> ## Documentation Index
> Fetch the complete documentation index at: https://docs.axiomancer.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Cloud

> Connect Google Cloud to Layer to inventory IAM policy bindings, service accounts, and collect Cloud Audit Logs for unified IAM and compliance evidence.

The Google Cloud integration discovers IAM policy bindings and collects Cloud Audit Log summaries for a GCP project. Use it to track who has access to your cloud resources and generate compliance evidence for identity and monitoring controls in [Axiom Codex](/codex/index).

## What you'll need

* A GCP project with Cloud Resource Manager and Cloud Logging APIs enabled.
* Permission to create a service account in the project.
* Five minutes.

## Set it up

<Steps>
  <Step title="Create a service account">
    In the Google Cloud Console, go to **IAM & Admin → Service Accounts** and click **Create Service Account**.

    * Name: `axiom-layer-readonly`
    * Role: **Viewer** (or a custom role — see below)
  </Step>

  <Step title="Create and download a key">
    Click on the service account, go to **Keys → Add Key → Create New Key**, and choose **JSON**. A JSON key file downloads automatically — keep it safe.
  </Step>

  <Step title="Paste credentials into Layer">
    In Layer, go to **Integrations**, find Google Cloud, and click **Connect**. Enter your **Project ID** and paste the full contents of the JSON key file into the **Service Account Key** field. Click **Connect**.
  </Step>

  <Step title="Wait for the first sync">
    The initial sync runs immediately and typically finishes in under five minutes.
  </Step>
</Steps>

## What gets synced

| Object                            | Fields                            | Refresh cadence |
| --------------------------------- | --------------------------------- | --------------- |
| IAM policy bindings               | role, members, binding count      | Daily           |
| Cloud Audit Logs (30-day summary) | entry count, breakdown by service | Daily           |

## Compliance evidence

GCP data generates evidence records for the following SOC 2 controls:

| Evidence                    | Controls            |
| --------------------------- | ------------------- |
| Project IAM policy bindings | CC6.1, CC6.2, CC6.3 |
| Cloud Audit Logs summary    | CC7.1, CC7.2        |

See the [SOC 2 evidence catalog](/codex/soc2-evidence-catalog) for full control descriptions.

## Least-privilege permissions

The **Viewer** role is sufficient. If you prefer a custom role with narrower scope, include these permissions:

* `resourcemanager.projects.getIamPolicy`
* `logging.logEntries.list`
* `logging.logs.list`

## Troubleshooting

<AccordionGroup>
  <Accordion title="Authentication fails on first sync">
    Verify the service account key JSON is complete (it should start with `{` and end with `}`). If the key was deleted or the service account disabled, create a new key and update it in Layer.
  </Accordion>

  <Accordion title="No audit log entries appear">
    Cloud Audit Logs must be enabled for the project. Go to **IAM & Admin → Audit Logs** in the Cloud Console and confirm that admin activity and data access logs are turned on for the services you want to monitor.
  </Accordion>

  <Accordion title="I want to monitor multiple projects">
    Create a separate connection for each project. You can reuse the same service account if you grant it the Viewer role on each additional project.
  </Accordion>
</AccordionGroup>