TigerGate scans your GCP project (or organization) with read-only access via a dedicated service account and its JSON key. A short gcloud script sets it up.
The service account only needs roles/viewer + roles/iam.securityReviewer — both read-only. TigerGate can never create, modify, or delete resources in your project.

​
Before you start

In TigerGate, go to Integrations → Cloud Providers, choose Add Provider → Google Cloud Platform. You’ll fill in two required values once the service account exists:
FieldWhat it is
Project IDThe GCP project TigerGate scans (e.g. my-project-12345). Read from the key’s own project_id if omitted here.
Service Account JSONThe downloaded key file for the service account created below — pasted in full.

​
1. Create the service account

1

Create the service account

gcloud iam service-accounts create tigergate-cspm-scan \
  --project=<YOUR_PROJECT_ID> \
  --display-name="TigerGate CSPM read-only scan"
2

Grant the two read-only roles

gcloud projects add-iam-policy-binding <YOUR_PROJECT_ID> \
  --member="serviceAccount:tigergate-cspm-scan@<YOUR_PROJECT_ID>.iam.gserviceaccount.com" \
  --role="roles/viewer"

gcloud projects add-iam-policy-binding <YOUR_PROJECT_ID> \
  --member="serviceAccount:tigergate-cspm-scan@<YOUR_PROJECT_ID>.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"
roles/viewer covers general resource read access; roles/iam.securityReviewer adds the IAM-policy read access the posture checks and exposure graph need.
3

Create and download a JSON key

gcloud iam service-accounts keys create tigergate-cspm-key.json \
  --iam-account=tigergate-cspm-scan@<YOUR_PROJECT_ID>.iam.gserviceaccount.com
tigergate-cspm-key.json is the file whose contents you paste into TigerGate. Treat it as a secret — anyone with the file can authenticate as the service account.

​
2. Connect it in TigerGate

1

Paste the Project ID + Service Account JSON

Under Integrations → Cloud Providers, add a Google Cloud Platform connection: enter the Project ID and paste the full contents of tigergate-cspm-key.json into Service Account JSON.
2

Test

Click Test. TigerGate mints a token from the key and does a live Cloud Resource Manager projects.get call to confirm the connection works — or tells you the exact reason (malformed key, disabled service account, wrong project ID) so you can fix it before saving.
3

Scan or schedule

Run an on-demand scan, or add a Schedule. Schedule creation re-validates the credentials, so a broken key can’t be scheduled.

​
Multiple projects (GCP organization)

To scan every project in an organization instead of one, bind the same two roles at the organization level and grant Cloud Asset Inventory read access so TigerGate can enumerate projects: 
gcloud organizations add-iam-policy-binding <YOUR_ORG_ID> \
  --member="serviceAccount:tigergate-cspm-scan@<YOUR_PROJECT_ID>.iam.gserviceaccount.com" \
  --role="roles/viewer"

gcloud organizations add-iam-policy-binding <YOUR_ORG_ID> \
  --member="serviceAccount:tigergate-cspm-scan@<YOUR_PROJECT_ID>.iam.gserviceaccount.com" \
  --role="roles/iam.securityReviewer"

gcloud organizations add-iam-policy-binding <YOUR_ORG_ID> \
  --member="serviceAccount:tigergate-cspm-scan@<YOUR_PROJECT_ID>.iam.gserviceaccount.com" \
  --role="roles/cloudasset.viewer"
Organization-wide and multi-project scanning is a scanner capability (organization_id / projects in the credentials), but the SaaS connect form only exposes a single Project ID. To scan a whole organization, contact support (or, if you’re self-hosting, set organization_id in the connection credentials).

​
Alternative: impersonation / Application Default Credentials

The scanner can also skip a long-lived JSON key entirely — authenticating via Application Default Credentials (use_adc) and, optionally, an impersonation target service account (impersonate_account). Neither is exposed in the SaaS dashboard form; contact support if you’re running TigerGate on-prem and want to use it.

​
Troubleshooting

Scan/Test errorCauseFix
PERMISSION_DENIED on the Cloud Resource Manager checkRole bindings missing or not yet propagatedRe-run the add-iam-policy-binding commands; IAM changes can take a minute to propagate
Service Account JSON is not valid JSON / missing client_email or private_keyKey file was truncated or edited when pastedRe-download the key with gcloud iam service-accounts keys create and paste the full file contents
DECODER routines::unsupported or similar key-parsing errorThe private key in the JSON is corrupted (partial copy/paste, wrong file)Re-download a fresh key — don’t hand-edit the JSON
GCP project ID is requiredNeither the form’s Project ID nor the key’s own project_id field is setFill in Project ID explicitly
Scan runs but few findingsOnly roles/viewer bound, not roles/iam.securityReviewerBind both roles (step 2 above)