</Accordion>
|
|
|
|
## Configure Service Account for Infisical
|
|
|
|
<Steps>
|
|
<Step title="Navigate to IAM & Admin > Service Accounts in Google Cloud Console">
|
|
|
|
</Step>
|
|
<Step title="Create Service Account">
|
|
Create a new service account with an ID that follows this requirement:
|
|
|
|
Your service account ID must end with the first two sections of your Infisical organization ID.
|
|
|
|
Example:
|
|
- Infisical organization ID: `df92581a-0fe9-42b5-b526-0a1e88ec8085`
|
|
- Required service account ID suffix: `df92581a-0fe9`
|
|
|
|
|
|
</Step>
|
|
<Step title="Configure Service Account Permissions">
|
|
<Tabs>
|
|
<Tab title="Secret Sync">
|
|
Add the required permissions for secret syncs:
|
|
|
|
</Tab>
|
|
</Tabs>
|
|
After configuring the appropriate roles, press "DONE".
|
|
</Step>
|
|
<Step title="Enable Service Account Impersonation">
|
|
To enable service account impersonation, you'll need to grant the **Service Account Token Creator** role to the Infisical instance's service account. This configuration allows Infisical to securely impersonate the new service account.
|
|
- Navigate to the IAM & Admin > Service Accounts section in your Google Cloud Console
|
|
- Select the newly created service account
|
|
- Click on the "PERMISSIONS" tab
|
|
- Click "Grant Access" to add a new principal
|
|
|
|
If you're using Infisical Cloud US, use the following service account: infisical-us@infisical-us.iam.gserviceaccount.com
|
|
|
|
If you're using Infisical Cloud EU, use the following service account: infisical-eu@infisical-eu.iam.gserviceaccount.com
|
|
|
|
|
|
</Step>
|
|
|
|
</Steps>
|
|
|
|
## Setup GCP Connection in Infisical
|
|
|
|
<Steps>
|
|
<Step title="Navigate to App Connections">
|
|
Navigate to the **App Connections** page in the desired project. 
|
|
</Step>
|
|
<Step title="Add Connection">
|
|
Select the **GCP Connection** option from the connection options modal.
|
|
|
|
</Step>
|
|
<Step title="Authorize Connection">
|
|
Select the **Service Account Impersonation** method and click **Connect to
|
|
GCP**. 
|
|
</Step>
|
|
<Step title="Connection Created">
|
|
Your **GCP Connection** is now available for use. 
|
|
</Step>
|
|
</Steps>
|