Skip to content

Commit

Permalink
minor edits for readme, removing reference to appscript project creat…
Browse files Browse the repository at this point in the history
…ion.
  • Loading branch information
nyoung committed Oct 21, 2020
1 parent a4afcdb commit fa94604
Showing 1 changed file with 13 additions and 10 deletions.
23 changes: 13 additions & 10 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,12 @@ This repo will let you audit all the IAM settings on projects in the GCP organiz

Create the a Virtual Machine (VM) in the Google Compute Engine dashboard.

**NOTE:** You are allowed [1 free F1-micro instance per month](https://cloud.google.com/free/) in your Google environment.

If you don't see the ability to create an F1-micro instance from the dashboard, you can use the following example command in Cloud Shell to create one:

```gcloud compute instances create <instance-name> --machine-type=f1-micro --zone=us-east1-b```

Once the VM instance has been created, stop the VM instance and change the following setting:

Cloud API access scopes
Expand All @@ -26,18 +32,14 @@ Install pip3:
Install pandas:
```sudo pip install pandas```

**NOTE:** You are allowed [1 free F1-micro instance per month](https://cloud.google.com/free/) in your Google environment.

If you don't see the ability to create an F1-micro instance from the dashboard, you can use the following example command in Cloud Shell to create one:

```gcloud compute instances create <instance-name> --machine-type=f1-micro --zone=us-east1-b```


### IAM Role ###

The service account running the machine will need to have rights to query the organization, folders, and projects for the IAM policies.

Create a role under the main organization with the following permissions:
Create a role under the main organization (at the root level) with the following permissions:

orgpolicy.policy.get
resourcemanager.folders.get
Expand All @@ -52,12 +54,9 @@ Once the role has been created, add the VM instance's service account to the rol

### Create BigQuery Table ###

Create a table for the audit to push to. If you are using separate projects for BigQuery and Compute Engine, you may need to allow the service account permissions to create jobs and insert data into the table.

### Create the AppScript Project ###

Log into [AppScript](https://script.google.com) and create a new project. Take note of the project ID for later use.
Create a new BigQuery table for this process to dump information to.

Note: If you are using separate projects for BigQuery and Compute Engine, you may need to allow the service account permissions to create jobs and insert data into the table.

### Install & Configure ###

Expand All @@ -79,7 +78,11 @@ Use crontab (or your favorite scheduler) to execute the script on your desired s
### Who do I talk to? ###

* Nick Young
* Enterprise Analytics Architect
* University of North Carolina at Greensboro
* nickyoung@uncg.edu

* Tim Watts
* Integrations Specialist
* University of North Carolina at Greensboro
* timwatts@uncg.edu

0 comments on commit fa94604

Please sign in to comment.