--- title: Integrations and custom roles source: https://docs.newrelic.com/docs/infrastructure/google-cloud-platform-integrations/get-started/integrations-custom-roles --- New Relic reads data from your GCP account using the Google Stackdriver API and other service-specific APIs. To access these APIs, the New Relic authorized account needs permissions that GCP grants through roles. The exact APIs, roles, and permissions depend on how you connect GCP to New Relic. ## APIs to enable [#apis-to-enable] Before you connect, enable the required Google Cloud APIs in each project you want to monitor, using the **API & Services** library. | Connection method | APIs to enable | | -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Workload Identity Federation** | - [IAM API](https://console.cloud.google.com/apis/library/iam.googleapis.com?pli=1): manage service account access - [Security Token Service API](https://console.cloud.google.com/apis/library/sts.googleapis.com): exchange tokens during WIF authentication - [Service Account Credentials API](https://console.cloud.google.com/apis/library/iamcredentials.googleapis.com): generate short-lived access tokens - [Stackdriver Monitoring API](https://console.cloud.google.com/apis/library/monitoring.googleapis.com): read metrics from GCP Cloud Monitoring - [Asset API](https://console.cloud.google.com/apis/library/cloudasset.googleapis.com): discover resources and metadata - [Cloud Resource Manager API](https://console.cloud.google.com/apis/library/cloudresourcemanager.googleapis.com): get display name of folder | | **New Relic service account** | Google Stackdriver Monitoring API | ## Required roles [#roles] For most setups, the GCP primitive role `Viewer` (`roles/viewer`) is sufficient. It provides [read-only access to existing resources and data](https://cloud.google.com/iam/docs/understanding-roles) without affecting your infrastructure state, and Google manages and updates it automatically as GCP services change. For tighter permission control, use a [custom role](#custom-role) instead. The roles you grant depend on your connection method. ### Workload Identity Federation [#roles-wif] Grant the service account you create these roles on the project: - `Viewer` (`roles/viewer`): read resources - `Service Usage Consumer` (`roles/serviceusage.serviceUsageConsumer`): access enabled APIs - `Cloud Asset Viewer` (`roles/cloudasset.viewer`): view cloud asset metadata - `Folder Viewer` (`roles/resourcemanager.folderViewer`): view folder metadata (required only for integrations configured at the folder level) The service account must also allow impersonation from the identity pool. During setup, you grant the `Workload Identity User` role (`roles/iam.workloadIdentityUser`) to the pool principal. ### Domain restriction constraints [#domain-restrictions] If your organization enforces a [domain restriction constraint](https://cloud.google.com/resource-manager/docs/organization-policy/restricting-domains), update the policy to allow the following New Relic identifiers, depending on which constraint you use: - `iam.allowedPolicyMemberDomains`: allow New Relic domain ID `C02x1gp26` - `iam.managed.allowedPolicyMembers`: allow Organization ID `740422149647` or Project Number `397727728820` ## Use a custom role [#custom-role] To control permissions more precisely than the `Viewer` role allows, create a custom role based on the [list of permissions](#list-permissions), which specifies the minimum set required to fetch data from each GCP integration. > #### ⚠️ IMPORTANT > > New Relic has no way of identifying problems related to custom permissions. If you choose to create a custom role, it is your responsibility to maintain it and ensure it collects the data properly. To set up a custom role: 1. Create a Google Cloud IAM custom role in each GCP project you want to monitor. 2. Add the permissions for the cloud services you want to monitor, using the [list below](#list-permissions). 