Configure Connection Details of Cloud Service Provider Accounts

You can seamlessly integrate with your cloud platform accounts from within the Calibo Accelerate platform. You need to connect to your cloud account through the Calibo Accelerate platform for various operations, such as creating cloud instances, deploying technologies on Kubernetes clusters, Docker containers, or OpenShift clusters within these cloud instances. After you save the connection details of your active cloud platform account and mark it as default, the Calibo Accelerate platform facilitates easy access to the cloud resources available in your default account.

Currently, the Calibo Accelerate platform supports integration with the following cloud service providers:

  • Amazon Web Services (AWS)

  • Microsoft Azure

  • Google Cloud Platform (GCP)

To save the connection details of your active cloud service provider account, follow these steps:

  1. Sign in to the Calibo Accelerate platform and click Configuration in the left navigation pane.

  2. On the Platform Setup screen, on the Cloud Platform, Tools & Technologies tile, click Configure.

  3. On the Cloud Platform, Tools & Technologies screen, in the Cloud Platforms section, click Configure.
    (After you save connection details for at least one cloud service provider account, you see the Modify button here.)

On the Cloud Platforms screen, click the cloud service provider of your choice.

Prerequisites

An AWS account with administrative access needs to be created. The following table contains the details of the IAM role that you need to create and the permissions you need to assign to the role.

User Input required in Calibo Accelerate Required Permissions Additional Details
IAM Cross-account role ARN

  • ElasticLoadBalancingFullAccess

  • ECR pull/push

  • Cost explorer read

  • IAM ListEntitiesForPolicy

  • EC2 instance creation/deletion

  • VPC/subnet creation

  • SecurityGroup creation

  • EKS: describe, get cluster

  • ALB read / write access

  • Master account configuration change for cross account

  • Create User permission with assume role permission (For running the CFT to create the cross-account role)

AWS account is required to provision the technology stack and application deployment.

The Calibo Accelerate platform connects with your AWS account by using the cross-account role.

  1. Environment Name: Provide a local name to your cloud account environment. Your AWS account connection details are saved by this name in the Calibo Accelerate platform.

  1. Description: Provide a description of your configuration. When you save connection details of multiple cloud accounts in the Calibo Accelerate platform, a brief description always helps you identify the saved connection details easily.

  2. Depending on the access requirements in your AWS environment, you can decide whether to connect to your AWS account by using AWS IAM user credentials or create a cross-account role with permissions for the Calibo Accelerate platform to access your AWS resources.

    For information on when you should sign in as an IAM user and when you should assume an IAM role, refer to the AWS documentation.

    • Use AWS User Credentials
      To connect to your AWS account by using specific IAM user credentials, choose this option, and then do the following:

      1. Region: Select the AWS availability region from the dropdown list.

      2. Access Key ID: Enter the access key ID, for example, AKIAIOSFODNN7EXAMPLE, which is the alphanumeric identifier associated with the IAM user.

      3. Secret Access Key: Enter the secret access key, for example, wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY, which is a private key corresponding to your access key ID and is used to authenticate your API requests.

      4. Test Connection: Click Test Connection to check if you can connect to the configured AWS account successfully.

    • Use Cross-Account Role
      If you create a cross-account role in your AWS account to allow the Calibo Accelerate platform to access your AWS resources, choose this option and then do the following:

      1. Region: Select the AWS availability region from the dropdown list.

      2. Master AWS Account: Your organization's master account ID is auto-populated. You can copy this ID for your reference.

      3. External ID: This is the unique identifier generated by Calibo. You need to mention this ID in the IAM role policy that you create to allow the Calibo Accelerate platform to access your AWS account. If you use the Calibo-provided CFT for IAM role policy, this ID is already mentioned in the template. You can copy this ID for your reference.

      4. Cross-Account Role ARN: After you create an IAM role and attach a policy to establish a trusted relationship between your AWS account and Calibo's account, you can provide the role's Amazon Resource Name (ARN) here. This ARN is required for the Calibo Accelerate platform to assume the role that you create in your AWS account.

      5. Download CFT: Download this CloudFormation Template provided by Calibo. This template creates an IAM role and the required policy to allow the Calibo Accelerate platform to access your AWS account. This is a reference template which you can customize to suit your requirements.

