GCP

Trace connects to Google Cloud through a service account provisioned in Trace's own GCP organization, dedicated to your organization. You grant that service account a read-only role set at the scope you choose — your whole organization, one folder, or a single project. Authentication is keyless (Workload Identity Federation): no service-account keys are ever created, stored, or exchanged. Trace never modifies your resources — the only change in your environment is the IAM role and bindings you create yourself when applying the grant.

How it works

1. From Settings → Integrations → GCP in the dashboard, choose the scope, enter its ID, and connect. Trace provisions your dedicated service account and shows you its email.
2. Apply the generated grant with Terraform, the gcloud CLI, or Cloud Shell. It creates a Trace-defined custom role that enumerates exact read-only permissions and binds it — together with roles/cloudasset.viewer — to your dedicated service account. Applying it requires an account that can create custom IAM roles (an Owner, or Role Administrator). For organization and folder grants the custom role is defined at the organization level, so it needs Organization Role Administrator; a project grant needs it on the project.
3. Click Verify access. Trace checks that the granted permissions are sufficient — and warns if the grant is broader than Trace needs — then activates the integration.

What Trace sees

The role set is metadata-only: list and describe resources, read IAM policies, and query Cloud Asset Inventory. Data-plane reads are excluded by design — Cloud Storage object contents, Secret Manager values, BigQuery table data, and monitoring data are not readable. Every permission in the custom role is enumerated in the onboarding artifacts, so you can audit the exact set before applying it.

Why connect GCP

Source code alone can't tell you what's actually reachable in your live environment. During a penetration test, Trace uses read-only recon of your real GCP footprint — what's deployed, what's public, how services connect — to confirm whether a weakness is genuinely reachable and exploitable, rather than only theoretically vulnerable. Credentials are minted per session, stay read-only, and expire automatically.

Disconnecting immediately revokes Trace's access and deletes your dedicated service account, invalidating every grant that references it (if the deletion is delayed, the integration page offers a retry). You can also remove the role bindings on your side at any time.