Granular Permissions for Service Account in GCP Instead of Basic Viewer Role

[bnilesh2003]

Context:
I'm currently working with Scout Suite for auditing and benchmarking our cloud infrastructure on Google Cloud Platform (GCP). The tool requires a service account with certain permissions. Typically, this would involve assigning the Viewer role at the organization level. However, due to security policies, I cannot grant such broad access.

Question:
I need to granulate the individual roles and permissions that can be used to replace the Viewer role. Specifically, I want to know which permissions and roles are necessary for the service account to function correctly with Scout Suite, without using the basic Viewer role.

Details:

• Service Account Usage: The service account will be used by Scout Suite for auditing purposes.
• Required Access: The service account needs read-only access to various resources across the organization.
• Constraints: Cannot use the basic Viewer role due to security policies.

Request:
Could anyone provide a detailed list of the granular permissions and roles that would collectively provide the same level of access as the Viewer role that will get the job done for auditing GCP? Any guidance on how to structure these permissions effectively would be greatly appreciated, Or any Idea of how can I get this information myself.

Thank you in advance for your help!

[kacper-polycloud]

Here are some I use at my work:

Granular Roles and Permissions for Scout Suite

BigQuery Metadata Viewer (roles/bigquery.metadataViewer):
Purpose: Allows Scout Suite to view metadata about BigQuery datasets, tables, and views.
Necessity: Essential if you want to audit BigQuery configurations and access controls.

Cloud Asset Viewer (roles/cloudasset.viewer):
Purpose: Enables Scout Suite to view metadata about all resources in your GCP organization. This is crucial for comprehensive auditing.
Necessity: Highly recommended, as it provides a broad view of your resource inventory.

Cloud Functions Viewer (roles/cloudfunctions.viewer):
Purpose: Allows Scout Suite to view Cloud Functions configurations and metadata.
Necessity: Required if you need to audit your serverless functions.

Compute Viewer (roles/compute.viewer):
Purpose: Grants read-only access to Compute Engine resources, including VMs, disks, and networks.
Necessity: Essential for auditing your compute infrastructure.

Google Cloud Storage Bucket Viewer / Storage Legacy Bucket Reader (roles/storage.legacyBucketReader) / Storage Insights Collector Service (roles/storage.insightsCollectorService) :
Purpose: There is no single role called "Google Cloud Storage Bucket Viewer". Instead the correct role is Storage Object Viewer (roles/storage.objectViewer). This grants read access to objects in Cloud Storage Buckets.
Necessity: Required to audit Cloud Storage configurations and access controls.

Security Reviewer (roles/iam.securityReviewer):
Purpose: Allows Scout Suite to view IAM policies, including roles, permissions, and service accounts.
Necessity: Crucial for auditing your IAM configurations and identifying potential security risks.

Stackdriver Accounts Viewer (roles/stackdriver.accounts.viewer):
Purpose: Allows Scout Suite to view Stackdriver (now Cloud Monitoring and Cloud Logging) accounts and configurations.
Necessity: Needed for auditing your monitoring and logging setup.

Other roles need custom list of permissions.