        Copy 
        {
          "AWSTemplateFormatVersion": "2010-09-09",
          "Description": "Configure cross account roles",
          "Metadata": {
            "Version": 0.7
          },
          "Outputs": {
            "RoleArn": {
              "Description": "IAM Role Arn for AWS configuration.",
              "Value": {
                "Fn::GetAtt": [
                  "DeveloperRole",
                  "Arn"
                ]
              }
            }
          },
          "Resources": {
            "DeveloperEC2Policy": {
              "Properties": {
                "ManagedPolicyName": "DeveloperEC2Policy",
                "PolicyDocument": {
                  "Version": "2012-10-17",
                  "Statement": [
                    {
                      "Condition": {
                        "StringEquals": {
                          "aws:RequestedRegion": [
                            "us-east-1"
                          ]
                        }
                      },
                      "Resource": "*",
                      "Action": [
                        "eks:List*",
                        "eks:Describe*",
                        "ce:Get*",
                        "ce:Describe*",
                        "ce:List*",
                        "ec2:Describe*",
                        "ec2:Get*"
                      ],
                      "Effect": "Allow",
                      "Sid": "ReadOnlyEKSAndCostExplorerAndEC2Metadata"
                    },
                    {
                      "Resource": [
                        {
                          "Fn::GetAtt": [
                            "TechstackInstanceRole",
                            "Arn"
                          ]
                        }
                      ],
                      "Action": [
                        "iam:PassRole"
                      ],
                      "Effect": "Allow"
                    },
                    {
                      "Condition": {
                        "StringEquals": {
                          "aws:RequestedRegion": [
                            "us-east-1"
                          ]
                        },
                        "ForAllValues:StringLike": {
                          "ec2:InstanceType": [
                            "t3.small",
                            "t3.medium",
                            "m5.large"
                          ]
                        }
                      },
                      "Resource": "*",
                      "Action": [
                        "ec2:RunInstances",
                        "ec2:StartInstances",
                        "ec2:StopInstances",
                        "ec2:TerminateInstances",
                        "ec2:DisassociateAddress"
                      ],
                      "Effect": "Allow",
                      "Sid": "ManageSpecificInstancesTypes"
                    },
                    {
                      "Resource": "*",
                      "Action": [
                        "ec2:AssociateIamInstanceProfile",
                        "ec2:AttachVolume",
                        "ec2:AuthorizeSecurityGroupEgress",
                        "ec2:AuthorizeSecurityGroupIngress",
                        "ec2:CreateSecurityGroup",
                        "ec2:CreateTags",
                        "ec2:CreateVolume",
                        "ec2:DeleteTags",
                        "ec2:DeleteVolume",
                        "ec2:DetachVolume",
                        "ec2:DisassociateIamInstanceProfile",
                        "ec2:AllocateAddress",
                        "ec2:AssociateAddress",
                        "ec2:CreateKeyPair",
                        "ec2:DeleteNetworkInterface",
                        "ec2:Describe*",
                        "ec2:ImportKeyPair",
                        "ec2:CreateVpc",
                        "ec2:AssociateRouteTable",
                        "ec2:CreateRoute",
                        "ec2:CreateRouteTable",
                        "ec2:CreateNatGateway",
                        "ec2:CreateInternetGateway",
                        "ec2:AttachInternetGateway",
                        "ec2:ModifyVpcAttribute",
                        "ec2:CreateSubnet"
                      ],
                      "Effect": "Allow"
                    },
                    {
                      "Resource": "*",
                      "Action": [
                        "cloudformation:DescribeStacks",
                        "cloudformation:ListStackResources"
                      ],
                      "Effect": "Allow",
                      "Sid": "CFNReadOnly"
                    },
                    {
                      "Resource": "*",
                      "Action": [
                        "lambda:GetFunction",
                        "lambda:ListAliases",
