Skip to content

guides

Intended Documentation

Google Cloud (GCP) Connector Setup (Beta)

Connect Intended to Google Cloud. Create a service account with setIamPolicy and compute.instances.stop, paste the service-account email, private key, and project ID, and run Test connection. JWT-bearer OAuth; host-pinned to Google API hosts. Beta until validated against your live GCP project.

intermediate3 min readpartial
PartialSource: codeValidated: 2026-07-09

Google Cloud (GCP) Connector Setup (Beta)#

Connect Intended to Google Cloud so approved intents can add an IAM policy binding and stop Compute instances through the real GCP adapter (packages/execution-engine/src/adapters/gcp.ts). Auth is a service-account JWT-bearer OAuth exchange. Every write is Authority-Token-verified and ESCALATEs for approval under the starter policy.

This connector is Beta

The adapter is real and covered by hermetic (mocked-HTTP) tests that pass in CI with no live tenant. Live proof against your real GCP project is pending — treat GCP as Beta, not GA. See the Capability Truth Matrix.

What the adapter does#

PropertyValue
Actionsgcp.binding.add (Resource Manager setIamPolicy), gcp.instance.stop (Compute instances.stop)
AuthService-account JWT-bearer OAuth (grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer), then Authorization: Bearer <token>
Pinned hostsToken: oauth2.googleapis.com; IAM: cloudresourcemanager.googleapis.com; Compute: compute.googleapis.com
SSRF hardeningBlocks metadata.google.internal, 169.254.169.254, any 169.254.*, localhost, 127.0.0.1
Test connectionGET /v1/projects/{project} (projects.get)

The adapter signs an RS256 JWT from the service-account key, exchanges it for a short-lived access token at the pinned token host, and uses that token only in-request (never persisted). gcp.binding.add is a read-modify-write with etag optimistic concurrency (getIamPolicy then setIamPolicy).

Provider-side steps#

1. Create a service account#

  1. In the Google Cloud console, go to IAM & Admin → Service Accounts → Create service account.
  2. Grant it the least-privilege roles below on the target project.
  3. Under Keys → Add key → Create new key → JSON, download the key file.

2. Extract the three fields (client_email, private_key, project_id, all required)#

The adapter reads the three fields flat (not as a nested JSON blob). From the downloaded key JSON:

  • client_email → the client_email value, e.g. svc@your-project.iam.gserviceaccount.com.
  • private_key → the private_key value, the multi-line PEM block beginning -----BEGIN PRIVATE KEY-----. Paste it verbatim, including the header/footer lines.
  • project_id → your GCP project ID.

Least-privilege scope guidance#

  • Matrix permissions for this connector: resourcemanager.projects.setIamPolicy, compute.instances.stop.
  • Prefer a custom role granting exactly resourcemanager.projects.getIamPolicy + resourcemanager.projects.setIamPolicy (for gcp.binding.add) and compute.instances.stop + compute.instances.get (for gcp.instance.stop), plus resourcemanager.projects.get for the probe.
  • Do not grant roles/owner or roles/editor. The default JWT scope is https://www.googleapis.com/auth/cloud-platform, so IAM enforcement, not scope breadth, is your control.

Fields to paste into the connect dialog#

Open Connectors → Connect a system → Google Cloud → Configure auth:

Field labelKeyRequiredValue
Service Account Emailclient_emailYessvc@your-project.iam.gserviceaccount.com
Service Account Private Keyprivate_keyYesThe PEM private_key from the key JSON (textarea)
Project IDproject_idYesYour GCP project ID

Credentials are stored per-tenant, AES-256-GCM-encrypted, and never displayed back.

Run Test connection#

  1. Finish the connect wizard to store the credential.
  2. On the connector card, click Test connection.
  3. The adapter signs a JWT, exchanges it for an access token, and calls projects.get. A green result means the key material is valid and the service account can read the project.

Next steps#

Google Cloud (GCP) Connector Setup (Beta) | Intended