mirror of
https://github.com/hanzoai/kms.git
synced 2026-11-03 01:10:24 +00:00
zeekay
0ebffbd529
- Fix 381 files where branding script corrupted variable names (e.g. isHanzo KMSTemplate -> isKmsTemplate) - Rebrand from "Hanzo KMS" to just "KMS" for white-label support (allows Lux KMS, Hanzo KMS, etc. via configuration) - 856 files, purely string replacements, no logic changes
115 lines
5.4 KiB
Plaintext
115 lines
5.4 KiB
Plaintext
---
|
|
title: "GCP Connection"
|
|
description: "Learn how to configure a GCP Connection for KMS."
|
|
---
|
|
|
|
KMS supports [service account impersonation](https://cloud.google.com/iam/docs/service-account-impersonation) to connect with your GCP projects.
|
|
|
|
<Accordion title="Self-Hosted Instance">
|
|
Using the GCP integration on a self-hosted instance of KMS requires configuring a service account on GCP and
|
|
configuring your instance to use it.
|
|
|
|
<Steps>
|
|
<Step title="Enable the IAM Service Account Credentials API">
|
|
Enable the IAM Service Account Credentials API for the project containing the service account that will be impersonated. You can do this from the Google Cloud Console or via the command line.
|
|
|
|
|
|
|
|
To enable via command line, run the following command, replacing `projectId` with your GCP project ID:
|
|
```bash
|
|
gcloud services enable iamcredentials.googleapis.com --project=projectId
|
|
```
|
|
|
|
Verify the API is enabled by running:
|
|
```bash
|
|
gcloud services list --enabled --project=projectId | grep iamcredentials
|
|
```
|
|
</Step>
|
|
<Step title="Navigate to IAM & Admin > Service Accounts in Google Cloud Console">
|
|
|
|
</Step>
|
|
<Step title="Create a Service Account">
|
|
Create a new service account that will be used to impersonate other GCP service accounts for your app connections.
|
|
|
|
|
|
Press "DONE" after creating the service account.
|
|
</Step>
|
|
<Step title="Generate Service Account Key">
|
|
Download the JSON key file for your service account. This will be used to authenticate your instance with GCP.
|
|
|
|
</Step>
|
|
<Step title="Configure Your Instance">
|
|
1. Copy the entire contents of the downloaded JSON key file.
|
|
2. Set it as a string value for the `INF_APP_CONNECTION_GCP_SERVICE_ACCOUNT_CREDENTIAL` environment variable.
|
|
3. Restart your KMS instance to apply the changes.
|
|
4. You can now use GCP integration with service account impersonation.
|
|
</Step>
|
|
</Steps>
|
|
|
|
</Accordion>
|
|
|
|
## Configure Service Account for KMS
|
|
|
|
<Steps>
|
|
<Step title="Navigate to IAM & Admin > Service Accounts in Google Cloud Console">
|
|
|
|
</Step>
|
|
<Step title="Create Service Account">
|
|
Create a new service account with an ID that follows this requirement:
|
|
|
|
Your service account ID must end with the first two sections of your KMS organization ID.
|
|
|
|
Example:
|
|
- KMS organization ID: `df92581a-0fe9-42b5-b526-0a1e88ec8085`
|
|
- Required service account ID suffix: `df92581a-0fe9`
|
|
|
|
|
|
</Step>
|
|
<Step title="Configure Service Account Permissions">
|
|
<Tabs>
|
|
<Tab title="Secret Sync">
|
|
Add the required permissions for secret syncs:
|
|
|
|
</Tab>
|
|
</Tabs>
|
|
After configuring the appropriate roles, press "DONE".
|
|
</Step>
|
|
<Step title="Enable Service Account Impersonation">
|
|
To enable service account impersonation, you'll need to grant the **Service Account Token Creator** role to the KMS instance's service account. This configuration allows KMS to securely impersonate the new service account.
|
|
- Navigate to the IAM & Admin > Service Accounts section in your Google Cloud Console
|
|
- Select the newly created service account
|
|
- Click on the "PERMISSIONS" tab
|
|
- Click "Grant Access" to add a new principal
|
|
|
|
If you're using KMS Cloud US, use the following service account: [email protected]
|
|
|
|
If you're using KMS Cloud EU, use the following service account: [email protected]
|
|
|
|
|
|
</Step>
|
|
|
|
</Steps>
|
|
|
|
## Setup GCP Connection in KMS
|
|
|
|
<Steps>
|
|
<Step title="Navigate to App Connections">
|
|
Navigate to the **Integrations** tab in the desired project, then select **App Connections**. 
|
|
</Step>
|
|
<Step title="Add Connection">
|
|
Select the **GCP Connection** option from the connection options modal.
|
|
|
|
</Step>
|
|
<Step title="Authorize Connection">
|
|
Select the **Service Account Impersonation** method and click **Connect to
|
|
GCP**. 
|
|
</Step>
|
|
<Step title="Connection Created">
|
|
Your **GCP Connection** is now available for use. 
|
|
</Step>
|
|
</Steps>
|