Configure Google Cloud Platform for monitoring

To monitor Google Cloud Platform (GPC) resources, configure GCP to allow the SolarWinds Platform to collect data by using a dedicated service account with the required permissions.

Required permissions

The service account must have the following IAM roles assigned at the GCP project level. Assign roles based on the features you plan to monitor.

Required for	Required roles	Description
Baseline access (required)	roles/viewer	Provides read-only access to all GCP resources. If assigned, you don’t need the more specific compute- or network-specific viewer roles listed below.
Compute and monitoring access	roles/compute.viewer roles/monitoring.viewer roles/dns.reader roles/compute.networkViewer	Use these roles instead of roles/viewer if you want more granular permissions.
Network connectivity monitoring	roles/networkmanagement.viewer	Required to monitor network traffic and connectivity.
Tag‑based monitoring	roles/tagUser roles/tagViewer	Required if you monitor resources by using GCP tags.
Instance management actions	roles/compute.instanceAdmin.v1 or roles/editor	Allows start, stop, and delete operations on Compute Engine instances. The roles/editor role also allows start, stop, and delete operation on additional GCP resources.
Cloud SQL monitoring	roles/cloudsql.viewer roles/logging.viewer	Required for monitoring cloud SQL in addition to roles/monitoring.viewer.
Load balancer monitoring	roles/compute.networkViewer roles/monitoring.viewer	Required to view load balancer configuration and metrics. roles/monitoring.viewer is required for graphs in the Load Balancer Monitoring tab or for API queries.
Cloud Router monitoring	roles/compute.viewer or roles/compute.networkViewer	Required to discover Cloud Routers and collect the status of BGP peers and Cloud NAT gateways. The roles include the compute.routers.get and compute.routers.list permissions.
Cost monitoring (BigQuery)	roles/bigquery.dataViewer roles/bigquery.jobUser roles/bigquery.user   or a custom role including bigquery.datasets.create, bigquery.datasets.update, bigquery.datasets.createTagBinding	Required to read billing export data, run queries, and manage datasets for cost monitoring.
GCP All Resources	roles/cloudasset.viewer	Required for monitoring statistics related to the environment. See SolarWinds Improvement Program (SWIP).

Required APIs/services

• Cloud Asset API - used for the SolarWinds Improvement Program (SWIP)
• Cloud DNS API
• Cloud Resource Manager API
• Compute Engine API
• CloudMonitoring API
• Cloud SQL - used for database monitoring
• Cloud SQL Admin API - used for database monitoring
• Network Management API
• Network Services API

Requirements for polling all GCP resources

To retrieve the list of all resources available in your GCP projects, the following must be met.

• The service account needs the roles/cloudasset.viewer role.
• The Cloud Asset API must be enabled.

The resources are polled once a week. The polled data is used for the SolarWinds Improvement Program (SWIP).

These resources are not counted toward your license and are not displayed on any view.

SWIP settings for GCP

Collecting SWIP data for GCP is enabled by default.

• To disable it, go to the Advanced Configuration page and clear the PollGcpSWIPData checkbox.

• To change the polling interval, modify the GcpSWIPPollingInterval setting. Disabling the setting does not delete data that has already been collected.

Create a GCP service account in the GCP console

Before you begin, contact an IT admin and have GCP projects within your organization created.

See Create service accounts in Google documentation for more information.

1. Log in to the Google console using an account with admin privileges.

2. Enable the required APIs/services.

   See Enabling an API in Google Cloud documentation.

3. Create a service account. See Create service accounts in Google Cloud documentation.

4. Grant the account the required roles. See IAM basic and predefined roles reference in Google Cloud documentation.

5. Generate a private key for the service account. As the key type, select JSON. See Create and delete service account keys in Google Cloud documentation.

   The generated key file contains the GCP credentials needed to add the GCP account to the SolarWinds Platform.