Deploy on Google Cloud

​

Before you start

• Terraform 1.11 or later and hashicorp/google 7.x or 8.x.
• In the host project, the identity applying the module must be able to create service accounts, custom roles, Pub/Sub, Firestore, Secret Manager, Cloud Run and Cloud Scheduler resources, and enable APIs.
• On every scanned project, folder or organization, it must be able to set IAM policy (resourcemanager.projects.setIamPolicy or the folder and organization equivalents).
• An organization API key (tg_). See Before you deploy.

​

Deploy with Terraform

gcloud config get-value project # the project you are about to deploy into
terraform init
terraform plan
terraform apply

provider "google" {
  project = "security-tools-123"
}

module "tigergate_dspm" {
  source = "https://releases.tigergate.dev/dspm/<version>/tigergate-dspm-gcp.zip"

  tigergate_api_url = "https://api.tigergate.dev"
  tigergate_api_key = var.tigergate_api_key # tg_..., your organization's API key
  enrollment_token  = var.enrollment_token  # tgdspm_..., from the console
  project_id        = "security-tools-123"
  region            = "us-central1"
  scan_project_ids  = ["security-tools-123", "data-prod-456"]
}

​

What the module creates

​

Permissions

​

Projects, folders and organizations

• scan_project_ids lists projects. Empty means the host project.
• scan_folder_ids, with organization_id, covers every project below the folders, including new ones.
• scan_whole_organization = true, with organization_id, covers the organization.

​

Networking

• Default: Cloud Run’s managed egress to the internet.
• Private databases: set vpc_network and vpc_subnetwork for Direct VPC egress, or vpc_connector for an existing Serverless VPC Access connector. vpc_egress = "ALL_TRAFFIC" sends everything through the VPC, for Cloud NAT or an egress firewall. Allow the TigerGate API host and the Google APIs.
• VPC Service Controls: a perimeter around the scanned projects must include the host project, or allow the scanner service account with an ingress rule. Otherwise reads fail with access_denied.
• No internet egress: copy the image to Artifact Registry and set scanner_image.

​

Edge cases

• APIs: calls made by the scanner’s service account are attributed to the host project, so the APIs it reads through must be enabled there. enable_apis = true (the default) does that. With enable_apis = false, a missing API shows as a preflight failure that names it.
• Firestore location: a Firestore database’s location cannot change. Set firestore_location before the first apply if region is not the location you want.
• Custom roles blocked: if your organization blocks a permission in custom roles, set discovery_role = "viewer".
• CMEK: Cloud Storage and BigQuery decrypt with their own service agents, so the scanner needs no Cloud KMS role. A disabled or destroyed key makes the data unreadable, and the store reports kms_denied.
• IAM deny policies that cover the scanner’s service account override the grants. The store reports access_denied, never clean.
• Requester Pays buckets of another project show as access_denied.
• Archive storage class objects are readable, with retrieval charges billed to the bucket’s project.

​

Cost

​

Operate the deployment

• Rotate the API key: add a version to the secret in the api_key_secret_id output, or apply a new tigergate_api_key with tigergate_api_key_version raised by one. No redeploy is needed.
• Logs: run the command that terraform output -raw logs_command prints.
• Max workers: on Google Cloud the coordinator starts at most the console’s Max workers tasks, within the module’s max_workers.
• Remove: select Revoke on the deployment, then terraform destroy.