Google Cloud integration
Secorvia connects to a Google Cloud project with a read-only service account key, builds an inventory of what it can see, and maps how resources and identities connect, so findings can be ranked by what an attacker could reach.
What Secorvia reads from Google Cloud, and what it finds
The Google Cloud services Secorvia lists on its homepage are GKE, BigQuery, Cloud IAM, Cloud Storage and Cloud Run. It reads how those resources are configured, which identities can act on them and how they relate to each other. It does not read what is inside them, so stored objects and table rows stay where they are.
What comes back is an inventory, a list of findings and a graph. The inventory records each resource's ID, region, tags and raw metadata, with the times it was first and last seen, and it can be filtered to GCP and to a single project. Each finding carries its evidence, an explanation of why it matters, remediation guidance and its compliance impact. From the Starter plan the graph is used to rank attack paths, and those paths can cross providers when you connect more than one. The compliance views list the CIS Google Cloud Foundations benchmark among their frameworks, and compliance starts on the Starter plan. Attack path analysis explains how paths are built and ranked.
What connecting Google Cloud takes
Google Cloud uses a service account key. Before you start, have the project ID and a service account JSON key for that project, and treat the complete JSON as a secret. You create the service account in your own project, so you decide how narrow its access is and you can disable the key whenever you like.
In Secorvia you open Cloud Accounts, choose Add Cloud Account, name the connection and pick GCP: Service Account Key. You enter the project ID, which is the actual project ID and not its display name or its numeric project number. The form expects 6 to 30 lowercase letters, digits or hyphens, starting with a letter. Then you paste the complete downloaded key file, with none of its fields removed, and enter a region if one applies. The key is encrypted before it is stored and is not shown again after you save. Keep it out of screenshots, tickets and source control.
Saving the connection starts the first scan automatically. The account's detail page shows its connection status, with links to scan history, inventory and findings for that project. When the first scan completes, review the inventory filtered to GCP and to the selected account. The Google Cloud connection guide shows each screen. If the form rejects the JSON, the guide's advice is to paste the full key, including its braces and escaped newlines.
Each project is connected as its own cloud account, so the plan's per-provider limit applies: one on Free, three on Starter, 25 on Growth and no fixed limit on Enterprise.
What Secorvia does not do on Google Cloud
Secorvia is read-only. It never asks for write access to your infrastructure, and a read-only credential cannot change your environment. It reports problems and does not fix them, so a remediation is a change you make in Google Cloud, followed by a new scan to confirm it.
What Secorvia can see is bounded by what you grant the service account and by the project you connect. When a scan cannot read resources, the guide tells you to check the service account's permissions and project scope with your Google Cloud administrator. The guide describes the fields and does not include a fixed list of roles to assign. If your security team wants the exact permission list before approving the connection, the security page says how to ask for it. A scan is also a snapshot of the project at the time it ran, not a live feed.
A service account key is a long-lived secret. If your concern is which outside identities can reach your Google Cloud and other accounts, the open source tool frontdoor checks federated trust, including workload identity federation. It is separate from the platform and needs no account.
Frequently asked questions
What credential does Google Cloud use?
A service account key. You paste the complete JSON key file and enter the project ID in the Add Cloud Account form.
Does Secorvia change anything in my Google Cloud project?
No. Secorvia never asks for write access. It reads configuration and metadata with a read-only service account that you create and can disable at any time.
Which Google Cloud services does Secorvia cover?
The homepage lists GKE, BigQuery, Cloud IAM, Cloud Storage and Cloud Run. The inventory after your first scan shows what was collected for your project.
Why does the form reject my project ID?
Use the actual project ID, not the display name or the numeric project number. It must be 6 to 30 lowercase letters, digits or hyphens, starting with a letter.
How many Google Cloud projects can I connect?
One on Free, three on Starter and 25 on Growth. Enterprise has no fixed limit. Each project counts as one cloud account.