Infrastructure

Google Cloud

Ploy connects to Google Cloud through your Google Workspace connection. Each Google Cloud organization is added as its own connection under Google Workspace, so the people and groups in your IAM policies are matched to the same Google accounts Ploy already knows from your directory.

Ploy signs in with Workload Identity Federation. Ploy stores no service account key or other secret for Google Cloud.

What Ploy reads

  • The organization, its folders and its projects. Deleted folders and projects are archived in Ploy.

  • Every IAM role binding on the organization, on each folder and on each project, conditional bindings included. A group that holds a role shows as the group.

  • Every service account in each project, and whether it is disabled. Each one is linked to the project it belongs to, as "Service account" access on that project.

  • Each service account's user-managed keys, on the account's Credentials tab: when each key was created, when it expires, whether it is disabled, and when it was last used.

  • When each service account and key last authenticated. For the last 6 weeks this comes from Cloud Monitoring and counts calls to any Google API, Google Workspace APIs included. Before that it comes from Policy Analyzer, which counts Google Cloud APIs only and can be up to a day behind.

  • People and groups from your Google Workspace directory are matched to their existing Google Workspace accounts in Ploy. Principals from outside it, such as users and groups from other domains, Google-managed service agents and service accounts from other organizations, show as their own accounts.

People's sign-ins and MFA status come from your Google Workspace connection, not from Google Cloud.

Before you start

  • Google Workspace connected in Ploy, with the Groups permission. Ploy reads your directory to match the people and groups in your IAM policies.

  • A Google Cloud organization admin who can run commands in Cloud Shell.

  • A connector project: the Google Cloud project that will hold Ploy's workload identity pool and service account. It can be an existing project or a new one.

Set up instructions

1. Add Google Cloud in Ploy

On the Integrations page, either open the catalogue and choose the Google Cloud card, or open the menu on your Google Workspace connection and choose Add Google Cloud. If Google Workspace is not connected yet, the Google Cloud card connects Google Workspace first.

2. Enter the connection details

The first page asks for:

  • Name: what this connection is called in Ploy, for example the organization's name. Optional.

  • Organization ID (required): the numeric ID of your Google Cloud organization. Run gcloud organizations list to find it.

  • Connector project ID (required): the ID of your connector project. Ploy's service account is created in it as ploy-connector.

  • Connector project number (required): that project's number. Run gcloud projects describe PROJECT_ID --format='value(projectNumber)' to find it.

  • Workload identity pool ID and Workload identity provider ID: leave these as ploy and ploy-oidc unless you want other IDs.

  • Allow Ploy to make changes: off by default. See Actions below.

Ploy checks each value has the shape Google uses before saving it.

3. Run the setup commands

The second page shows values Ploy works out for this connection:

  • Service account: the account Ploy acts as, ploy-connector@PROJECT_ID.iam.gserviceaccount.com. The setup commands create it.

  • Issuer URL: Ploy's OIDC issuer for your organization. Your provider's issuer URI must be exactly this.

  • Attribute condition: limits the provider to this connection, so Google rejects tokens Ploy creates for anything else. It is required: the test fails without it.

  • Principal: the identity that is granted roles/iam.workloadIdentityUser on the service account.

  • Setup commands: a ready-to-run script with your values filled in.

Copy the setup commands and run them in Cloud Shell as an organization admin. They:

  • enable the IAM, IAM Credentials, Security Token Service, Cloud Resource Manager, Cloud Asset, Policy Analyzer, API Keys and Cloud Monitoring APIs on the connector project

  • create the workload identity pool and an OIDC provider that trusts Ploy's issuer URL, with the attribute condition

  • create the service account and let this connection act as it (roles/iam.workloadIdentityUser)

  • grant the service account roles/serviceusage.serviceUsageConsumer on the connector project

  • grant the service account these read roles on the organization: roles/cloudasset.viewer, roles/iam.securityReviewer, roles/browser, roles/policyanalyzer.activityAnalysisViewer and roles/monitoring.viewer

  • when changes are allowed, also grant roles/iam.securityAdmin and roles/iam.serviceAccountAdmin on the organization

If you manage Google Cloud with Terraform or another tool, create the same resources and grants there instead.

