Cisco
Login
Search
Software Secure Workload
Activity Configure

Configure and Manage Connectors for Secure Workload Cloud Connectors GCP Connector Create a New GCP Connector

Last updated: Jun 09, 2025

Create a New GCP Connector

Procedure

1

From the navigation pane, choose Manage > Connectors.
2

Click GCP Connector.
3

Click either of the options to create a new GCP connector:

  • Get Started Guide

    OR

  • Generate Templates
4

Get Started Guide: Use this option to gather labels and flow data from GKE clusters. Before you configure this connector, see:

  • Requirements and prerequisites

    Understand the general requirements and prerequisites for the GCP cloud connector as well as the specific requirements for each capability.

  • GCP Roles and Permissions

    This wizard creates a GCP Cloud Deployment Manager template with the roles and policies required for the capabilities you enable. You will upload this template to GCP.

  • Segmentation policy enforcement: Before you enable policy enforcement for any VPC, read about important caveats and take action to avoid unintended results.
5

Click Get Started. For more information, see Edit a New GCP Connector.
6

Click Generate Templates.

Cisco Secure Workload requires relevant permissions to access and read flow logs settings and perform policy enforcement. Based on the capability selections, a Cloud Deployment Manager template is auto-generated. Use this template to apply the relevant permissions to the desired user. Copy or paste commands to create the recommended built-in role on GCP CLI.

Select activities to be performed with Cisco Secure Workload on your GCP Resources.

  • Context Gathering

  • Ingest Flow Logs

  • Segmentation

  • Managed Kubernetes Services


 

The above selections will determine the RBAC recommendations.
7

Create new Service Accounts and grant IAM roles to service accounts in the Google Cloud console.

Use IAM roles with custom service accounts to-

  • Limit the instances access to Google Cloud APIs using granular IAM roles.

  • Provide each instance, or set of instances, a unique identity.

  • Limit the access of the default service account.
8

Create and manage service accounts using the Identity and Access Management (IAM) API, and the Google Cloud console.
9

In addition to basic roles ( viewer, editor, owner) and custom roles, assign the Compute Engine predefined roles to the members of your project:

  • Compute Network Viewer

  • Kubernetes Engine Roles and Permissions
10

Create and manage Google Cloud resources and services directly on the command line or through scripts using the Google Cloud CLI. You can either Copy or Download the template.

What to do next

If you have enabled Context Gathering, Ingest Flow Logs, Segmentation, and or Managed Kubernetes Services:

  • If you enabled flow ingestion, it may take up to 25 minutes for flows to begin appearing on the Investigate > Traffic page.

  • (Optional) For richer flow data and other benefits including visibility into host vulnerabilities (CVEs), install the appropriate agent for your operating system on your VPC-based workloads. For requirements and details, see the agent installation chapter.

  • After you have successfully configured the GCP connector to gather labels and ingest flows, follow the standard process for building segmentation policies. For example: Allow Secure Workload to gather sufficient flow data to generate reliable policies; define or modify scopes (typically one for each VPC); create a workspace for each scope; automatically discover policies based on your flow data, and/or manually create policies; analyze and refine your policies; ensure that your policies meet the guidelines and best practices below; and then, when you are ready, approve and enforce those policies in the workspace. When you are ready to enforce segmentation policy for a particular VPC, return to the connector configuration to enable segmentation for the VPC.

    For more information, see Best Practices When Enforcing Segmentation Policy for GCP Inventory.

If you have enabled Managed Kubernetes Services (GKE) option:

Event Log:

The event logs can be used to know significant events happening per connector from different capabilities. We can filter them using various attributes like Component, Namespace, Messages and Timestamp.

Previous topic GCP Connector Configuration Overview Next topic Create a GCP Connector