Important
This feature is currently in beta and may require additional validation or implementation steps. If you would like to use this method for GCP integration, please contact your CSM to enable this workflow for your Scrut account.
When to use this method?
When connecting multiple GCP Projects (ideally, more than 10)
If you’re connecting multiple projects, the legacy approach of connecting GCP with Scrut might be time-consuming. You have to repeat the same steps for each integration (one integration equals one GCP account) to connect multiple GCP Projects, which can be highly time-consuming and manual.
To address this challenge, we’ve simplified the workflow. This method allows you to connect multiple GCP projects simultaneously. We’ve also limited the manual steps required, reducing the time and effort needed to set up the integration.
How to Integrate Your GCP Account With Scrut for Multi-Projects
Permissions
Before you begin the integration, make sure you have the following permissions for your GCP platform:
Project Details and Configurations: Access to view project metadata, resource settings, and configurations across your Google Cloud environment to ensure compliance with best practices.
Logs and Monitoring Data: Permission to retrieve logs and performance data via Stackdriver to track resource usage, detect unusual activity, and maintain operational security.
Service Account Tokens: Access to service account tokens and associated metadata to ensure secure authentication and proper access control within cloud services.
Cloud Resource Manager API is enabled for the project. (To learn more, refer to Cloud Resource Manager API | Google Cloud.)
IAM Service Account Credentials API is enabled for the project. (To learn more, refer to IAM Service Account Credentials API.)
The service account has the following permissions: Security Reviewer, Service Account Token Creator, and Viewer. (To know more, refer to IAM Basic and Predefined Roles.)
Pro Tip:
See here for a detailed overview of the permissions needed for this integration. To learn more about service account impersonation, refer to Google’s documentation on:
Step 1: Navigate to Integrations in Scrut
Log in to Scrut and click Integrations on the left navigation panel.
Click the Integrations Library tab at the top of the page.
In the Categories section, click Cloud Providers.
Click the Integrate button on the Google Cloud card.
Click the Connect button on the GCP integration page.
Step 2: Execute Scrut’s Integration Script
Scrut runs a script on your GCP organization to extract the required metadata for the integration. Follow the instructions on the screen to generate and execute the script.
Prerequisites
Install the Google Cloud SDK if you haven’t done so already.
Step 2.1: Authenticate the CLI
Run these commands sequentially.
gcloud auth login
sudo apt-get install jqStep 2.2: Download the Shell File
Download this file: scrut-gcp-setup-script.sh
Step 2.3: Upload the File to Cloud Shell
Open Google Cloud Shell.
Click Open Editor → More (
.png)
) → Upload. Upload the file you downloaded in the previous step to the same directory.
Step 2.4: Run the Script
chmod +x scrut_gcp_integration.sh
./scrut_gcp_integration.shScrut runs the script on your GCP organization to extract the required metadata for the integration. After you run the script, you’ll be prompted to:
Select the GCP organization and billing account you want to connect to Scrut.
.png)
Select the projects to include in the integration. Enter the numbers corresponding to the projects you want to connect. Enter ALL to connect all your GCP projects to Scrut in a single step.
.png)
Once you provide the inputs, the script will create a service account and the necessary roles and permissions.
Once it finishes executing, it will create a file named scrut_config.json.gz.enc in the same folder as the script. Download the generated encrypted (scrut_config.json.gz.enc) file. You’ll need to upload it in the next step of the integration process in Scrut.
Note:
When connecting a huge number of GCP projects, the integration script may occasionally encounter issues during execution. If the script fails to complete, please contact our support team at support@scrut.io for assistance.
Step 3: Upload the encrypted file to Scrut
Navigate back to the Scrut platform and click Next.
Upload the downloaded file and click Finish.
This completes your GCP integration with Scrut.
FAQs & Troubleshooting
1: How secure is this script?
To protect your configuration data, Scrut uses a two-layer (hybrid) encryption approach. This ensures the data remains secure even if it is shared or stored outside your environment.
Why a Hybrid Approach?
Some encryption methods are fast but not ideal for securely sharing secrets. Others are very secure but slow and limited in how much data they can handle. This script combines both approaches to get the best of each.
What Happens to Your Data
Data Is Compressed First: Before encryption, the configuration file is compressed. This reduces file size and ensures consistent encryption results.
Data Is Locked with AES-256 (Fast & Strong): The compressed file is encrypted using AES-256-CBC. AES is a widely trusted industry standard used by banks and cloud providers. A random secret key and a random initialization value (IV) are generated for every run. This ensures that even if the same data is encrypted twice, the output will look completely different each time.
The AES Key Is Locked with RSA-2048 (Secure Sharing): The AES key itself must be protected. The script encrypts the AES key using RSA-2048 with Scrut's public key. Only Scrut's private key can unlock it. This ensures no one else (including you) can decrypt the file once it's encrypted for Scrut.
Final Secure Package Is Created: The script combines everything into one encrypted file. Encrypted AES key (RSA-protected) * Encrypted data (AES-protected). This single file is what you securely share with Scrut.
Security Benefits
Uses industry-standard encryption (AES-256 + RSA-2048)
Keys are generated fresh for every run
No secrets are stored in plain text
Only Scrut can decrypt the final file
Safe to transmit over email or upload portals
What You Need to Share
At the end of the process, you'll get one encrypted file: scrut_config.json.encThis is the only file you need to provide to Scrut.
2: Can I connect multiple projects to Scrut?
Yes. Once you run the script, you’ll be prompted to choose the projects you want to connect to Scrut. Enter the corresponding project numbers. Alternatively, you can enter ALL to connect all your existing GCP projects to Scrut in one go.
3: How do I add a new GCP project to connect to Scrut?
To add a new GCP project to your existing Scrut ↔ GCP integration, you must repeat the steps mentioned above. In the step where you select the GCP projects, enter the number corresponding to the new project. Complete the remaining integration steps as instructed above.
4: What happens after I disconnect the integration?
Scrut deletes all the credentials and data stored on our end and disintegrates the integration from our platform. Currently, service accounts created during this process persist in the customer environment and must be manually deleted if no longer required.