4. Test and save

Click Test. Ploy checks, in order, that:

  • it can read your Google Workspace directory

  • it can sign in through your provider and act as the service account

  • your provider rejects tokens Ploy creates for any other connection

  • it can read the organization

  • it can search the organization's folders and projects

Then save. Ploy starts the first scan of the organization straight away.

Each Google Cloud organization can be connected only once in a Ploy organization.

Actions

Ploy only reads from Google Cloud unless Allow Ploy to make changes is ticked on the first page and the write roles are granted. With changes allowed, Ploy can:

  • grant an IAM role on the organization, a folder or a project to a Google Workspace person or group, a user or group from another domain, or one of the organization's service accounts

  • remove someone from every role binding on the organization, a folder or a project, conditional bindings included

  • disable, enable and delete the organization's service accounts

The roles Ploy can grant are Viewer, Browser, Security Reviewer, Logs Viewer and Monitoring Viewer anywhere, plus Folder Viewer on folders and the organization, Organization Viewer on the organization, and Service Account User on projects other than the connector project. Ploy never grants Owner, Editor, or any role that could take over its own connection, and it never disables or deletes its own service account.

People are suspended and removed in Google Workspace, not in Google Cloud.

To turn changes on later, tick the box, save, and run the updated setup commands, which now include the write roles.

Google Cloud costs

Reading Cloud Monitoring is the part of this integration Google can charge for. Since October 2025, Google bills Monitoring read API calls by the number of time series they return: the first 1 million each month are free for each billing account, then it costs $0.50 per million. Any charge goes to your Google Cloud billing account, not to Ploy.

On each scan, Ploy reads two Monitoring metrics per project, one for service accounts and one for keys. Each read returns one time series for every account or key that authenticated in the last 6 weeks. For example, 30 projects with 30 active accounts and keys each come to around 110,000 time series a month, well inside the free allowance.

To avoid Monitoring reads altogether, leave out roles/monitoring.viewer. Ploy then takes last-used dates from Policy Analyzer only, which does not count calls to Google APIs outside Google Cloud, such as Google Workspace APIs.

Managing connections

  • More than one organization: add each one as its own Google Cloud connection under the same Google Workspace connection.

  • Pause: use the toggle on the connection's row. A paused connection is not scanned and Ploy makes no changes through it.

  • Change organization: a connection stays tied to the organization it was set up for. To connect a different organization, add a new connection.

  • Remove: choose Remove on the connection's row. Ploy stops scanning the organization and archives everything it found there. Removing a connection needs the same permission as removing an integration.

Troubleshooting

The test names the step that failed:

  • Ploy's identity was accepted but may not act as the service account: if you have just run the setup commands, wait a few minutes for Google to apply them and test again. Otherwise check that the service account grants roles/iam.workloadIdentityUser to the principal shown on the second page.

  • Your workload identity provider accepts any Ploy token: set the provider's attribute condition to the value shown on the second page, exactly, then test again.

  • Ploy authenticated but cannot read organization: check the organization ID, and that the service account has roles/browser on the organization.

  • The Cloud Resource Manager API (or the Cloud Asset API) is not enabled on the connector project: run the gcloud services enable line from the setup commands, then test again.

  • Ploy can read the organization but not search it: grant the service account roles/cloudasset.viewer on the organization.

  • Google Workspace needs group read access: reconnect Google Workspace with the Groups permission.

  • Ploy could not read the Google Workspace directory: check the Google Workspace connection is working, then test again.

If Google denies Ploy access to one project, or an API is not enabled there, Ploy skips that project and tries it again later. The rest of the organization is still scanned.

If last-used dates look old for an account you know is in use, check that the service account has roles/monitoring.viewer on the organization and that the Cloud Monitoring API is enabled on the connector project. Without them Ploy only sees Google Cloud API calls, through Policy Analyzer.

Was this helpful?
Was this helpful?