Manually integrate your Google Cloud Platform

Workload Identity Federation (WIF) lets New Relic access your GCP metrics using short-lived tokens instead of long-lived keys. You create and control the service account in your own GCP project, so New Relic never stores static credentials.

This guide covers manual setup through the New Relic UI. If you prefer infrastructure as code, see Automate with Terraform.

ヒント

Already have projects connected with a service account? Add new projects with WIF alongside them — both methods work under the same New Relic account. Just follow this guide to add a WIF-based connection.

Requirements

These are the requirements for the integration:

Requirement	Details
New Relic account	You need a New Relic account with admin permissions. If you don't have one already, create a New Relic account.
GCP APIs	In your GCP project's API & Services Library, enable five APIs: IAM, Security Token Service, Service Account Credentials, Stackdriver Monitoring, and Asset. For the full list with links, see Enable required GCP APIs.
GCP permissions	You need permissions to create service accounts, workload identity pools, and IAM bindings — typically the Owner or IAM Admin role.
Service account	You create a service account with the Viewer, Service Usage Consumer, Cloud Asset Viewer, and Folder Viewer roles. New Relic impersonates this account to read your metrics. For setup steps, see Create or select a service account.
Workload Identity Pool	A WIF pool with an OIDC provider configured to trust New Relic. The setup wizard guides you through creating it. For setup steps, see Create a Workload Identity Pool through Configure provider attributes.

重要

Due to security and compliance requirements, you must not use the New Relic GCP integration if your accounts or data fall under FedRAMP. Use of this feature with FedRAMP regulated accounts is strictly prohibited.

Manually integrate GCP

Start the integration in New Relic

Go to Infrastructure > Google Cloud Platform in New Relic.
Select Add a GCP account (or the primary action button if this is your first integration).
Select the New Relic account you want to use.
Under Select instrumentation method, choose Workload Identity Federation.
Under Choose setup method, select Manually integrate your GCP project or folder.

Enable required GCP APIs

Enable these five APIs in your GCP project. They let New Relic authenticate and collect data:
- IAM API: manage service account access
- Security Token Service API: exchange tokens during WIF authentication
- Service Account Credentials API: generate short-lived access tokens
- Stackdriver Monitoring API: read metrics from GCP Cloud Monitoring
- Asset API: discover resources and metadata
- Cloud Resource Manager API: create, read, and update metadata for GCP resource containers.
Confirm the checkbox once all five are enabled, then select Continue.

Create or select a service account

In your GCP project, create a service account for New Relic to impersonate:

In the GCP Console, go to IAM & Admin > Service Accounts.
Create a new service account, or use an existing one.
Assign the following roles to the service account:
- Viewer
- Service Usage Consumer
- Cloud Asset Viewer
- Folder Viewer (required only for integrations configured at the folder level)
Select Save.
重要
To monitor every project in a folder through one connection, grant these roles on the folder instead of on a single project. See Integrate at the folder level.

Create a Workload Identity Pool

A workload identity pool is a container for external identities (such as New Relic) that you trust.

In the GCP Console, go to IAM & Admin > Workload Identity Federation.
Select Get Started (or Create Pool).
Enter a pool name and description, then enable the pool.
Select Continue.

Add an OIDC provider to the pool

This tells GCP to trust tokens signed by New Relic.

Under Select a provider, choose OpenID Connect (OIDC).
Copy these values from the New Relic UI into the GCP Console:
- Provider pool name: shown in the New Relic setup screen.
- Issuer URL: shown in the New Relic setup screen (for example, https://oidc.newrelic.com/r/gcp-cmp).
Under Allowed audiences, select it and keep the default audience unselected.
Copy the Audience URL from the New Relic UI.
Select Continue.

Configure provider attributes

Attribute mappings tell GCP how to read New Relic's tokens. Add these two mappings:

Google attribute	OIDC attribute
`google.subject`	`assertion.sub`
`attribute.nr_account_id`	`assertion.nr_account_id`

The New Relic UI shows your account ID pre-filled. Copy it into the condition field in GCP.

重要

The attribute condition ensures only your New Relic account can use this pool. Without it, any New Relic account could potentially access your GCP project.

Grant access to the pool

Connect the identity pool to your service account so New Relic can impersonate it:

In the pool details, select Grant Access.
Enable Grant access using service account impersonation.
Select the service account you created in the Create or select a service account step.
Under Add principals, select Principal with access.
Add the identity attribute nr_account_id with your New Relic account ID value.
Select Save.

Download and upload the configuration file

This step links your GCP setup to New Relic:

In the GCP Console, in the pool's Connected Service Accounts section, select the service account.
Set these parameters:
- Service Provider: select the provider you just created.
- OIDC ID Token Path: select /
- Format Type: JSON
Select Download Config to get a JSON file.
Return to the New Relic setup screen and upload this JSON file.
New Relic validates the configuration with a test authentication. If it succeeds, you'll see a Connection succeeded message.
重要
Don't close the browser tab before selecting Continue after uploading. If you do, you lose your progress.

Select projects and services

After the connection is verified:

New Relic lists the GCP projects your service account can access.
Expand a project to see available services.
Select the services you want to monitor.
Select Instrument to start collecting data.
Services fall into two categories:

Full entity support — metrics, entities in the entity explorer, and dashboards.
Metrics only — New Relic collects metrics, but doesn't create an entity.

Integrate at the folder level

With Workload Identity Federation, you can integrate a single project or an entire folder of projects. In GCP, when you grant IAM roles at the folder level, every project within that folder inherits them. So if you grant the service account's roles on a folder instead of on one project, New Relic can monitor all the projects in that folder through a single connection.

To do this, in Create or select a service account grant the service account the Viewer, Service Usage Consumer, Cloud Asset Viewer, and Folder Viewer roles on the folder rather than on a single project. When you reach Select projects and services, New Relic lists every project in that folder so you can choose which ones to monitor.

View your GCP data

After you complete the setup, New Relic starts monitoring your GCP data at regular polling intervals, and your data appears in the New Relic UI after a few minutes. To learn how to view, query, and explore it — including dashboards, alerts, and entities — see View and query your GCP data.

Link multiple Google projects

A single WIF configuration grants access to the GCP projects your service account has permissions for. During setup, New Relic lists all accessible projects so you can select which ones to monitor.

To monitor additional GCP projects later:

If the new projects are in the same GCP organization and your service account already has access, go to Infrastructure > GCP > Manage services and add them.
If the new projects require a different service account or identity pool, repeat the setup to create a new WIF connection.

Manage services

After setup, you can change which services are monitored for each project:

Go to one.newrelic.com > All capabilities > Infrastructure > GCP.
Select Manage services next to your account.
Toggle services on or off per project.
Save your changes.

Disable or unlink your GCP integrations

You can disable individual services or completely disconnect your GCP project from New Relic.

Disable one or more GCP services

Go to Infrastructure > GCP > Manage services.
Clear the checkbox for each service you want to disable.
Save your changes.

Disconnect the GCP account entirely

Go to Infrastructure > GCP > Manage services.
Select Unlink this account.
Save your changes.

After unlinking in New Relic, clean up on the GCP side:

Open the GCP Console and go to IAM & Admin > Workload Identity Federation.
Delete the identity pool you created for New Relic, or remove the OIDC provider from it.
Optionally, delete the service account if it was created solely for New Relic.