                        "lambda:ListVersionsByFunction",
                        "lambda:InvokeFunction"
                      ],
                      "Effect": "Allow",
                      "Sid": "LambdaGetAndInvoke"
                    },
                    {
                      "Resource": "*",
                      "Action": [
                        "logs:DescribeLogGroups",
                        "logs:DescribeLogStreams",
                        "logs:GetLogEvents",
                        "logs:FilterLogEvents"
                      ],
                      "Effect": "Allow",
                      "Sid": "ReadCloudWatchLogsForThatLambda"
                    },
                    {
                      "Resource": "*",
                      "Action": [
                        "cloudwatch:GetMetricData",
                        "cloudwatch:GetMetricStatistics",
                        "cloudwatch:ListMetrics"
                      ],
                      "Effect": "Allow",
                      "Sid": "ReadCloudWatchMetrics"
                    },
                    {
                      "Resource": "*",
                      "Action": [
                        "s3:ListAllMyBuckets",
                        "s3:GetBucketLocation",
                        "iam:ListRoles"
                      ],
                      "Effect": "Allow",
                      "Sid": "ListAllS3BucketsAndRoles"
                    }
                  ]
                },
                "Roles": [
                  "DeveloperRole"
                ]
              },
              "DependsOn": "DeveloperRole",
              "Type": "AWS::IAM::ManagedPolicy"
            },
            "DeveloperRole": {
              "Properties": {
                "ManagedPolicyArns": [
                  "arn:aws:iam::aws:policy/ElasticLoadBalancingFullAccess"
                ],
                "RoleName": "DeveloperRole",
                "AssumeRolePolicyDocument": {
                  "Version": "2012-10-17",
                  "Statement": [
                    {
                      "Condition": {
                        "StringEquals": {
                          "sts:ExternalId": "97518028"
                        }
                      },
                      "Action": [
                        "sts:AssumeRole"
                      ],
                      "Effect": "Allow",
                      "Principal": {
                        "AWS": [
                          "781950061287"
                        ]
                      }
                    },
                    {
                      "Action": "sts:AssumeRole",
                      "Effect": "Allow",
                      "Principal": {
                        "Service": "sagemaker.amazonaws.com"
                      }
                    }
                  ]
                }
              },
              "Type": "AWS::IAM::Role"
            },
            "TechstackInstanceRole": {
              "Properties": {
                "ManagedPolicyArns": [
                  "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM"
                ],
                "RoleName": "techstack-instance-role",
                "AssumeRolePolicyDocument": {
                  "Version": "2012-10-17",
                  "Statement": [
                    {
                      "Action": "sts:AssumeRole",
                      "Effect": "Allow",
                      "Principal": {
                        "Service": "ec2.amazonaws.com"
                      }
                    }
                  ]
                }
              },
              "Type": "AWS::IAM::Role"
            },
            "Ec2InstanceProfile": {
              "Properties": {
                "Path": "/",
                "Roles": [
                  {
                    "Ref": "TechstackInstanceRole"
                  }
                ],
                "InstanceProfileName": "techstack-instance-role"
              },
              "Type": "AWS::IAM::InstanceProfile"
            },
            "EcrPullPushPolicy": {
              "Properties": {
                "ManagedPolicyName": "EcrPullPushPolicy",
                "PolicyDocument": {
                  "Version": "2012-10-17",
                  "Statement": [
                    {
                      "Resource": "*",
                      "Action": [
                        "ecr:GetAuthorizationToken",
                        "ecr:GetDownloadUrlForLayer",
                        "ecr:BatchGetImage"
                      ],
                      "Effect": "Allow"
                    }
                  ]
                },
                "Roles": [
                  {
                    "Ref": "TechstackInstanceRole"
                  }
                ]
              },
              "DependsOn": "TechstackInstanceRole",
              "Type": "AWS::IAM::ManagedPolicy"
            }
          }
        }