3. Assign the custom role to the New Relic authorized account. ## List of permissions [#list-permissions] ### Common permissions All integrations need the following permissions: - `monitoring.timeSeries.list` - `serviceusage.services.use` ### Service-specific permissions For some GCP integrations, New Relic also needs the following permissions, mainly to collect tags and other attributes. | Integration | Permissions | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Google AlloyDB](https://docs.newrelic.com/docs/infrastructure/google-cloud-platform-integrations/gcp-integrations-list/google-alloydb-monitoring-integration) | - `alloydb.clusters.get` - `alloydb.clusters.list` - `alloydb.instances.get` - `alloydb.instances.list` | | [Google AppEngine](https://docs.newrelic.com/docs/integrations/google-cloud-platform-integrations/gcp-integrations-list/google-app-engine-monitoring-integration) | Not applicable. Google App Engine does not require additional permissions. | | [Google BigQuery](https://docs.newrelic.com/docs/google-bigquery-integration) | - `bigquery.datasets.get` - `bigquery.tables.get` - `bigquery.tables.list` - `bigquery.jobs.list` | | [Google Bigtable](https://docs.newrelic.com/docs/integrations/google-cloud-platform-integrations/gcp-integrations-list/google-cloud-bigtable-monitoring-integration) | - `bigtable.instances.get` - `bigtable.instances.list` - `bigtable.clusters.get` - `bigtable.clusters.list` - `bigtable.tables.get` - `bigtable.tables.list` - `bigtable.appProfiles.get` - `bigtable.appProfiles.list` | | [Google Cloud API Gateway](https://docs.newrelic.com/docs/integrations/google-cloud-platform-integrations/gcp-integrations-list/google-cloud-api-gateway-monitoring-integration) | - `apigateway.gateways.get` - `apigateway.gateways.list` - `apigateway.apis.get` - `apigateway.apis.list` - `apigateway.apiconfigs.get` - `apigateway.apiconfigs.list` - `apigateway.locations.list` | | [Google Cloud Composer](https://docs.newrelic.com/docs/integrations/google-cloud-platform-integrations/gcp-integrations-list/google-cloud-composer-monitoring-integration) | - `composer.environments.get` - `composer.environments.list` | | [Google Cloud Dataflow](https://docs.newrelic.com/docs/integrations/google-cloud-platform-integrations/gcp-integrations-list/google-cloud-dataflow-monitoring-integration) | - `dataflow.jobs.get` - `dataflow.jobs.list` - `dataflow.messages.list` - `dataflow.metrics.get` | | [Google Cloud Dataproc](https://docs.newrelic.com/docs/integrations/google-cloud-platform-integrations/gcp-integrations-list/google-cloud-dataproc-monitoring-integration) | - `dataproc.clusters.get` - `dataproc.clusters.list` - `dataproc.jobs.get` - `dataproc.jobs.list` | | [Google Cloud Functions](https://docs.newrelic.com/docs/integrations/google-cloud-platform-integrations/gcp-integrations-list/google-cloud-functions-monitoring-integration) | - `cloudfunctions.functions.list` | | [Google Cloud Load Balancing](https://docs.newrelic.com/docs/integrations/google-cloud-platform-integrations/gcp-integrations-list/google-cloud-load-balancing-monitoring-integration) | Not applicable. Google Cloud Load Balancing does not require additional permissions. | | [Google Cloud Pub/Sub](https://docs.newrelic.com/docs/integrations/google-cloud-platform-integrations/gcp-integrations-list/google-cloud-pubsub-monitoring-integration) | - `pubsub.subscriptions.get` - `pubsub.subscriptions.list` - `pubsub.topics.get` - `pubsub.topics.list` | | [Google Cloud Router](https://docs.newrelic.com/docs/integrations/google-cloud-platform-integrations/gcp-integrations-list/google-cloud-router-monitoring-integration) | - `compute.routers.get` - `compute.routers.list` | | [Google Cloud Run](https://docs.newrelic.com/docs/integrations/google-cloud-platform-integrations/gcp-integrations-list/google-cloud-run-monitoring-integration) | - `run.configurations.get` - `run.configurations.list` - `run.locations.list` - `run.revisions.get` - `run.revisions.list` - `run.routes.get` - `run.routes.list` - `run.services.get` - `run.services.list` | | [Google Cloud Spanner](https://docs.newrelic.com/docs/integrations/google-cloud-platform-integrations/gcp-integrations-list/google-cloud-spanner-monitoring-integration) | - `spanner.instances.get` - `spanner.instances.list` - `spanner.databases.get` - `spanner.databases.list` - `spanner.databases.getDdl` | | [Google Cloud SQL](https://docs.newrelic.com/docs/google-cloud-sql-monitoring-integration) | `cloudsql.instances.list` | | [Google Cloud Storage](https://docs.newrelic.com/docs/integrations/google-cloud-platform-integrations/gcp-integrations-list/google-cloud-storage-monitoring-integration) | `storage.buckets.list` | | [Google Compute Engine](https://docs.newrelic.com/docs/integrations/google-cloud-platform-integrations/gcp-integrations-list/google-compute-engine-monitoring-integration) | - `compute.instances.list` - `compute.disks.get` - `compute.disks.list` | | [Google