Reference: Google Cloud permissions

Turbonomic requires specific permissions to monitor your Google Cloud workloads and billing data.

Permissions for the Google Cloud target (project-level permissions)

The permissions listed in this section allow the Google Cloud target in Turbonomic to monitor and optimize workloads in individual projects.

Be sure to set up a service account in Google Cloud, create a custom role, and then assign the custom role to the service account. You need to specify these permissions when you create the custom role.

When a service account has been properly configured for use with Turbonomic, add a Google Cloud target in the user interface.

  • Workload monitoring permissions

    Turbonomic functionality Required permissions

    Access to Google Cloud APIs to discover workloads

    • serviceusage.services.get

      Verifies access to Google Cloud APIs

    Discovery of regions

    • compute.regions.list

      Gets supported regions

    Discovery of zones

    • compute.zones.list

      Gets supported zones

    Discovery of VMs and instance types (machine types)

    • compute.instances.get

      Gets instance properties

    • compute.instances.list

      Gets instances

    • compute.machineTypes.get

      Gets machine type properties

    • compute.machineTypes.list

      Gets supported machine types

    Discovery of instance groups and types (managed or unmanaged)

    • compute.instanceGroups.list

      Gets instance groups

    Discovery of managed instance groups (MIGs)

    • compute.autoscalers.list

      Gets auto scaling details for a MIG

    • compute.instanceGroupManagers.get

      Gets MIG properties

    • compute.instanceGroupManagers.list

      Gets MIGs

    • compute.instanceTemplates.list

      Gets compute tier and instance templates of MIG

  • Action execution permissions

    Turbonomic functionality Required permissions
    Execution of actions for all supported entities

    • iam.serviceAccounts.actAs

      Grants a service account the necessary permissions to perform various operations on Google Cloud APIs
    Verification of action execution status for all supported entities

    • compute.globalOperations.get

      Checks the status of async operations

    • compute.regionOperations.get

      Checks the status of async operations

    • compute.zoneOperations.get

      Checks the status of async operations
    Execution of parking actions for VMs

    • compute.instances.start

      Restarts a VM after action execution

    • compute.instances.stop

      Stops a VM before changing its properties
    Execution of parking actions for MIGs

    • compute.autoscalers.get

      Gets the configuration of an autoscaler

    • compute.autoscalers.update

      Updates the configuration of an autoscaler

    • compute.instanceGroupManagers.use

      Allows an autoscaler to manage the instance groups that are associated with it

    • compute.instanceGroupManagers.get

      Gets the state and configuration of a zonal or regional MIG

    • compute.instanceGroupManagers.update

      Updates the minimum and maximum replicas in a zonal MIG