---
title: "Prepare GCP for Cloud Discovery | Lansweeper Platform"
slug: "prepare-google-cloud-platform-for-cloud-discovery"
description: "Prepare Google Cloud Platform for Lansweeper Cloud Discovery. Set up the service account, permissions, and access needed to inventory your GCP assets."
updated: 2026-06-19T18:14:18Z
published: 2026-06-19T18:14:18Z
canonical: "docs.lansweeper.com/prepare-google-cloud-platform-for-cloud-discovery"
stale: true
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lansweeper.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Prepare Google Cloud Platform for Cloud Discovery

> [!WARNING]
> Note on third‑party tools
> 
> We aim to provide accurate and helpful details about third‑party tools, but we can’t guarantee that this information is always complete or up to date. For the most reliable information, please always refer to the third‑party tool’s official documentation.

Integrating your Google Cloud Platform (GCP) environment with Lansweeper Cloud Discovery allows Lansweeper to securely inventory assets across your GCP organization. This configuration uses Workload Identity Federation, enabling Lansweeper to authenticate with GCP using OpenID Connect (OIDC), without storing or managing long-lived credentials.

## Create a Workload Identity Pool and Provider

You’ll first create a Workload Identity Pool with an OIDC provider to enable federated authentication from Lansweeper. For more information, see [Manage workload identity pools and providers](https://cloud.google.com/iam/docs/manage-workload-identity-pools-providers).

To configure a Workload Identity Pool for Lansweeper Discovery

1. In the Google Cloud console, go to **IAM & Admin > Workload Identity Federation**.
2. Select **Create pool**, then provide a name (for example, `lansweeper-pool`).
3. Modify the **Pool ID** field as needed. This is the value you'll enter in the **first field** of your GCP Cloud Action in Lansweeper.
4. Under **Provider type**, select **OpenID Connect (OIDC)**.
5. Enter a **Provider Name.**
6. Enter the **Provider ID**. This is the value you'll enter in the **second field** of your GCP Cloud Action in Lansweeper.

              Use IDs, not names

              

Make sure to use the Pool and Provider IDs, and not the names, when you configure your GCP Cloud Action.

1. Enter the following:
  - **Issuer URL**:

```
https://login.auth.lansweeper.com/6d02a192-efc6-a58a-e413-8abc60f3b067
```
  - **Allowed audiences**:

```
866d6f4d-c8fa-4342-9f6a-377932892ee0
```
2. Add attribute mappings:
  - Map **google.subject** to **assertion.sub**
  - Map **attribute.site_id** to **assertion.site_id**
3. Set an attribute condition to limit access by Lansweeper Site:

```
attribute.site_id == '<your site ID>'
```

To allow multiple Sites, use the **OR** operator:

```
attribute.site_id == '<site ID #1>' || attribute.site_id == '<site ID #2>'
```
4. Create the pool and provider.

## Create a service account

This service account grants Lansweeper permission to read resource data in your projects and organization.

1. Follow Google’s documentation to [Create service accounts](https://cloud.google.com/iam/docs/service-accounts-create).
2. Assign the following roles:
  - Viewer (for scanning project assets)
  - Folder Viewer (to read folder structures)
  - Organization Viewer (to read organizational metadata)
3. Save the new service account.
4. Copy the Service account email address as you’ll need it later.

> Recommendation
> 
> 
> The predefined Viewer role is typically sufficient. Ensure that no editor or write-level permissions are granted.

## Configure access to the Workload Identity Pool

You’ll now allow your Lansweeper Workload Identity federation to impersonate the GCP service account.

1. Follow Google’s documentation to [Manage workload identity pools and providers](https://cloud.google.com/iam/docs/manage-workload-identity-pools-providers).
2. In the **Attribute name** field, select **subject** and enter:

```
866d6f4d-c8fa-4342-9f6a-377932892ee0
```

## Enable access across multiple projects (optional)

If your GCP environment includes multiple projects you want to scan:

1. In each project, go to **IAM & Admin > IAM**.
2. Find the service account created for Lansweeper.
3. Grant it the **Viewer** role at the project level.

This allows the service account to list and read resources across all targeted projects.

## Next steps

Now that you have prepared your GCP environment, you can create a Cloud Discovery action to connect with Lansweeper Sites.

- [Create a cloud action - Google Cloud Platform](/v1/docs/create-a-cloud-action-google-cloud-platform)