Google Cloud Platform provider permissions - List of Google Cloud Platform (GCP) permissions for use during Cortex Cloud onboarding to enable continuous monitoring in your cloud environment. - Administrator Guide - Cortex CLOUD

Cortex Cloud Runtime Security Documentation
Product
Cortex Cloud Application Security > Cortex CLOUD
License
Cloud Runtime Security
Creation date
2024-12-24
Last date published
2026-06-10
Category
Administrator Guide
Abstract

List of Google Cloud Platform (GCP) permissions for use during Cortex Cloud onboarding to enable continuous monitoring in your cloud environment.

When onboarding Google Cloud Platform (GCP), Cortex Cloud creates an authentication template that requests the permissions needed for monitoring your cloud environment. Permissions are organized by security capability, then by the role that contains them. Each role lists its assignment scope and the specific permissions it grants:

Each role is bound at the scope you configure during onboarding (organization, folder, or project), with the following exceptions:

  1. The audit-log Pub/Sub publisher and subscriber roles (roles/pubsub.publisher, roles/pubsub.subscriber) are bound only to the single Pub/Sub topic and subscription Cortex creates in the host project, not at the onboarding scope.

  2. The roles/iam.serviceAccountTokenCreator impersonation grants are bound on individual Cortex service-account resources (one binding per SA, not at the onboarding scope).

  3. For folder (ACCOUNT_GROUP) onboardings only, the roles/iam.organizationRoleViewer built-in role is bound at the organization level so that Cortex can read organization-level custom-role definitions.

  4. Agentless Disk Scanning permissions are further restricted by an IAM Condition that limits their effect to Compute Engine snapshots and disks whose names start with cortex-scan-. The condition applies regardless of whether the binding resource itself is at project, folder, or organization level.