SailPoint Non-Human Identity (NHI) Discovery Permissions
The following GCP configuration is required when you enable SailPoint Non-Human Identity (NHI) Discovery on the Google Workspace SaaS connector. Grant only the roles and APIs that correspond to the features you plan to use. Refer to Supported Features for more information.
Important
SailPoint NHI Discovery requires the Service Account authentication grant type.
SailPoint recommends assigning the Viewer and Organization Viewer roles to the SailPoint service account at the organization level. The following table lists additional GCP IAM roles you can assign for least-privilege access by feature:
| Feature | GCP IAM Roles |
|---|---|
| Continuous secret discovery | Secret Manager Viewer, Secret Manager Secret Accessor, API Keys Viewer, Cloud Functions Viewer |
| IAM monitoring | Cloud Asset Viewer, View Service Accounts, IAM Recommender Viewer, Activity Analysis Viewer, Organization Role Viewer, Folder Viewer |
| Compliance validation | Logs Viewer, Logs View Accessor, Private Logs Viewer, Security Reviewer |
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.