GCP Cloud Armor is a web application firewall (WAF) and DDoS protection service that protects applications through configurable security policies.
Required Permissions
To integrate GCP Cloud Armor with Scytale, the following permissions are required:
read: roles/compute.viewer
read: cloudasset.assets.searchAllResources
The Compute Engine API and the Cloud Asset API must be enabled on your GCP project.
Scytale follows the least-privilege principle, limiting permission scopes strictly to what's required for reliable audit evidence collection.
How to Connect
In Scytale, go to 'Integrations'.
Search for GCP Cloud Armor and select 'Connect'.
Paste your private key, client email & project ID.
Add a connection name — this will be used to differentiate between your connections — and then select 'Connect'.
You have now successfully connected to GCP Cloud Armor.
You can upload your GCP service account JSON key file to prefill these fields automatically instead of copying each value by hand.
If you have already connected GCP for another Scytale integration, Cloud Armor reuses the same credentials — no additional grants are required.
How to Generate a Service Account Key in GCP
Step 1 — Create a service account
In the Google Cloud console, go to 'IAM & Admin' → 'Service Accounts' and select 'Create Service Account'. Give it a descriptive name — for example, scytale-integration — and select 'Create and Continue'.
Step 2 — Grant the required roles
Assign the Compute Viewer role (roles/compute.viewer) and the Cloud Asset Viewer role (roles/cloudasset.viewer) to the service account. These grant read-only access to your Cloud Armor security policies and the resources they protect.
Step 3 — Enable the required APIs
In the Google Cloud console, go to 'APIs & Services' and make sure the Compute Engine API and the Cloud Asset API are enabled on your project.
Step 4 — Create and download a JSON key
Open the service account, go to the 'Keys' tab, select 'Add Key' → 'Create new key', choose JSON, and select 'Create'. The key file downloads to your computer — upload it in Scytale to prefill the connection fields.