      6. Test Connection: Click Test Connection to check if you can connect to the configured AWS account successfully.

  3. Configure VPC for Technology Deployment:

    A Virtual Private Cloud (VPC) is a logically isolated section of the cloud where you can launch AWS resources in a virtual network that you define. A VPC provides network isolation, allowing you to create a private, segmented environment for your applications and services. From within the Calibo Accelerate platform, you can either use your existing AWS VPC or create a new VPC for technology deployments.

    To configure a VPC for technology deployments, turn on the toggle.

    In the Configure VPC for Technology Deployment section, either specify the details of an existing VPC or create a new VPC in your AWS account.

    Depending on your choice, do either of the following:

    Specify the following details:

    Field Description
    VPC ID

    Select from the list of existing VPC IDs or enter a VPC ID. If your IAM policy does not allow the specified IAM user to access the VPC endpoints, the existing VPC IDs cannot be listed. In this case, you must manually enter the VPC ID.
    If you manually enter a VPC ID, it must match the following pattern: /vpc-[a-zA-Z0-9]/
    Private Subnets Select or enter at least two private subnets. Each private subnet must match the following pattern: /subnet-[a-z A-Z 0-9]/
    Public Subnets (Optional) If you want to specify public subnets, select or enter at least two subnets. Each public subnet must match the following pattern: /subnet-[a-z A-Z 0-9]/
    Security Groups for EC2

    Select or enter the security group name and click Add. You can add as many security groups as allowed per VPC by AWS. For information about security group quota in an AWS VPC, refer to the AWS documentation.

    Security group name must match the following pattern: /sg-[a-z A-Z 0-9]/
    Security Groups for Load Balancer (Optional) Select or enter the security group name and click Add. You can add up to 5 security group names. Security group name must match the following pattern: /sg-[a-z A-Z 0-9]/
    AMI ID (Optional) Select or enter the unique ID of the AWS AMI that you want to launch. You can find out the desired AMI ID from the AWS Management Console.
    Use Existing Key Pair To use a key pair that you have already created in your account, select this option, and then select your preferred key pair name from the dropdown list of existing key pair names.
    Create New Key Pair To create a new key pair from within the platform, type a key pair name that is easy for you to remember. To import a key pair which you have generated from a third-party tool, type a key pair name and paste the contents of your public key into the Public Key field.

    Specify the following details:

    Field Description
    VPC CIDR

    Specify the IPv4 CIDR block for your VPC. The allowed block size is between a /16 netmask (65,536 IP addresses) and /28 netmask (16 IP addresses). For more information about VPC CIDR blocks, refer to the AWS documentation.

    By default, the 10.0.0.0/19 CIDR block is specified, which you can edit.
    Private Subnets Select or enter at least two private subnets. Each private subnet must match the following pattern: /subnet-[a-z A-Z 0-9]/
    Public Subnets (Optional) If you want to specify public subnets, select or enter at least two subnets. Each public subnet must match the following pattern: /subnet-[a-z A-Z 0-9]/
    Source Address for Security Group of Load Balancer (Optional)

    It represents the allowed sources from which traffic is accepted by the security group associated with the load balancer. Specify the IP address range in CIDR notation.

    AMI ID (Optional) Select or enter the unique ID of the AWS AMI that you want to launch. You can find out the desired AMI ID from the AWS Management Console.
    Use Existing Key Pair To use a key pair that you have already created in your account, select this option, and then select your preferred key pair name from the list of existing key pair names.
    Create New Key Pair To create a new key pair from within the platform, type a key pair name that is easy for you to remember. To import a key pair which you have generated from a third-party tool, type a key pair name and paste the contents of your public key into the Public Key field.
    Cloud Tags (Optional)

    Cloud tags are used to label and categorize AWS resources for identification, organization, and cost tracking. You can add optional tags to resources created within this configuration. Currently, the tags you specify are applied to the following objects that are created in AWS from within the Calibo Accelerate platform:

    • Virtual Private Cloud (VPC)

    • Subnets (Public and Private)

    • Route Tables

    • Internet Gateway

    • NAT Gateway

    • Elastic IP Address for NAT Gateway

    • Security Groups

    • SSH Keys
  4. To password-protect your AWS connection details, turn on the Secure configuration details with a password toggle, enter a password, and then retype it to confirm.

    This is optional but recommended. When you share the connection details with multiple users, password protection helps you ensure authorized access to the connection details.

  5. After you save and activate the configured AWS connection details, you can see them listed in the Cloud Platforms section on the Cloud Platform, Tools & Technologies screen.

Prerequisites

User Input required in Calibo Accelerate Required Permissions Additional Details

Subscription ID

Tenant ID

Client ID

  • Application Gateway full access

  • ACR pull/push

  • Cost Analysis read

  • Microsoft.Authorization read

  • VM instance creation/deletion

  • VNET/subnet creation

  • NSG creation

  • AKS: describe, get cluster

  • Resource group read / create access

  • Storage Read

Azure Subscription is required to provision the technology stack and application deployment.

The Calibo Accelerate platform connects with your Azure account by using the provided credential details.

  1. Environment Name: Provide a local name to your cloud account environment. Your Microsoft Azure account connection details are saved by this name in the Calibo Accelerate platform.

