Ctrlk
DocumentationTutorialsTry Cloud
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Google Cloud Platform

Connect your GCP account to EMCP with OAuth (recommended) or a service account key, and run confidential workloads in your own GCP project.

There are two ways to connect your GCP account to EMCP:

  • OAuth (recommended) — sign in with Google and grant access through a consent screen. No long-lived keys change hands, and access can be revoked at any time from your Google account.

  • Service account key — create and upload a JSON key, described further below.

Connect with OAuth (recommended)

  1. Go to the Settings page and open the BYOS tab.

  2. Click Create Cloud oAuth and select GCP as the cloud provider.

  3. Enter an Auth name (and optional tags), then click Connect.

  4. You are redirected to the Google consent screen — sign in with the Google account that has access to your GCP project and approve the requested access.

  5. Back in EMCP, finalize the connection by selecting the default GCP project that workloads should be created in.

  6. The subscription appears as ACTIVE in your Cloud Keys list.

The Google user who grants consent must hold the IAM permissions listed in Manual Configuration of Permissions on the target project — for example via the predefined roles roles/compute.admin and roles/iam.serviceAccountUser.

To run a workload in your own GCP project, select this subscription when creating a Virtual Machine. The resources are provisioned in your project, on your billing.

What happens under the hood

  1. Consent — EMCP uses the OAuth 2.0 authorization-code flow. Google returns a short-lived access token and a refresh token; your Google password is never seen by EMCP.

  2. Storage — the tokens are stored encrypted in the vHSM, in a namespace private to your team. Only the subscription owner can manage them.

  3. Usage — before each Terraform run, EMCP refreshes the access token automatically and provisions the resources in your selected project. Unlike static keys, the credentials expire within an hour and renew themselves.

  4. Revocation — deleting the subscription removes the tokens from the vHSM. You can additionally revoke EMCP's access at any time from your Google account permissions.

Connect with a Service Account key (alternative)

The sections below describe the alternative path: creating a service account JSON key and adding it to EMCP manually.

Prerequisites

In Google Cloud Platform (GCP), a service account key is a type of credential used to authenticate and authorize applications and virtual machines (VMs) to access GCP services programmatically. Service account keys are associated with service accounts, which are identities used by applications running on GCP to interact with other services and resources securely.

Service Account Keys: To authenticate as a service account, applications typically use a service account key, which is a JSON file that contains authentication credentials. This key file is downloaded from GCP and is used by the application to authenticate itself when making API requests.

Create Service Account Keys

In this section, we will create a Service Account and a Service Account Keys that we will use in EMCP.

  1. Sign in to the GCP console.

  2. Next, you need to navigate to the "Service Accounts" tab.

  3. After that, you need to create a Service Account for EMCP. To do this, click on the "+ CREATE SERVICE ACCOUNT" button.

  4. After successfully creating the Service Account, you will be able to see the account listed in the table displaying all accounts.

  5. Next, you need to navigate to the page with detailed information about the Service Account you created earlier. To do this, click on the email address associated with the Service Account in the table.

  6. After you navigate to the detailed information page of the Service Account, you should select the 'KEYS' tab.

  7. The next step is to select the "ADD KEY" button and then choose "Create new key" from the dropdown list. In the modal window that appears, select the key format (JSON) and click the "CREATE" button.

  8. After doing this, the key will be automatically generated and downloaded to your device.

Manual Configuration of Permissions

To use this key in EMCP, ensure that your service account is assigned a role that grants the following permissions:

You can use predefined roles provided by GCP or create your own custom role and assign it the necessary access permissions.

Enable Compute Engine API

At this step, you need to select the "Compute Engine" tab and click the "Enable" button to enable the creation of VMs.

Add credentials

The final step is to add the key that you previously created and downloaded into EMCP: go to the Settings page, open the BYOS tab, select GCP, and upload/paste the service account JSON key. After validation, the subscription appears as ACTIVE and can be selected when creating resources — exactly as with the OAuth flow above.

Last updated