SC26AI agents lab + dinner on the river · Nov 17
Parallel Works
View as Markdown
Share:

Google

This page explains how to set up a Google account so that ACTIVATE can manage your Google infrastructure, clusters, billing, storage, and usage data.

The steps on this page should be completed by a cloud engineer in your organization.

Google Account

We recommend creating a new Google project for the ACTIVATE platform, which will allow you to keep your existing Google project separate from the platform and make it easier to manage billing and usage data. This will also ensure the principle of least privilege, as ACTIVATE will only have access to the resources it needs to manage.

Ensure the following APIs are enabled for the project in the API & Services page:

  • Cloud Resource Manager API
  • IAM API
  • Compute Engine API
  • Filestore API

Setting Up Google Credentials

To get started quickly, you can create a new service account and add the Owner role. This will allow ACTIVATE to manage all resources in your project. If you want to limit the scope of the service account, you can create a custom role and assign it to the service account.

Creating a Service Account Key

ACTIVATE uses service account keys to authenticate with Google Cloud. You can create a new service account key by following the steps on the Google documentation.

Google Permissions

This section includes the permissions or roles you'll need to assign to the Google service account you create for ACTIVATE. You can create a custom role with all the necessary permissions in the IAM console.

pw-platform

These permissions are used to create and manage clusters, networks, disks, snapshots, buckets and file systems. ACTIVATE checks for them, together with the billing permissions below, when you add the cloud account.

compute.instances.create
compute.instances.delete
compute.instances.get
compute.instances.list
compute.instances.start
compute.instances.stop
compute.instances.setLabels
compute.instances.setMachineType
compute.instances.setMetadata
compute.instances.setServiceAccount
compute.instances.setTags
compute.instances.attachDisk
compute.instances.detachDisk
compute.instances.addAccessConfig
compute.disks.create
compute.disks.createSnapshot
compute.disks.delete
compute.disks.get
compute.disks.list
compute.disks.setLabels
compute.disks.use
compute.disks.useReadOnly
compute.snapshots.create
compute.snapshots.delete
compute.snapshots.get
compute.snapshots.list
compute.snapshots.setLabels
compute.snapshots.useReadOnly
compute.zones.list
compute.images.useReadOnly
compute.zoneOperations.get
compute.regionOperations.get
compute.globalOperations.get
compute.networks.create
compute.networks.delete
compute.networks.get
compute.networks.use
compute.networks.updatePolicy
compute.subnetworks.create
compute.subnetworks.delete
compute.subnetworks.get
compute.subnetworks.list
compute.subnetworks.use
compute.subnetworks.useExternalIp
compute.routers.create
compute.routers.delete
compute.routers.get
compute.routers.update
compute.routers.list
compute.routes.create
compute.routes.delete
compute.addresses.create
compute.addresses.delete
compute.addresses.get
compute.addresses.list
compute.addresses.setLabels
compute.addresses.use
compute.globalAddresses.create
compute.globalAddresses.createInternal
compute.globalAddresses.delete
compute.globalAddresses.get
compute.firewalls.create
compute.firewalls.delete
compute.firewalls.get
compute.firewalls.list
compute.resourcePolicies.create
compute.resourcePolicies.delete
compute.resourcePolicies.get
compute.resourcePolicies.list
storage.buckets.create
storage.buckets.delete
storage.buckets.get
storage.buckets.getIamPolicy
storage.buckets.list
storage.buckets.setIamPolicy
storage.buckets.update
storage.hmacKeys.create
storage.hmacKeys.delete
storage.hmacKeys.get
storage.hmacKeys.list
storage.hmacKeys.update
storage.objects.create
storage.objects.delete
storage.objects.get
storage.objects.list
storage.objects.setIamPolicy
storage.objects.update
iam.serviceAccounts.create
iam.serviceAccounts.delete
iam.serviceAccounts.get
iam.serviceAccounts.actAs
iam.serviceAccountKeys.create
iam.serviceAccountKeys.delete
iam.serviceAccountKeys.list
resourcemanager.projects.get
resourcemanager.projects.getIamPolicy
resourcemanager.projects.setIamPolicy
servicenetworking.services.addPeering
file.instances.create
file.instances.delete
file.instances.get
file.instances.list
file.operations.get
lustre.instances.create
lustre.instances.delete
lustre.instances.get
lustre.operations.get

pw-billing

These permissions are used to provision and access billing infrastructure. You can also assign the existing Google IAM roles BigQuery User and Service Usage Admin to your Google service account.

serviceusage.operations.get
serviceusage.services.disable
serviceusage.services.enable
serviceusage.services.get
serviceusage.services.list
monitoring.timeSeries.list
serviceusage.operations.cancel
serviceusage.operations.delete
serviceusage.operations.list
serviceusage.quotas.get
serviceusage.quotas.update
serviceusage.services.use
bigquery.datasets.create
bigquery.datasets.get
bigquery.jobs.create
bigquery.tables.list
resourcemanager.projects.get
bigquery.bireservations.get
bigquery.capacityCommitments.get
bigquery.capacityCommitments.list
bigquery.config.get
bigquery.datasets.getIamPolicy
bigquery.jobs.list
bigquery.models.list
bigquery.readsessions.create
bigquery.readsessions.getData
bigquery.readsessions.update
bigquery.reservationAssignments.list
bigquery.reservationAssignments.search
bigquery.reservations.get
bigquery.reservations.list
bigquery.routines.list
bigquery.savedqueries.get
bigquery.savedqueries.list
bigquery.transfers.get
bigquerymigration.translation.translate
resourcemanager.projects.list
bigquery.datasets.delete
bigquery.tables.get
bigquery.tables.getData