Skip to main content
Workload scanning provisions billed infrastructure in your Google Cloud organization, so it needs two things a CSPM-only GCP integration doesn’t: a billing account, and a quick check of a handful of organization policies. Confirm both before you start the wizard.

​
Billing account

Workload scanning creates a dedicated scanning project in your organization, and that project must have a billing account linked before onboarding can create anything in it.
  • Find your billing account ID with gcloud billing accounts list, or in the Google Cloud billing console.
  • Whoever runs the onboarding script or terraform apply needs the billing.resourceAssociations.create permission on that billing account: typically granted through the Billing Account User role. This is separate from the Organization Admin access the base GCP integration needs, and at some organizations it’s held by a different person or team.
If the person running the script doesn’t hold billing.resourceAssociations.create, the script fails at the billing-link step with a specific error naming the missing permission: ask your billing administrator to grant Billing Account User on the account you plan to use, then re-run the same command.

​
Organization policies that affect scanning

The onboarding script checks the policies below automatically and tells you what to do before it creates anything. Review them ahead of time if you already know your organization enforces them: None of these need to be pre-configured for scanning to work: they only matter if your organization already enforces them. The onboarding script’s preflight checks report which ones apply to your organization and what to change, so a failure here is loud and specific rather than a silent skipped scan.

​
Who should run onboarding

The same Organization Admin (or equivalent) access the base GCP integration needs is sufficient to run the script or apply the Terraform template, and workload scanning adds only the billing permission above, not a different admin role.

​
Next step