Google

This page explains how to set up a Google account so that ACTIVATE can manage your Google infrastructure, clusters, billing, storage, and usage data.

Google Account

We recommend creating a new Google project for the ACTIVATE platform, which will allow you to keep your existing Google project separate from the platform and make it easier to manage billing and usage data. This will also ensure the principle of least privilege, as ACTIVATE will only have access to the resources it needs to manage.

Ensure the following APIs are enabled for the project in the API & Services page:

• Cloud Resource Manager API
• IAM API
• Compute Engine API
• Filestore API

Setting Up Google Credentials

To get started quickly, you can create a new service account and add the Owner role. This will allow ACTIVATE to manage all resources in your project. If you want to limit the scope of the service account, you can create a custom role and assign it to the service account.

Creating a Service Account Key

ACTIVATE uses service account keys to authenticate with Google Cloud. You can create a new service account key by following the steps on the Google documentation.

Google Permissions

This section includes the permissions or roles you'll need to assign to the Google service account you create for ACTIVATE. You can create a custom role with all the necessary permissions in the IAM console, or assign the Owner role, which includes all of them.

pw-compute

These permissions are used to create and manage VMs, disks, snapshots and networks.

pw-storage

These permissions are used to create and manage Cloud Storage buckets, Filestore and Managed Lustre instances, and the service accounts and HMAC keys that give clusters access to buckets.

pw-iam

These permissions are used to create the service accounts ACTIVATE uses on your behalf and to grant them access to the project.

pw-billing

These permissions are used to provision and access billing infrastructure.