Google Cloud SCC Integration Guide

If your team runs infrastructure on Google Cloud, this integration brings Security Command Center (SCC) findings into Openlane automatically. You get a single place to track cloud security findings, remediation timelines, and service level agreement (SLA) compliance.

Integration Snapshot

Item	Details
Primary use case	Continuous ingestion of SCC findings into Openlane
Data direction	One-way (GCP -> Openlane), read-only
GCP services used	SCC, IAM, Security Token Service (STS)
Setup model	Workload identity federation (keyless, recommended) or service account key JSON
Openlane records created	Findings, Vulnerabilities and Risks (created or updated), linked to your SCC integration

Key Capabilities

• Keyless Authentication: Workload identity federation lets GCP trust Openlane as an OpenID Connect (OIDC) identity provider, so no service account key is ever created, downloaded, or stored.
• Findings Ingestion: Pulls SCC findings and normalizes them into Openlane vulnerability records, giving you a unified view for remediation tracking and SLA compliance.
• Scoped Collection: Supports source and filter scoping to match your operating model and compliance boundary.

Prerequisites

• gcloud CLI access with permissions to create workload identity pools and grant identity and access management (IAM) bindings.
• SCC API enabled in the target project.
• Organization ID or project ID to define your SCC collection scope.

Step-by-Step Setup

Step 1: Run the GCP Setup Script

Use the Openlane setup script to configure IAM, enable required APIs, and print the exact values needed in Openlane.

1. Download the script:

   curl -fsSL https://docs.theopenlane.io/integrations/setup/gcp/openlane-gcp-scc-setup.sh \
     -o openlane-gcp-scc-setup.sh
   chmod +x openlane-gcp-scc-setup.sh

2. Run the setup:

   ./openlane-gcp-scc-setup.sh \
     --project-id <PROJECT_ID> \
     --organization-id <ORGANIZATION_ID>

The script prints the service account key JSON and other values to paste into Openlane.

Step 2: Connect Google Cloud SCC in Openlane

1. Navigate to Organization Settings > Integrations and find Google Cloud SCC.

2. Click Configure and enter the credential fields:

   Field	Required	Description
   serviceAccountKeyJson	Yes	Service account key JSON used to authenticate to GCP SCC
   organizationId	Yes (one of organizationId or projectId)	ID of the organization to use as the parent
   projectId	Yes (one of organizationId or projectId)	ID of the project to use as the parent
   projectScope	No	Filter project scope; only applies when using an Organization ID as the parent (all or specific)
   projectIds	Conditional	List of project IDs to include; required when projectScope is specific
   sccSourceIds	No	List of SCC source IDs to limit which sources findings are pulled from
   oauthScopes	No	OAuth scopes to request for the service account; defaults to https://www.googleapis.com/auth/cloud-platform

   Finding your SCC source IDs

   Option A (GCP Console): Go to Security Command Center > Settings > Sources. Each row shows a source; the numeric ID at the end of the resource name is what you need.

   Option B (REST API):

   curl -s \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "x-goog-user-project: <PROJECT_ID>" \
     "https://securitycenter.googleapis.com/v2/organizations/<ORG_ID>/sources?pageSize=100"

   This returns source resource names like organizations/123/sources/456; paste the full name or just the numeric suffix into sccSourceIds.

3. Optionally configure data ingestion behavior:

   Setting	Description
   Filter Expression	Common Expression Language (CEL) expression evaluated against each finding; only findings that match are ingested

   Filter expression examples:

   # Exclude GKE security bulletins
   payload.category != "GKE_SECURITY_BULLETIN"

   # Ingest only critical findings
   payload.severity == "CRITICAL"

   CEL expressions have access to the full raw payload for each finding via payload.<field>.

4. Click Save & Connect.

Validate Connection

After saving, Openlane runs a health check against Google Cloud SCC and displays the result on the Installed tab of the Integrations page. You should see a Healthy badge confirming connectivity. If the badge shows Needs Attention, review the troubleshooting section below.

Supported Operations

This integration is read-only and one-directional. Openlane validates connectivity by listing sources, then pulls findings from the configured source scope. Openlane never pushes configuration changes back into GCP.

What Openlane Creates From Findings

Each SCC finding becomes a normalized vulnerability record in Openlane:

• Converts findings into vulnerability payloads with severity, state, category, timestamps, and source URIs preserved.
• Deduplicates by externalID, with Common Vulnerabilities and Exposures (CVE) fallback when available, so repeated syncs update existing records instead of creating duplicates.
• Links each vulnerability to the SCC integration that produced it.
• Stores raw payload data if raw payload retention is enabled in your integration config.

What You Can Do Next

Once vulnerabilities land in Openlane, you can link them to affected assets, create remediation tasks, and track resolution against SLAs. This saves you from manually gathering evidence when an auditor asks for system monitoring or vulnerability management evidence.

Disconnect

To remove this integration:

1. Navigate to Organization Settings > Integrations
2. Select the Installed tab
3. Open the menu on the integration card and select Disconnect.

This removes stored credentials and stops all collection activity. You can reconnect later by configuring the integration again.

Troubleshooting

• Permission errors: verify the service account has SCC read permissions at the configured scope.
• No findings ingested: verify source scope and finding filter configuration.

References

• Openlane GCP setup script
• Security Command Center overview
• Security Command Center findings concepts