  2. Description: Provide a description of your configuration. When you save connection details of multiple cloud accounts in the Calibo Accelerate platform, a brief description always helps you identify the saved connection details easily.

  3. Subscription ID: Enter the unique alphanumeric identifier for your Microsoft Azure subscription.

  4. Tenant ID: Enter your unique identifier for the Azure AD (Active Directory) tenant.

  5. Client ID: Enter the unique identifier for your application (service principal) in Azure AD.

  6. Select Secret Manager

    In this section, you can directly key in the credentials to connect to your Microsoft Azure resources, or choose to retrieve them programmatically from Azure Key Vault depending on your secrets management preferences.

    Do one of the following:

    • Select Calibo Accelerate, type your Client Secret Key, and select the Azure region where your resources are located. In this case, your Microsoft Azure credentials are securely stored in the Calibo-managed secrets store.
    • Select Azure Key Vault. In the Vault Configuration dropdown list, the Azure Key Vault configurations that you save and activate in the Vault Configuration section on the Cloud Platform, Tools & Technologies screen are listed for selection. Select the desired configuration from the dropdown list. Provide the Vault Name and Client Secret Key and select the Azure region where your resources are located. This helps the Calibo Accelerate platform retrieve the credential values programmatically.
  7. Test Connection: Click Test Connection to check if you can connect to the configured Azure account successfully.

  8. Configure Virtual Network for Tech Stack Deployment:

    In Azure, a Virtual Network (VNet) is a fundamental building block that allows you to logically isolate and securely connect Azure resources, such as virtual machines, to the internet and to each other. It acts as a representation of your own network in the cloud.

    From within the Calibo Accelerate platform, you can either connect to your existing Azure virtual network or create a new virtual network for technology deployments.

    To configure an Azure virtual network for technology deployments, turn on the toggle.

    In the Configure Virtual Network for Technology Deployment section, either specify the details of an existing Azure virtual network or create a new Azure virtual network.

    Depending on your choice, do either of the following:

    Specify the following details:

    Field Description
    Image ID (Optional) Provide your Azure instance image ID.
    Resource Group The Azure resource group is a logical container for resources deployed in Azure. Select the desired resource group from the list of your existing resource groups or enter the desired resource group where your virtual network is located.
    Virtual Network This is the Azure Virtual Network to which you want to connect from the Calibo Accelerate platform. Select the desired virtual network from the list of your existing virtual networks or enter the desired virtual network name.
    Private Subnets Private subnets are used to host resources that should not be directly accessible from the internet. Enter at least one private subnet ID within the chosen virtual network. A subnet ID should begin with a letter or number, end with a letter, number or underscore, and may contain only letters, numbers, underscores, periods, or hyphens.
    Public Subnets (Optional) Public subnets are used for resources that require internet access. If needed, specify at least one public subnet ID within the chosen virtual network. A subnet ID should begin with a letter or number, end with a letter, number or underscore, and may contain only letters, numbers, underscores, periods, or hyphens.
    Application Gateway Subnet (Optional)

    Enter or select the subnet from the dropdown list where the Application Gateway is located. This is an optional field.

    Network Security Group for Virtual Machine Enter or select the Network Security Group (NSG) that is associated with the virtual machines in the chosen virtual network.
    Application Security Group (Optional) Enter or select the Application Security Group if applicable. This is an optional field.
    SSH Key Name Enter or select the SSH key name from the list. This key is used for secure access to virtual machines.

     

    Specify the following details:

    Field Description
    Virtual Network Address Space Enter the desired IPv4 address space for the Azure virtual network. This defines the range of private IP addresses that can be used within the virtual network. The address space for a virtual network is composed of one or more non-overlapping address ranges that are specified in CIDR notation. For detailed information about virtual network address space, refer to the Microsoft Azure documentation.
    Resource Group (Optional) Azure resource group is a logical container for resources deployed in Azure. Enter or select the Azure resource group where you want to deploy the new virtual network. This is an optional field.
    Private Subnets Private subnets are used to host resources that should not be directly accessible from the internet. Specify at least one private subnet for your virtual network. Public Subnet should begin with a letter or number, end with a letter, number or underscore, and may contain only letters, numbers, underscores, periods, or hyphens.
    Public Subnets (Optional) Public subnets are used for resources that require internet access. If needed, specify at least one public subnet within the chosen virtual network. Public Subnet should begin with a letter or number, end with a letter, number or underscore, and may contain only letters, numbers, underscores, periods, or hyphens.
    Application Gateway Subnet (Optional)

