Multicloud Defense - GCP Account Onboarding

Hello everyone, and welcome to the discussion for onboarding a Google Cloud Platform or GCP project onto a multi cloud defense controller. My name is Himanshu, and I am a customer success specialist. This presentation discusses some concepts and tips for a successful onboarding.00:04Recording of a GCP project to MCD controller. For an effective and holistic understanding, it is recommended to be viewed prior to the demo that follows this presentation. The concepts discussed in this presentation complement that demo. Here's our agenda for this presentation. We'll begin with discussing the concept of projects in GCP.00:20Followed by the concept of folders, we'll then proceed to talking about onboarding a project versus a folder and conclude with providing some tips and caveats to keep in mind while onboarding a project. What does a project Signify in Google Cloud Platform or GCP?00:40Think of a project as a container for your resources such as virtual machines, databases, and storage buckets. It is the fundamental organizational unit where you deploy and manage your infrastructure. You can maintain multiple isolated projects to separate environments. For instance, one project for a development team.00:56Another for testing, and a 3rd for production, crucially, each project is linked to a specific billing account. Additionally, API enablement is strictly per project. E.g., if you enable an API in project A, it does not automatically propagate to project B.01:13You must explicitly enable the required APIs in every project where you intend to use them. Next, let's talk about a folder. A folder is an optional grouping mechanism that allows you to organize multiple projects and other folders together while projects are the actual containers for your resources.01:29Like Vmiss and databases, folders act as directories to help manage those projects at scale. The GCP resource hierarchy begins at the organization level, the root/company level, followed by an optional layer of folders, then projects, and finally the resources themselves. It is important to note that you cannot deploy resources directly under a folder.01:47You must create projects 1st and then add your resources into those projects. To effectively protect assets inside a project using MCD gateways, the system requires two specific service accounts, one for the MCD controller and one for the MCD gateways.02:06Since service accounts can only be created within projects and not directly in folders, you must onboard the project itself to gain protection. The onboarding script provided in the MCD controller's easy setup page is designed to automatically create these service accounts for you. While you can use Terraform to onboard a folder, be aware that this is intended solely for asset and traffic discovery, not.02:23For Active protection. Before attempting to onboard a project, verify that your project is linked to a valid billing account.02:43This is essential because the onboarding script triggers the enablement of several APIs, some of which require an active billing account to function. The onboarding script provided on the MCD controller's easy setup page creates among other things a storage bucket to store logs.02:49Bucket names in GCP must be globally unique across all projects, including those outside your organization. To attempt to have a globally unique bucket name, you must modify the prefix value in the onboarding script before running it. If you fail to do this, the script may create other resources.03:07Like API enablements and the service accounts, but will fail to create the bucket for which it will show a log error stating a cloud storage bucket named system d log bucket already exists. To resolve this, you can either create the bucket manually or modify the prefix and run the script again.03:22If you choose the latter, you must 1st delete the service accounts created in the previous failed attempt. Please refer to the MCD user guide for the specific steps on removing cloud service providers. Unlike onboarded AWS or Azure accounts where inventory discovery is enabled automatically in MCD controller.03:38An onboarded GCP project requires a manual enabling of inventory discovery. Once you have connected your project to the MCD controller, you must go to the infrastructure tab. Select CPS accounts, check the box for your GCP account, and then click Manage Inventory to enable asset and inventory discovery for the regions where your assets reside. Well, thanks for watching.03:56