Google Cloud

​

Overview

​

Before You Start

• Rootly administrator access to configure AI connectors.
• MCP Tool User (roles/mcp.toolUser) on each selected project. Google requires this role to call managed MCP tools.
• Google Cloud IAM permissions for the data you expect Rootly AI to read. Neither authentication method grants access that the connected identity does not already have.
• At least one active Google Cloud project selected during setup.

​

Choose An Authentication Method

​

Google OAuth

​

Workload Identity Federation

​

Configure Google Cloud For Workload Identity Federation

export TRUST_PROJECT_ID="your-security-project"
export TRUST_PROJECT_NUMBER="123456789012"
export QUOTA_PROJECT_ID="your-quota-project"
export POOL_ID="rootly-ai"
export PROVIDER_ID="rootly"
export SERVICE_ACCOUNT_ID="rootly-ai-reader"
export ROOTLY_ISSUER="https://your-rootly-issuer.example"
export ROOTLY_SUBJECT="copy-the-exact-subject-from-rootly"
export PROVIDER_RESOURCE="projects/${TRUST_PROJECT_NUMBER}/locations/global/workloadIdentityPools/${POOL_ID}/providers/${PROVIDER_ID}"
export ROOTLY_AUDIENCE="https://iam.googleapis.com/${PROVIDER_RESOURCE}"
export SERVICE_ACCOUNT_EMAIL="${SERVICE_ACCOUNT_ID}@${TRUST_PROJECT_ID}.iam.gserviceaccount.com"
export ROOTLY_PRINCIPAL="principal://iam.googleapis.com/projects/${TRUST_PROJECT_NUMBER}/locations/global/workloadIdentityPools/${POOL_ID}/subject/${ROOTLY_SUBJECT}"

gcloud services enable sts.googleapis.com iamcredentials.googleapis.com \
  --project="${TRUST_PROJECT_ID}"

gcloud iam workload-identity-pools create "${POOL_ID}" \
  --project="${TRUST_PROJECT_ID}" \
  --location="global" \
  --display-name="Rootly AI"

gcloud iam workload-identity-pools providers create-oidc "${PROVIDER_ID}" \
  --project="${TRUST_PROJECT_ID}" \
  --location="global" \
  --workload-identity-pool="${POOL_ID}" \
  --issuer-uri="${ROOTLY_ISSUER}" \
  --allowed-audiences="${ROOTLY_AUDIENCE}" \
  --attribute-mapping="google.subject=assertion.sub" \
  --attribute-condition="assertion.sub == '${ROOTLY_SUBJECT}'"

gcloud iam service-accounts create "${SERVICE_ACCOUNT_ID}" \
  --project="${TRUST_PROJECT_ID}" \
  --display-name="Rootly AI read-only"

gcloud iam service-accounts add-iam-policy-binding "${SERVICE_ACCOUNT_EMAIL}" \
  --project="${TRUST_PROJECT_ID}" \
  --role="roles/iam.workloadIdentityUser" \
  --member="${ROOTLY_PRINCIPAL}"

export SELECTED_PROJECT_ID="your-production-project"

for ROLE in \
  roles/browser \
  roles/cloudasset.viewer \
  roles/logging.viewer \
  roles/monitoring.viewer \
  roles/run.viewer \
  roles/compute.viewer \
  roles/mcp.toolUser; do
  gcloud projects add-iam-policy-binding "${SELECTED_PROJECT_ID}" \
    --member="serviceAccount:${SERVICE_ACCOUNT_EMAIL}" \
    --role="${ROLE}"
done

gcloud services enable \
  cloudresourcemanager.googleapis.com \
  iamcredentials.googleapis.com \
  logging.googleapis.com \
  monitoring.googleapis.com \
  run.googleapis.com \
  compute.googleapis.com \
  cloudasset.googleapis.com \
  --project="${QUOTA_PROJECT_ID}"

gcloud projects add-iam-policy-binding "${QUOTA_PROJECT_ID}" \
  --member="${ROOTLY_PRINCIPAL}" \
  --role="roles/serviceusage.serviceUsageConsumer"

gcloud projects add-iam-policy-binding "${QUOTA_PROJECT_ID}" \
  --member="serviceAccount:${SERVICE_ACCOUNT_EMAIL}" \
  --role="roles/serviceusage.serviceUsageConsumer"

​

Connecting

​

What Rootly AI Can Read

• Cloud Resource Manager — discover project IDs, names, numbers, folders, and organizations.
• Cloud Logging — list log names and query entries with filters and time windows.
• Cloud Monitoring — query time series, metric descriptors, alert policies, and active alerts.
• Cloud Run — list services and inspect service configuration and status.
• Compute Engine — list instances and inspect basic instance state.

​

Project And Workload Ingestion

​

During an Incident

• “Why did checkout errors spike in store-prod during the last 20 minutes? Correlate logs and request metrics.”
• “Are any Cloud Monitoring alerts firing for the payment service, and what changed in its error logs?”
• “Is the Cloud Run checkout service healthy in us-central1?”
• “Which Compute Engine instances in this project are stopped or unhealthy?”

​

Adjusting Project Scope

​

Best Practices

• Select only operational projects Rootly AI needs. Do not select sandbox, personal, or unrelated projects merely because the identity can see them.
• Use least-privilege viewer roles. Grant read access only to the Google Cloud products needed for investigations.
• Use a stable identity. Prefer Workload Identity Federation for durable background ingestion. If you use OAuth, a dedicated Google Workspace user avoids coupling the connection to an employee lifecycle.
• Bind the exact Rootly subject. Do not grant roles/iam.workloadIdentityUser to an entire workload identity pool. Bind the principal://.../subject/... value shown for your Rootly team.
• Separate environments deliberately. Select production and staging only when responders need both, and use clear project display names so questions resolve predictably.
• Review project scope after organization changes. Migrations between folders or organizations can change inherited IAM access.
• Audit access in Google Cloud. Google Cloud audit logs remain the authoritative record of API calls and IAM changes.

​

Troubleshooting

​

Frequently Asked Questions

​

Related Pages