Google Cloud Platform provider permissions - List of Google Cloud Platform (GCP) permissions for use during Cortex XDR onboarding to enable continuous monitoring in your cloud environment. - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR 5.x Documentation
Product
Cortex XDR
License
XDR + Cloud
Creation date
2025-07-13
Last date published
2026-06-11
Category
Administrator Guide
Abstract

List of Google Cloud Platform (GCP) permissions for use during Cortex XDR onboarding to enable continuous monitoring in your cloud environment.

Notice

Requires a Cortex XDR license that has the Cloud Posture Security or Cloud Runtime Security add-on.

When onboarding Google Cloud Platform (GCP), Cortex XDR creates an authentication template that requests the permissions needed for monitoring your cloud environment. Permissions are organized by security capability, then by the role that contains them. Each role lists its assignment scope and the specific permissions it grants:

Each role is bound at the scope you configure during onboarding (organization, folder, or project), with the following exceptions:

  1. The audit-log Pub/Sub publisher and subscriber roles (roles/pubsub.publisher, roles/pubsub.subscriber) are bound only to the single Pub/Sub topic and subscription Cortex creates in the host project, not at the onboarding scope.

  2. The roles/iam.serviceAccountTokenCreator impersonation grants are bound on individual Cortex service-account resources (one binding per SA, not at the onboarding scope).

  3. For folder (ACCOUNT_GROUP) onboardings only, the roles/iam.organizationRoleViewer built-in role is bound at the organization level so that Cortex can read organization-level custom-role definitions.

  4. Agentless Disk Scanning permissions are further restricted by an IAM Condition that limits their effect to Compute Engine snapshots and disks whose names start with cortex-scan-. The condition applies regardless of whether the binding resource itself is at project, folder, or organization level.