> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rootly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Cloud

> Connect Rootly AI to selected Google Cloud projects for read-only investigations across logs, metrics, alerts, Cloud Run, GKE, and Compute Engine.

## Overview

Connecting Google Cloud gives Rootly AI **read-only access** to operational data in the projects you select. During an investigation, Rootly AI can correlate Cloud Logging entries, Cloud Monitoring metrics and alerts, Cloud Run services, Google Kubernetes Engine (GKE) workloads, and Compute Engine instances.

The connection uses Google OAuth and Google's managed Model Context Protocol (MCP) servers. Rootly does not ask you to create or paste a service-account key.

<Note>
  Authorizing Google establishes which projects the Google identity is allowed to see. The project multi-select in Rootly is a separate boundary: Rootly AI only queries—and, when AI facts ingestion is enabled, ingests facts from—the projects you explicitly select.
</Note>

<Note>
  This AI connector is separate from the [Google Cloud Monitoring alert source](/integrations/google-cloud-monitoring). The alert source sends monitoring events into Rootly; this connector lets Rootly AI read selected Google Cloud projects during investigations. Configure both when you need both behaviors.
</Note>

***

## Before You Start

You'll need:

* **A Google account** with read access to the projects you want Rootly AI to investigate.
* **MCP Tool User (`roles/mcp.toolUser`)** on each selected project. Google requires this role to call managed MCP tools.
* **Google Cloud IAM permissions** for the data you expect Rootly AI to read. OAuth does not grant access that the Google account does not already have.
* **At least one active Google Cloud project** selected during setup.

For broad investigation coverage, the authorizing identity typically needs read access to Cloud Resource Manager, Cloud Logging, Cloud Monitoring, Cloud Run, GKE, and Compute Engine. Your organization can grant a narrower set if Rootly AI only needs some of those products. See [Google Cloud MCP access control](https://docs.cloud.google.com/mcp/access-control) for Google's current role requirements.

<Warning>
  Prefer a dedicated Google Workspace user with only the required viewer permissions. A personal account can break the connection when that person leaves the organization or loses project access.
</Warning>

***

## Connecting

<Steps>
  <Step title="Start The Google Cloud Connection">
    Open **AI & Agents → Connectors**, find **Google Cloud**, and click **Connect**.
  </Step>

  <Step title="Authorize Rootly In Google">
    Sign in to Google, review the requested read access, and approve the connection. Google returns you to Rootly after authorization.
  </Step>

  <Step title="Select Projects">
    Search the project multi-select and choose up to 50 Google Cloud projects Rootly AI should use. The list contains active projects visible to the Google identity, including each project's display name and project ID. If a visible project is not in the list, enter its exact project ID for Rootly to verify.
  </Step>

  <Step title="Save And Verify">
    Save the selection. Rootly verifies the connection. When AI facts ingestion is enabled for your account, Rootly also begins ingesting project facts for the selected projects.
  </Step>
</Steps>

<ParamField path="Google Cloud Projects" type="multi-select" required>
  Select one or more projects. This selection provides the project scope for investigation tools and bounds optional background fact ingestion when that feature is enabled.

  OAuth authorization and project selection are independent. Adding another visible project later does not require another OAuth flow. Rootly displays up to 500 discovered projects; for larger organizations, use **Add projects by exact ID** to verify and select projects outside that displayed set.
</ParamField>

<Note>
  Rootly never treats "all projects visible to this Google account" as permission to crawl them all. Newly created projects and projects granted to the identity later remain unselected until an administrator adds them in Rootly.
</Note>

***

## What Rootly AI Can Read

For the selected projects, Rootly AI can use:

* **Cloud Resource Manager** — discover project IDs, names, numbers, folders, and organizations.
* **Cloud Logging** — list log names and query entries with filters and time windows.
* **Cloud Monitoring** — query time series, metric descriptors, alert policies, and active alerts.
* **Cloud Run** — list services and inspect service configuration and status.
* **Google Kubernetes Engine** — list clusters, inspect Kubernetes resources, review rollout status and events, and read workload logs.
* **Compute Engine** — list instances and inspect basic instance state.

All calls use an allowlist of reviewed, read-only tools. Rootly AI cannot create, update, restart, scale, or delete Google Cloud resources.

### Project And Workload Ingestion

When AI facts ingestion is enabled, Rootly records selected projects, their organization or folder hierarchy, and Cloud Run services as infrastructure facts. These facts help it resolve human names such as `payments-prod` or `checkout` to the correct Google Cloud resource during an investigation. GKE resources, Compute Engine instances, logs, metrics, and alerts remain on-demand; Rootly does not persist those raw inventories or telemetry as facts.

AI facts ingestion availability depends on your Rootly account rollout. If you need to confirm whether it is enabled for your account, contact Rootly Support. Live investigation tools remain available for the selected projects even when background fact ingestion is not enabled.

Workload ingestion is bounded by the saved project selection. Removing a project purges the facts authored for that project, stops future ingestion, and prevents it from being used as an investigation-tool scope. It does not revoke the Google identity's IAM access; revoke or narrow that access in Google Cloud when you need an enforcement boundary outside Rootly.

***

## During an Incident

You can ask natural questions such as:

* *"Why did checkout errors spike in `store-prod` during the last 20 minutes? Correlate logs and request metrics."*
* *"Are any Cloud Monitoring alerts firing for the payment service, and what changed in its error logs?"*
* *"Is the Cloud Run checkout service healthy in `us-central1`?"*
* *"Did the GKE deployment finish rolling out, and are its pods restarting?"*
* *"Which Compute Engine instances in this project are stopped or unhealthy?"*

If a project name is ambiguous, Rootly AI uses discovered project facts to resolve it or asks you to choose among the selected projects.

