Create Google Cloud Bindings
CloudPlans connects to your project with Workload Identity Federation: your project trusts the CloudPlans AWS identity, which impersonates a service account of your project. No service account key is created or shared.
The quickest way is the Helper: Google Cloud Shell setup of the credential form, which prints a script that does all of this (see GCP automations for the script, the Terraform and the roles of every service). These are the same steps done by hand, in the project you want CloudPlans to manage.
Step 1: Enable the APIs
In APIs & Services → Library enable: IAM, Security Token Service, IAM Service Account Credentials and Cloud Resource Manager, plus the API of every service you manage (Compute Engine, Kubernetes Engine, Cloud SQL Admin, Memorystore for Redis, Dataproc, Vertex AI).
Step 2: Create the Workload Identity Pool and the AWS provider
- Go to IAM & Admin → Workload Identity Federation → Create pool and name it
cloudplans-pool. - Add a provider of type AWS named
cloudplans-awswith the AWS account ID605134468875. - Configure the attribute mapping:
google.subject=assertion.arnandattribute.aws_role=assertion.arn.
Step 3: Create the service account
Go to IAM & Admin → Service accounts → Create service account, name it cloudplans-scheduler.
Step 4: Let CloudPlans impersonate the service account
In the service account, open Principals with access → Grant access, and add this principal with the role Workload Identity User (roles/iam.workloadIdentityUser):
principalSet://iam.googleapis.com/projects/<PROJECT_NUMBER>/locations/global/workloadIdentityPools/cloudplans-pool/attribute.aws_role/arn:aws:sts::605134468875:assumed-role/cloudplansbatch/cloudplansbatch
Step 5: Grant the roles of your services
In IAM & Admin → IAM grant the service account cloudplans-scheduler@<project-id>.iam.gserviceaccount.com the predefined role of each service you manage:
| Service | Role |
|---|---|
| Compute Engine VM (start/stop and resize) | roles/compute.instanceAdmin.v1 |
| GKE | roles/container.clusterAdmin |
| Cloud SQL | roles/cloudsql.editor |
| Memorystore for Redis | roles/redis.editor |
| Dataproc | roles/dataproc.editor |
| Vertex AI endpoint | roles/aiplatform.user |
Step 6: Let CloudPlans resolve your project number
Grant the role roles/browser to the CloudPlans service account cloudsschedulerfromaws@cloudsscheduler.iam.gserviceaccount.com. It is read only: it only lets CloudPlans resolve your numeric project number when you save the credential and cannot start, stop or delete anything.
Step 7: Fill in the credential
Paste your GCP Project ID in the credential form (Create).