The GCP integration connects TigerTrust to your Google Cloud project via a service account. TigerTrust authenticates with a service account key and enumerates certificates across Certificate Manager, Compute Engine SSL, GKE, and Cloud KMS.
Gcp

​
What gets discovered

Certificate Manager

Both Google-managed (ACME-issued, auto-renewed) and self-managed certificates. Domain names, SANs, expiry, and certificate map attachments.

Load balancer SSL certificates

Global SSL certificates attached to HTTPS proxies. Google-managed certs are marked as auto-renewing; self-managed certs are eligible for TigerTrust renewal.

GKE cluster CA

Cluster CA certificates and API server FQDNs. Reported with “GKE-Managed” as the issuer.

Cloud KMS

Cloud KMS key rings and customer-managed keys associated with certificate material.

​
Service account setup

1

Create the service account

export PROJECT_ID=my-project
gcloud iam service-accounts create tigertrust-discovery \
  --project=$PROJECT_ID \
  --display-name="TigerTrust Discovery"
2

Assign minimum roles

SA="tigertrust-discovery@$PROJECT_ID.iam.gserviceaccount.com"

for ROLE in \
  roles/certificatemanager.viewer \
  roles/compute.viewer \
  roles/container.viewer \
  roles/cloudkms.viewer; do
  gcloud projects add-iam-policy-binding $PROJECT_ID \
    --member="serviceAccount:$SA" \
    --role="$ROLE"
done
3

Create and download the key

gcloud iam service-accounts keys create tigertrust-sa.json \
  --iam-account=$SA
The resulting JSON file is what you paste into TigerTrust.
4

Enable the required APIs

gcloud services enable \
  certificatemanager.googleapis.com \
  compute.googleapis.com \
  container.googleapis.com \
  cloudkms.googleapis.com \
  --project=$PROJECT_ID

​
Minimum custom role

If your policy prohibits the pre-defined viewer roles, create a custom role with only the permissions TigerTrust requires: 
title: "TigerTrust Discovery"
description: "Read-only discovery of certificates across GCP"
stage: "GA"
includedPermissions:
- certificatemanager.certs.list
- certificatemanager.certs.get
- certificatemanager.certmaps.list
- certificatemanager.certmapentries.list
- compute.sslCertificates.list
- compute.sslCertificates.get
- compute.targetHttpsProxies.list
- container.clusters.list
- container.clusters.get
- cloudkms.cryptoKeys.list
- cloudkms.cryptoKeys.get
- cloudkms.keyRings.list
- resourcemanager.projects.get
Save as tigertrust-role.yaml and create with: 
gcloud iam roles create tigertrustDiscovery \
  --project=$PROJECT_ID \
  --file=tigertrust-role.yaml
For DNS-01 through Google Cloud DNS, also grant roles/dns.admin on the target zone.

​
Connect from the product

1

Open the GCP integration

Go to Integrations > Cloud > GCP > Connect.
2

Enter credentials

Enter the project ID and paste the full contents of the service account JSON key file.
3

Verify authentication

Click Test connection. TigerTrust authenticates and confirms API access across Certificate Manager, Compute, and Container.
4

Run a scan

Click Scan now to discover Certificate Manager entries, Compute SSL certificates, and GKE cluster CAs.

​
Managed vs self-managed certificates

TigerTrust treats Google Certificate Manager’s two certificate types differently:
Google issues and rotates these certificates via its own ACME integration. TigerTrust records them with auto-renewal noted and does not schedule its own renewal — it monitors expiry and reports drift from what Google reports.
Service account keys are long-lived credentials. Rotate them on a regular schedule using gcloud iam service-accounts keys create and delete the old key immediately after updating TigerTrust. Consider using Workload Identity Federation instead of key files for TigerTrust deployments running on Google Cloud.

Google Cloud DNS for ACME

Reuse the service account for DNS-01 challenge automation.

AWS integration

Add ACM discovery.

Azure integration

Add Key Vault and App Service.

Cloud integrations overview

Manage all cloud accounts from one place.