***

## Adjusting Project Scope

<Steps>
  <Step title="Open The Google Cloud Connector">
    Go to **AI & Agents → Connectors** and click **Configure** on the Google Cloud card.
  </Step>

  <Step title="Update The Project Selection">
    Add or remove projects in the multi-select. Rootly only shows active projects currently visible to the connected Google identity.
  </Step>

  <Step title="Save">
    Save the selection. Added projects become available for investigations and, when AI facts ingestion is enabled, background refreshes. Removed projects are excluded from future queries and refreshes.
  </Step>
</Steps>

If Google definitively reports that a selected project is no longer visible, Rootly blocks live calls to that project and purges the facts it authored for that project. If other selected projects remain visible, the connection stays available. If none remain visible, the connector requires reconfiguration. Transient discovery failures do not replace the last successful fact snapshot with an empty inventory.

***

## Best Practices

* **Select only operational projects Rootly AI needs.** Do not select sandbox, personal, or unrelated projects merely because the identity can see them.
* **Use least-privilege viewer roles.** Grant read access only to the Google Cloud products needed for investigations.
* **Use a stable identity.** A dedicated Google Workspace user avoids coupling the OAuth connection to an employee lifecycle.
* **Separate environments deliberately.** Select production and staging only when responders need both, and use clear project display names so questions resolve predictably.
* **Review project scope after organization changes.** Migrations between folders or organizations can change inherited IAM access.
* **Audit access in Google Cloud.** Google Cloud audit logs remain the authoritative record of API calls and IAM changes.

***

## Troubleshooting

<AccordionGroup>
  <Accordion title="A project is missing from the project picker" icon="magnifying-glass">
    Rootly displays at most 500 projects. First enter the exact project ID in **Add projects by exact ID**; Rootly verifies it before saving. If verification fails, confirm the project is active, appears for the same identity in Google Cloud Console, and grants the identity Resource Manager visibility and `roles/mcp.toolUser`.
  </Accordion>

  <Accordion title="Authorization succeeds but verification fails" icon="triangle-exclamation">
    OAuth completed, but Rootly could not discover all required managed MCP tools or make a read call. Check that the required Google Cloud APIs are available to the identity, then reconnect. Organization policies that block OAuth applications can also prevent verification.
  </Accordion>

  <Accordion title="Some tools work while logs, metrics, or workloads fail" icon="lock">
    Google Cloud IAM is product-specific. The identity may be able to discover the project but lack viewer access to Logging, Monitoring, Cloud Run, GKE, or Compute Engine. Test the same resource with that identity in Google Cloud Console and add only the missing viewer permissions.
  </Accordion>

  <Accordion title="A selected project was deleted or access was removed" icon="folder-minus">
    Open **Configure**. Rootly identifies previously selected projects that are no longer visible so you can save a repaired scope. If access was removed accidentally, restore IAM permissions first and reopen the connector. Rootly does not use the loss of access as a signal to crawl a different project.
  </Accordion>

  <Accordion title="The connection stopped working after a Google account change" icon="plug-circle-xmark">
    Reconnect Google Cloud and select the projects again. Password changes normally do not revoke OAuth by themselves, but account suspension, administrator revocation, or removal of IAM access does.
  </Accordion>
</AccordionGroup>

***

## Frequently Asked Questions

<AccordionGroup>
  <Accordion title="Can I select multiple Google Cloud projects?" icon="layer-group">
    Yes. One OAuth connection can authorize access to multiple projects. Rootly's multi-select stores the subset that Rootly AI may use during investigations and, when enabled, background fact ingestion.
  </Accordion>

  <Accordion title="Does selecting projects change Google Cloud IAM?" icon="key">
    No. Project selection only narrows Rootly's behavior. Google Cloud IAM controls what the connected identity can access, and Rootly cannot expand that access.
  </Accordion>

  <Accordion title="Will Rootly automatically ingest new projects?" icon="circle-plus">
    No. Even if the Google identity can see a newly created project, a Rootly administrator must explicitly add it to the connector's project selection.
  </Accordion>

  <Accordion title="Can I connect with a Google Cloud service account?" icon="robot">
    Not currently. The connector uses Google user OAuth and does not accept uploaded service-account JSON keys. Use a dedicated Google Workspace user with least-privilege access when you need an identity that is independent of an individual responder.
  </Accordion>

  <Accordion title="Is the integration read-only?" icon="lock">
    Yes. Rootly exposes only reviewed read tools from Google's managed MCP servers. It does not expose mutation tools or use the connection to alter resources.
  </Accordion>

  <Accordion title="How do I fully disconnect Google Cloud?" icon="trash">
    Disconnect the Google Cloud card in Rootly to remove the stored OAuth credentials, stop ingestion, and delete the Google Cloud facts authored by this connector, including selected project, hierarchy, and Cloud Run service facts. Historical investigation context remains unchanged. For defense in depth, also revoke Rootly's OAuth access from the Google account or your Google Workspace administrator controls.
  </Accordion>
</AccordionGroup>

***

## Related Pages

<CardGroup cols={2}>
  <Card title="Connectors Overview" icon="sparkles" href="/ai/connectors/overview">
    The full list of connectors and how they fit together.
  </Card>

  <Card title="Data Privacy for Rootly AI" icon="shield" href="/ai/data-privacy-for-rootly-ai">
    What Rootly AI sees, retention, and model-training controls.
  </Card>

  <Card title="Google Cloud Monitoring Alert Source" icon="bell" href="/integrations/google-cloud-monitoring">
    Send Google Cloud Monitoring alerts into Rootly for routing and response.
  </Card>

  <Card title="Google Cloud managed MCP servers" icon="up-right-from-square" href="https://docs.cloud.google.com/mcp/supported-products">
    Google's reference for managed MCP products and tools.
  </Card>
</CardGroup>