    Enter or select the subnet from the dropdown list where the Application Gateway is located. This is optional and applicable if you are using an Application Gateway.
    Network Security Group for Virtual Machine Enter or select the Network Security Group (NSG) that is associated with the virtual machines in the chosen virtual network.
    Application Security Group (Optional) Enter or select the Application Security Group if applicable. This is an optional field.
    SSH Key Name Enter or select the SSH key name from the list. This key is used for secure access to virtual machines.
  9. To password-protect your Azure connection details, turn on the Secure configuration details with a password toggle, enter a password, and then retype it to confirm.

    This is optional but recommended. When you share the connection details with multiple users, password protection helps you ensure authorized access to the connection details.

  10. After you save and activate the configured Azure connection details, you can see them listed in the Cloud Platforms section on the Cloud Platform, Tools & Technologies screen.

Prerequisites

Before configuring Google Cloud Platform (GCP) in Calibo Accelerate, ensure that:

  • An active Google Cloud account is available.

  • A Google Cloud project with an active billing account is available.

  • You have sufficient permissions to create service accounts, assign IAM roles, enable the required APIs, and configure Workload Identity Federation.

  • A Google Cloud service account with the required IAM roles is available or can be created during setup.

  • The Google Cloud CLI (gcloud) is installed and authenticated if you plan to run the provided setup script.

  • You have the required AWS account and role information if you use Workload Identity Federation.

To save the connection properties of your GCP account, provide the following details:

  1. Environment Name: Provide a local name to your cloud account environment. Your GCP account connection details are saved by this name in the Calibo Accelerate platform.

  2. Description: Provide a description of your configuration. When you save connection details of multiple cloud accounts in the Calibo Accelerate platform, a brief description always helps you identify the saved connection details easily.

  3. Project ID - Enter the ID of the Google Cloud project that Calibo Accelerate uses to discover and manage cloud resources. You can find it under Project info on the Google Cloud console dashboard.

  4. Under Select Authentication Method, select one of the following options:

    Workload Identity Federation lets Calibo Accelerate authenticate to Google Cloud using your AWS identity, without storing a static key.

    1. Select Workload Identity as the authentication method.

    2. Note the AWS account details displayed on the form — you will use these when configuring the Workload Identity Pool Provider in Google Cloud.

    3. Click View Setup Guide to open the Setup Guide for Workload Identity Federation, which offers three tabs: Manual Setup, Generate Script, and Permissions.

      Manual Setup

      Follow these steps to configure Workload Identity Federation manually:

      Task Details
      Enable Required APIs Enable the IAM, Security Token Service (STS), and IAM Credentials APIs.
      Create a Workload Identity Pool Create a Workload Identity Pool in your Google Cloud project.
      Create a Workload Identity Provider Configure an AWS provider within the pool and trust the AWS account shown on the setup guide page.
      Create or Select a Service Account Create a new service account or use an existing one for the federated workload.
      Configure IAM Access Grant the required Workload Identity Federation and application-specific permissions to the service account (see Permissions below).
      Retrieve project information Locate your Google Cloud Project Number.
      Complete the configuration

      Enter the collected values into the configuration form and save your changes.

      For more information, see Workload Identity Federation in the Google Cloud Documentation.

      Generate Script

      As an alternative to completing the manual setup, use the script template provided in the setup guide or generate a customized script using your Google Cloud project details.

      • Open the Generate Script tab. Alternatively, copy the script template displayed on the Manual Setup tab.

      • Enter the following details:

        • Project ID

        • Project Number

        • Pool ID

        • Provider ID

        • Service Account Name

        The script automatically uses the AWS account ID and AWS role name displayed in the setup guide.

      • Click Generate Script.

      • Review the generated script and then copy or download it.

      • Run the script in your environment. At a high level, the script performs the following actions:

        • Sets the specified Google Cloud project as the active project.

        • Creates the service account if it does not already exist.

