GCP Cloud Armor is a web application firewall (WAF) and DDoS protection service that protects applications through configurable security policies.
Required Permissions
To integrate GCP Cloud Armor with Scytale, the following permissions are required:
read: roles/compute.viewer
The Compute Engine API must be enabled on your GCP project.
Scytale follows the least-privilege principle, limiting permission scopes strictly to what's required for reliable audit evidence collection.
How to Connect
In Scytale, go to 'Integrations'.
Search for GCP Cloud Armor and select 'Connect'.
Paste your private key, client email & project ID.
Add a connection name — this will be used to differentiate between your connections — and then select 'Connect'.
You have now successfully connected to GCP Cloud Armor.
You can upload your GCP service account JSON key file to prefill these fields automatically instead of copying each value by hand.
If you have already connected GCP for another Scytale integration, Cloud Armor reuses the same credentials — no additional grants are required.
How to Generate a Service Account Key in GCP
Step 1 — Create a service account
In the Google Cloud console, go to 'IAM & Admin' → 'Service Accounts' and select 'Create Service Account'. Give it a descriptive name — for example, scytale-integration — and select 'Create and Continue'.
Step 2 — Grant the Compute Viewer role
Assign the Compute Viewer role (roles/compute.viewer) to the service account. This grants read-only access to your Cloud Armor security policies.
Step 3 — Enable the Compute Engine API
In the Google Cloud console, go to 'APIs & Services' and make sure the Compute Engine API is enabled on your project.
Step 4 — Create and download a JSON key
Open the service account, go to the 'Keys' tab, select 'Add Key' → 'Create new key', choose JSON, and select 'Create'. The key file downloads to your computer — upload it in Scytale to prefill the connection fields.