Select Actions to adjust the guide

Some actions may require additional configuration in the provider to be accessible. Choose the actions you need and the guide will be updated.

Action

Scope(s)

Loading actions...

Dynamic Guide URL

Scopes Selected


          
            Separator

Create or select a Google Cloud project

To use the IAM and Security APIs with OAuth 2.0, you need a Google Cloud project.

Select an existing project from the dropdown at the top of the page, or create a new one by clicking New Project and filling in the Project name, Organization, and Parent resource fields, then clicking Create.

Enable the required APIs

Navigate to APIs & Services > Library, search for each API below, click on it, then click Enable. If it already shows Manage, the API is already enabled.

Identity and Access Management (IAM) API
IAM Service Account Credentials API
Secret Manager API
Cloud Resource Manager API

Configure Google Auth Platform

Before creating OAuth credentials, ensure Google Auth Platform is configured.

In the Google Cloud Console, go to APIs & Services > OAuth consent screen. This will open the Google Auth Platform dashboard.

If you have already configured Auth Platform (the OAuth Overview page with usage metrics is shown), skip this step and navigate to the Branding page from the sidebar. Otherwise, you will see a Get started button — click it to begin the configuration process.

Fill in the required fields for your application.

App name: Enter a name for your application (e.g., StackOne GCP IAM & Security Integration).
User support email: Select an email for user inquiries.
Click Next to continue.

Choose the appropriate user type for your application.

Internal: Only users within your Google Workspace organization can authorize (no app verification required).
External: Any Google account can authorize (requires app verification for production use).
Click Next to continue.

Provide email addresses for Google to notify you about any changes to your project. Click Next to continue.

Review your settings, agree to the Google API Services User Data Policy, and click Create to complete the setup.

Configure scopes

In Google Auth Platform, go to Data Access and click Add or Remove Scopes to configure the OAuth scopes your application needs.

Enables actions: Access Secret Version, Add Secret Version, Create Folder, Create Project, Create Project Role, Create Secret, Create Service Account, Create Service Account Key, Delete Folder, Delete Project, Delete Project Role, Delete Secret, Delete Service Account, Delete Service Account Key, Destroy Secret Version, Disable Secret Version, Disable Service Account, Disable Service Account Key, Enable Secret Version, Enable Service Account, Enable Service Account Key, Get Folder, Get Organization, Get Project, Get Project IAM Policy, Get Role, Get Secret, Get Secret IAM Policy, Get Secret Version, Get Service Account, Get Service Account Key, Get Tag Key, Get Tag Value, List Folders, List Predefined Roles, List Project Roles, List Projects, List Secret Versions, List Secrets, List Service Account Keys, List Service Accounts, List Tag Keys, List Tag Values, Search Folders, Search Organizations, Search Projects, Set Project IAM Policy, Set Secret IAM Policy, Test Project IAM Permissions, Undelete Project Role, Undelete Service Account, Update Folder, Update Project, Update Project Role, Update Secret, Update Service Account

Add the required Google Cloud Platform scopes for your integration.

In the Update selected scopes side panel that opens, check the required scopes from the list.

If a required scope is not shown in the list, use the Manually add scopes section.

Enter the full scope URL in the input field.
Click Add to table.

Confirm and persist your scope configuration.

Click Update to apply the selected scopes. The side panel will close.
On the Data Access page, click Save to persist the scope configuration.

Create OAuth 2.0 client credentials

Set up OAuth client credentials to authenticate with the GCP IAM and Security APIs. If you already have an existing OAuth 2.0 client, you can reuse it by adding the StackOne redirect URI and generating a new secret.

In the Google Cloud Console, go to APIs & Services > Credentials.

Skip this step if you are using an existing client.

Click + Create Credentials and select OAuth client ID.
Select Web application as the application type.
Enter a Name for your OAuth client (e.g., StackOne Cloud Security Integration).
Under Authorized redirect URIs, click Add URI and enter `https://api.stackone.com/connect/oauth2/googlecloudsecurity/callback`.
Click Create. A dialog will display your Client ID and Client Secret — copy and store them securely.

Skip this step if you created a new client above.

Click on your existing OAuth 2.0 client ID from the list.
Under Authorized redirect URIs, click Add URI, enter `https://api.stackone.com/connect/oauth2/googlecloudsecurity/callback`, and click Save.
Under Client secrets, click + Add secret to generate a new secret. Copy it and store it securely — it will not be shown again.
Your Client ID is shown on the same page under Additional information.

## Creating the StackOne Connector Profile To create the Connector Profile in StackOne for Google Cloud Security: Login to StackOne and navigate to [Connector Profiles](https://app.stackone.com/connector_profiles)

Click + Connector Profile
Search for and select Google Cloud Security
Select Type as OAuth 2.0
Fill out the fields using details retrieved from your provider:
- Client ID
- Client Secret
- Scopes (Optional)
(Optional) Select Actions to be enabled for this Connector Profile
Click Create profile

Congratulations! The new Connector Profile will now show up in your project ready to be used. You can now continue to Link Accounts for Google Cloud Security.