        • Assigns the following predefined IAM roles to the service account:

          • roles/compute.viewer

          • roles/compute.instanceAdmin.v1

          • roles/compute.loadBalancerAdmin

          • roles/container.viewer

        • Creates or updates a custom IAM role containing the required permissions for managing VPC networks, subnets, routes, Cloud Routers, firewall rules, and external IP addresses.

        • Assigns the custom IAM role to the service account.

        • Optionally assigns the roles/billing.viewer role to the service account at the Cloud Billing account level when billing access is enabled in the script.

        • Enables the following APIs:

          • Identity and Access Management (IAM) API

          • Security Token Service API

          • Service Account Credentials API

          • Cloud Resource Manager API

        • Restricts access to the specified AWS account and AWS role.

        • Grants the federated AWS principal the roles/iam.workloadIdentityUser role on the Google Cloud service account.

        • After the script completes, record the resulting Service Account Email, Project Number, Pool ID, and Provider ID. You need these values to complete the configuration form.

        Permissions

        On the Permissions tab, review the IAM roles and permissions required by Calibo Accelerate. Ensure that the Google Cloud service account has the following access:

        Resource IAM role or permission Purpose
        Compute roles/compute.viewer Discovers virtual machines, instance groups, machine images, and zones.
        roles/compute.instanceAdmin.v1 Creates and manages Compute Engine instances used as deployment targets.
        roles/compute.networkAdmin Manages networking resources associated with Compute Engine instances.
        Load Balancer roles/compute.loadBalancerAdmin Configures and manages application load balancers.
        VPC (optional) compute.networks.create Creates VPC networks.
          compute.networks.get compute.networks.list Retrieves and lists VPC networks.
          compute.subnetworks.create Creates subnets.
          compute.subnetworks.get compute.subnetworks.list Retrieves and lists subnets.
          compute.routes.create Creates network routes.
          compute.routes.get compute.routes.list Retrieves and lists routing configurations.
          compute.routers.create Creates Cloud Routers.
          compute.routers.get compute.routers.list compute.routers.update Retrieves, lists, and updates Cloud Router configurations.
        Firewall (optional) compute.firewalls.get compute.firewalls.list Retrieves and lists VPC firewall rules.
        External IP address (optional) compute.addresses.create compute.addresses.get compute.addresses.list compute.addresses.use Creates, retrieves, lists, and uses external IP addresses.
        VPC policy (optional) compute.networks.updatePolicy Updates the IAM policy associated with a VPC network.
        Google Kubernetes Engine roles/container.viewer Discovers and views GKE clusters and related Kubernetes resources.
        Workload Identity Federation roles/iam.workloadIdentityUser Allows the trusted AWS workload to impersonate the Google Cloud service account without using a service account key.

      After completing the Google Cloud setup, close the setup guide and enter the following values in the GCP configuration form:

      • Service Account Email : Enter the email address of the Google Cloud service account that the federated workload will impersonate. For example, calibo-secret-reader@my-project.iam.gserviceaccount.com.

      • Project Number: Enter the numeric identifier of the Google Cloud project that contains the workload identity pool. You can find it under Project info on the Google Cloud console dashboard.

      • Pool ID: Enter the unique ID of the workload identity pool. To find it, go to IAM & Admin > Workload Identity Federation, and select the required pool.

      • Provider ID: Enter the unique ID of the AWS provider created in the workload identity pool. To find it, open the required pool under Workload Identity Federation, and select the provider.

      Click Test Connection to verify that Calibo Accelerate can connect to the Google Cloud project using Workload Identity Federation.

    1. Select Service Account as the authentication method.

    2. Click View Setup Guide to open the Setup Guide for Service Account, which offers two tabs: Manual Setup and Permissions.

    Manual Setup

    Follow these steps to create and configure the service account:

    Task Details
    Create or select a Service Account Create a new service account or select an existing one that will be used by this integration.
    Assign Required IAM Roles Grant the service account the required IAM roles based on the Google Cloud resources it needs to access (see Permissions below).
    Create a Service Account Key Generate a JSON key for the service account and securely download it.

    For more information, see Create service accounts in the Google Cloud Documentation.

    Use the Script Template

    As an alternative to completing the manual setup, you can use the script template provided in the setup guide.

    • Click the Download icon to save the script or click the Copy icon to copy it to your clipboard.

    • Replace the following placeholder values with your Google Cloud configuration details.

