Connecting Google Cloud to Landfall
Landfall reads your GCP resource state through a single service-account key you create and scope yourself. One JSON key is all it needs; nothing else is stored.
What you'll need
- A GCP project, and permission to create a service account and key in it.
- An admin on your Landfall organization, to save the connection under Settings → Integrations.
1. Create a service account and key
Give the service account a read-only role scoped to what an investigation needs (e.g. roles/viewer at the project level) — notEditor/Owner.
IAM & Admin → Service Accounts → Create Service Account
Name it something recognizable (e.g. landfall-integration).
console.cloud.google.com/iam-admin/serviceaccounts
Screenshot pending — see this guide's tracked follow-up. Grant it a read-only role
roles/viewer at the project (or narrower resource) level is enough for the investigator agent's read-only queries.
Keys → Add key → Create new key → JSON
GCP downloads the key file once — you'll paste its full contents into Landfall next.
2. Add it to Landfall
In Landfall, open Settings → Integrations → Google Cloud and paste the full JSON key file's contents, then run Test connection.
Reference
| Field | Value |
|---|---|
| Service account key (JSON) | The full service-account JSON key (contains client_email + private_key) |
This connection is read-only — the agent queries resource state, it never writes. See Integrations architecture for how every Landfall integration shares this same connector shape, and today's actual agent-access and incident-triggering status per integration (GCP is configuration/read-only on both fronts today).