Configure the Google Cloud account

In order to gather data from the Google Pub/Sub, Google Cloud Monitoring, and Google Cloud Billing using this add-on, create a Google Cloud Service or External account for each project from the Google Cloud Console. For more information, see the Create Service Accounts at https://cloud.google.com/iam/docs/service-accounts-create, Create and delete service account keys at https://cloud.google.com/iam/docs/keys-create-delete, and Configure workload identity federation with AWS or Azure https://cloud.google.com/iam/docs/workload-identity-federation-with-other-clouds?authuser=1 topics in the Google Cloud documentation. A service account’s credentials, obtained from the Google API Console, include a uniquely generated email address, a client ID, and at least one public/private key pair. You might also need to add a predefined role to your service account - see https://cloud.google.com/iam/docs/understanding-roles. After you have your new public/private key pair, save it to your machine.

An external account’s credentials obtained from the Google API Console include credential source information, an impersonated service account URL, a token URL, and an audience. After you have your credential, save it to your machine.

For non-Dedicated accounts, the add-on supports external-account credentials only on AWS and Azure virtual machines. Dedicated WIF is configured under a France or Germany sovereign profile and does not expand that existing support matrix.

Application Default Credentials (ADC)

The add-on supports Google Cloud’s Application Default Credentials (ADC) feature for customer-managed on-premise instances. This feature isn’t supported for cloud instances. For more details, see Application Default Credentials (ADC).

ADC is not supported for Dedicated accounts. Configure service-account JSON or external-account JSON for WIF instead. ADC accounts are auto-discovered and cannot be deleted or modified, except for the Google Cloud Environment setting.

Sovereign cloud profiles

To restrict collection for a Google account to France Data Boundary by S3NS or Germany Data Boundary by T-Systems, configure the account’s Google Cloud Environment setting. For more information, see Configure sovereign cloud profiles.

Configure a France or Germany Dedicated account

Dedicated is an opt-in deployment under the existing France Data Boundary by S3NS and Germany Data Boundary by T-Systems environments. It is not a separate Google Cloud Environment value.

1. Open Configuration > Google Credentials and add or edit an account.
2. Select the France S3NS or Germany T-Systems environment.
3. Select Dedicated for Sovereign Deployment.
4. Set Account Type to Service Account or External Account, then supply the matching JSON document.
5. Review the inherited universe, authentication endpoints, and locations. Leave override fields blank unless the provider instructed you to change them.
6. Save the account.

France Dedicated inherits s3nsapis.fr and u-france-east1. Germany Dedicated inherits the current preview universe apis-berlin-build0.goog and u-germany-northeast1. Blank values are resolved at runtime and are not written to the account stanza. An explicit override remains pinned when a future add-on changes a packaged default.

Dedicated authentication values are account-owned. A supported input can optionally override only the service origins used by that input. Endpoint precedence is input override, then account override, then https://<service>.<universe>.

Do not set GOOGLE_CLOUD_UNIVERSE_DOMAIN in the Splunk process. The add-on applies the universe per account so mixed Commercial, Data Boundary, and Dedicated collection remains isolated. OAuth scopes retain their standard googleapis.com identifier values because scopes are identifiers, not API destinations.

If Sovereign Deployment is absent or blank, the account remains on its existing Data Boundary path. The add-on does not migrate or automatically write back existing account or input stanzas.

For credential rules, endpoint overrides, prerequisites, and the supported collector table, see Configure sovereign cloud profiles.

Note

Your new public/private key pair is generated and downloaded to your machine, and it serves as the only copy of this key. You are responsible for storing it securely.

To get data from Google Cloud Platform, you need to enable related APIs in Google Cloud Platform. For more information, see the Google Cloud storage APIs & Reference at https://cloud.google.com/storage/docs/apis and Getting Endpoints Quickstart documentation at https://cloud.google.com/endpoints/docs/quickstart-endpoints.