    • Run the script in your environment. At a high level, the script performs the following actions:

      • Sets the specified Google Cloud project as the active project.

      • Checks whether the specified service account exists and creates it if required.

      • Assigns the following project-level IAM roles to the service account:

        Creates or updates a custom IAM role containing the required permissions to:

        • Create, retrieve, and list VPC networks.

        • Create, retrieve, and list subnets.

        • Create, retrieve, and list routes.

        • Create, retrieve, list, and update Cloud Routers.

        • Retrieve and list firewall rules.

        • Create, retrieve, list, and use external IP addresses.

    • If service account authentication is selected, create and download a JSON key for the service account.

    Permissions

    • On the Permissions tab, review the IAM roles and permissions required by Calibo Accelerate. Ensure that the Google Cloud service account has the following access:
      ResourceIAM role or permissionPurpose
      Compute roles/compute.viewer Discovers virtual machines, instance groups, machine images, and zones.
      roles/compute.instanceAdmin.v1 Creates and manages Compute Engine instances used as deployment targets.
      roles/compute.networkAdmin Manages networking resources associated with Compute Engine instances.
      Load Balancerroles/compute.loadBalancerAdminConfigures and manages application load balancers.
      VPC (optional)compute.networks.createCreates VPC networks.
      compute.networks.get compute.networks.list Retrieves and lists VPC networks.
      compute.subnetworks.createCreates subnets.
      compute.subnetworks.get compute.subnetworks.list Retrieves and lists subnets.
      compute.routes.createCreates network routes.
      compute.routes.get compute.routes.list Retrieves and lists routing configurations.
      compute.routers.createCreates Cloud Routers.
      compute.routers.get compute.routers.list compute.routers.update Retrieves, lists, and updates Cloud Router configurations.
      Firewall (optional)compute.firewalls.get compute.firewalls.list Retrieves and lists VPC firewall rules.
      External IP address (optional)compute.addresses.create compute.addresses.get compute.addresses.list compute.addresses.use Creates, retrieves, lists, and uses external IP addresses.
      VPC policy (optional)compute.networks.updatePolicyUpdates the IAM policy associated with a VPC network.
      Google Kubernetes Engineroles/container.viewerDiscovers and views GKE clusters and related Kubernetes resources.
      Workload Identity Federationroles/iam.workloadIdentityUserAllows the trusted AWS workload to impersonate the Google Cloud service account without using a service account key.

    • Select Secret Manager
      In this section, you can either upload and store your GCP service account credentials directly in Calibo Accelerate or retrieve them programmatically from Google Secret Manager, depending on your secrets management preferences.

      Do one of the following:

      • Option 1: Calibo Accelerate (built-in secrets store)

        Select Calibo to store the GCP service account credentials securely in the Calibo-managed secrets store.

        • Select Calibo under Select Secret Manager.

        • Upload the GCP service account JSON Key file. You can drag and drop the file or browse and select it from your local system.

        • After the file is uploaded, Calibo Accelerate automatically extracts and populates the following information:

          Field Description
          Service Account Email Displays the service account email from the client_email property in the JSON key.
          Private Key ID Displays the private key identifier associated with the uploaded service account.

          • Then click Test Connection to verify that Calibo Accelerate can successfully connect to the GCP account using the uploaded credentials.

        • Option 2: Google Secret Manager

          Select Google Secret Manager. In the Secret Manager Tools dropdown list, the Google Secret Manager configurations that you save and activate in the Secret Management section on the Cloud Platform, Tools & Technologies screen are available for selection.

          Select your desired secrets management tool configuration. Provide the Service Account JSON Key so that Calibo Accelerate can securely fetch the Private Key ID and Service Account Email at runtime.

          Then click Test Connection to verify that Calibo Accelerate can successfully connect to the configured GCP account.

    Return to the GCP configuration form in Calibo Accelerate

  1. Secure configuration details with a password

    To password-protect your GCP connection details, turn on the Secure configuration details with a password toggle, enter a password, and then retype it to confirm.

    This is optional but recommended. When you share the connection details with multiple users, password protection helps you ensure authorized access to the connection details.

  1. After you Save and Activate the configured GCP connection details, you can see them listed in the Cloud Platforms section on the Cloud Platform, Tools & Technologies screen.

Related Topics Link IconRecommended Topics What's next? Configure Technologies and Testing Tools