> For the complete documentation index, see [llms.txt](https://docs.enclaive.cloud/enclaive-multi-cloud-platform/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enclaive.cloud/enclaive-multi-cloud-platform/tutorials/settings/bring-your-own-subscription/google-cloud-platform.md). # Google Cloud Platform **OAuth connection to your GCP account** * sign in with Google and grant access through a consent screen. No long-lived keys change hands, and access can be revoked at any time from your Google account. ## Prerequisites ### Manual Configuration of Permissions To use this key in EMCP, ensure that your service account is assigned a role that grants the following permissions: ``` billing.resourceCosts.get compute.disks.create compute.firewallPolicies.create compute.firewallPolicies.delete compute.firewallPolicies.get compute.firewallPolicies.update compute.firewallPolicies.use compute.globalOperations.get compute.instances.create compute.instances.delete compute.instances.get compute.instances.setMetadata compute.instances.start compute.instances.stop compute.networks.create compute.networks.delete compute.networks.get compute.networks.setFirewallPolicy compute.networks.updatePolicy compute.projects.get compute.subnetworks.create compute.subnetworks.delete compute.subnetworks.get compute.subnetworks.use compute.subnetworks.useExternalIp compute.zones.get resourcemanager.projects.get ``` You can use predefined roles provided by GCP or create your own custom role and assign it the necessary access permissions. ## Enable Compute Engine API At this step, you need to select the **"Compute Engine"** tab and click the **"Enable"** button to enable the creation of VMs. ## Connect with OAuth 1. Go to the `Settings` page and open the `BYOS` tab. 2. Click `Create Cloud oAuth` and select **GCP** as the cloud provider. 3. Enter an **Auth name** (and optional tags), then click **Connect**. 4. You are redirected to the Google consent screen — sign in with the Google account that has access to your GCP project and approve the requested access. 5. Back in EMCP, finalize the connection by selecting the **default GCP project** that workloads should be created in. 6. The subscription appears as `ACTIVE` in your Cloud Keys list. {% hint style="info" %} The Google user who grants consent must hold the IAM permissions listed in [Manual Configuration of Permissions](/enclaive-multi-cloud-platform/tutorials/settings/bring-your-own-subscription/google-cloud-platform.md#manual-configuration-of-permissions) on the target project — for example via the predefined roles `roles/compute.admin` and `roles/iam.serviceAccountUser`. {% endhint %} To run a workload in your own GCP project, select this subscription when creating a Virtual Machine. The resources are provisioned in your project, on your billing. ### What happens under the hood 1. **Consent** — EMCP uses the OAuth 2.0 authorization-code flow. Google returns a short-lived access token and a refresh token; your Google password is never seen by EMCP. 2. **Storage** — the tokens are stored encrypted in the vHSM, in a namespace private to your team. Only the subscription owner can manage them. 3. **Usage** — before each Terraform run, EMCP refreshes the access token automatically and provisions the resources in your selected project. Unlike static keys, the credentials expire within an hour and renew themselves. 4. **Revocation** — deleting the subscription removes the tokens from the vHSM. You can additionally revoke EMCP's access at any time from your [Google account permissions](https://myaccount.google.com/permissions).
## ##