New Relic reads data from your GCP account using the Google Stackdriver API and other service-specific APIs. To access these APIs, the New Relic authorized account needs permissions that GCP grants through roles. The exact APIs, roles, and permissions depend on how you connect GCP to New Relic.
APIs to enable
Before you connect, enable the required Google Cloud APIs in each project you want to monitor, using the API & Services library.
Connection method | APIs to enable |
|---|---|
Workload Identity Federation |
|
New Relic service account | Google Stackdriver Monitoring API |
Required roles
For most setups, the GCP primitive role Viewer (roles/viewer) is sufficient. It provides read-only access to existing resources and data without affecting your infrastructure state, and Google manages and updates it automatically as GCP services change. For tighter permission control, use a custom role instead.
The roles you grant depend on your connection method.
Workload Identity Federation
Grant the service account you create these roles on the project:
Viewer(roles/viewer): read resourcesService Usage Consumer(roles/serviceusage.serviceUsageConsumer): access enabled APIsCloud Asset Viewer(roles/cloudasset.viewer): view cloud asset metadataFolder Viewer(roles/resourcemanager.folderViewer): view folder metadata (required only for integrations configured at the folder level)
The service account must also allow impersonation from the identity pool. During setup, you grant the Workload Identity User role (roles/iam.workloadIdentityUser) to the pool principal.
Domain restriction constraints
If your organization enforces a domain restriction constraint, update the policy to allow the following New Relic identifiers, depending on which constraint you use:
iam.allowedPolicyMemberDomains: allow New Relic domain IDC02x1gp26iam.managed.allowedPolicyMembers: allow Organization ID740422149647or Project Number397727728820
Use a custom role
To control permissions more precisely than the Viewer role allows, create a custom role based on the list of permissions, which specifies the minimum set required to fetch data from each GCP integration.
Importante
New Relic has no way of identifying problems related to custom permissions. If you choose to create a custom role, it is your responsibility to maintain it and ensure it collects the data properly.
To set up a custom role:
- Create a Google Cloud IAM custom role in each GCP project you want to monitor.
- Add the permissions for the cloud services you want to monitor, using the list below.
- Assign the custom role to the New Relic authorized account.
List of permissions
All integrations need the following permissions:
monitoring.timeSeries.listserviceusage.services.use
For some GCP integrations, New Relic also needs the following permissions, mainly to collect tags and other attributes.
Integration | Permissions |
|---|---|
Not applicable. Google App Engine does not require additional permissions. | |
| |
| |
| |
Not applicable. Google Cloud Load Balancing does not require additional permissions. | |
| |
| |
| |
| |
| |
| |
|
Sugerencia
This applies to the New Relic service account and Google user account connection methods only. With Workload Identity Federation, these permissions are not needed: New Relic uses your own service account (which already has the Viewer role) to list accessible projects after you establish the WIF connection.
To see the list of projects you can link to New Relic through the UI, your New Relic authorized service account needs these permissions:
resourcemanager.projects.getmonitoring.monitoredResourceDescriptors.listIf you prefer not to grant these permissions, you have two alternatives:
- Assign the
Role ViewerorMonitoring Viewerrole to link projects through the UI, then switch to a custom role after you link the projects. - Use New Relic NerdGraph to link projects without listing them. You must know the project
idin advance. See the NerdGraph GraphiQL cloud integrations API tutorial for details.
- Assign the