Datastore](https://docs.newrelic.com/docs/integrations/google-cloud-platform-integrations/gcp-integrations-list/google-datastore-monitoring-integration) | - `datastore.databases.get` - `datastore.databases.list` | | [Google Firebase Authentication](https://docs.newrelic.com/docs/infrastructure/google-cloud-platform-integrations/gcp-integrations-list/google-cloud-firebase-auth-monitoring-integration) | - `firebase.projects.get` - `firebaseauth.configs.get` | | [Google Firebase Realtime Database](https://docs.newrelic.com/docs/integrations/google-cloud-platform-integrations/gcp-integrations-list/google-cloud-firebase-database-monitoring-integration) | - `firebase.projects.get` - `firebasedatabase.instances.get` - `firebasedatabase.instances.list` | | [Google Firebase Hosting](https://docs.newrelic.com/docs/integrations/google-cloud-platform-integrations/gcp-integrations-list/google-cloud-firebase-hosting-monitoring-integration) | - `firebase.projects.get` - `firebasehosting.sites.get` - `firebasehosting.sites.list` | | [Google Firebase Storage](https://docs.newrelic.com/docs/integrations/google-cloud-platform-integrations/gcp-integrations-list/google-cloud-firebase-storage-monitoring-integration) | - `firebase.projects.get` - `firebasestorage.buckets.get` - `firebasestorage.buckets.list` | | [Google Firestore](https://docs.newrelic.com/docs/integrations/google-cloud-platform-integrations/gcp-integrations-list/google-cloud-firestore-monitoring-integration) | - `datastore.databases.get` - `datastore.databases.list` | | [Google Kubernetes Engine](https://docs.newrelic.com/docs/integrations/google-cloud-platform-integrations/gcp-integrations-list/google-kubernetes-engine-monitoring-integration) | `container.clusters.list` | | [Google Managed Kafka](https://docs.newrelic.com/docs/infrastructure/google-cloud-platform-integrations/gcp-integrations-list/google-cloud-managed-kafka-monitoring-integration) | - `managedkafka.clusters.get` - `managedkafka.clusters.list` - `managedkafka.topics.get` - `managedkafka.topics.list` - `managedkafka.consumerGroups.get` - `managedkafka.consumerGroups.list` | | [Google Memorystore for Memcached](https://docs.newrelic.com/docs/integrations/google-cloud-platform-integrations/gcp-integrations-list/google-memorystore-memcached) | - `memcache.instances.get` - `memcache.instances.list` | | [Google Memorystore for Redis](https://docs.newrelic.com/docs/integrations/google-cloud-platform-integrations/gcp-integrations-list/google-memorystore-redis) | - `redis.instances.get` - `redis.instances.list` | | [Google Memorystore for Valkey](https://docs.newrelic.com/docs/infrastructure/google-cloud-platform-integrations/gcp-integrations-list/google-memorystore-valkey) | - `memorystore.instances.get` - `memorystore.instances.list` | | [Google Serverless VPC Access](https://docs.newrelic.com/docs/integrations/google-cloud-platform-integrations/gcp-integrations-list/google-serverless-vpc-access-monitoring-integration) | - `vpcaccess.connectors.get` - `vpcaccess.connectors.list` - `vpcaccess.locations.list` | | [Google Vertex AI](https://docs.newrelic.com/docs/integrations/google-cloud-platform-integrations/gcp-integrations-list/google-vertexai-monitoring-integration) | - `aiplatform.endpoints.get` - `aiplatform.endpoints.list` - `aiplatform.models.get` - `aiplatform.models.list` | ### Permissions to link projects through the UI > #### 💡 TIP > > This applies to the **New Relic service account** and **Google user account** connection methods only. With **Workload Identity Federation**, these permissions are not needed: New Relic uses your own service account (which already has the `Viewer` role) to list accessible projects after you establish the WIF connection. To see the list of projects you can link to New Relic through the UI, your New Relic authorized service account needs these permissions: - `resourcemanager.projects.get` - `monitoring.monitoredResourceDescriptors.list` If you prefer not to grant these permissions, you have two alternatives: - Assign the `Role Viewer` or `Monitoring Viewer` role to link projects through the UI, then switch to a custom role after you link the projects. - Use [New Relic NerdGraph](https://docs.newrelic.com/docs/apis/graphql-api/get-started/introduction-new-relic-nerdgraph) to link projects without listing them. You must know the project `id` in advance. See the [NerdGraph GraphiQL cloud integrations API tutorial](https://docs.newrelic.com/docs/apis/graphql-api/tutorials/nerdgraph-graphiql-cloud-integrations-api-tutorial) for details.