> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plerion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# GCP workload scanning prerequisites

> What to prepare before turning on GCP workload scanning: a linked billing account and the org policies that affect it

Workload scanning provisions billed infrastructure in your Google Cloud organization, so it needs two things a CSPM-only GCP integration doesn't: a billing account, and a quick check of a handful of organization policies. Confirm both before you start the wizard.

***

## Billing account

Workload scanning creates a dedicated **scanning project** in your organization, and that project must have a billing account linked before onboarding can create anything in it.

* Find your billing account ID with `gcloud billing accounts list`, or in the [Google Cloud billing console](https://console.cloud.google.com/billing).
* Whoever runs the onboarding script or `terraform apply` needs the `billing.resourceAssociations.create` permission on that billing account: typically granted through the **Billing Account User** role. This is separate from the **Organization Admin** access the base GCP integration needs, and at some organizations it's held by a different person or team.

<Tip>
  If the person running the script doesn't hold `billing.resourceAssociations.create`, the script fails at the billing-link step with a specific error naming the missing permission: ask your billing administrator to grant **Billing Account User** on the account you plan to use, then re-run the same command.
</Tip>

***

## Organization policies that affect scanning

The onboarding script checks the policies below automatically and tells you what to do before it creates anything. Review them ahead of time if you already know your organization enforces them:

| Policy                                               | What it affects                                                                              | What to do                                                                                                                                                                       |
| ---------------------------------------------------- | -------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `constraints/compute.vmExternalIpAccess`             | Blocks external IPs on VMs, including the scanner VM's default egress path                   | Choose the **Cloud NAT** networking mode in the wizard; the script detects this automatically and adds `--nat` for you                                                           |
| `constraints/compute.storageResourceUseRestrictions` | Can restrict snapshot use to the same project, which blocks the cross-project scan-disk step | If your organization locks this to same-project only, workload scanning is blocked for the projects it applies to; the preflight check reports this by project                   |
| `constraints/gcp.resourceLocations`                  | Restricts which regions resources can be created in                                          | The scanning project's resources (scan disks, scanner VMs) are created in the same regions as the workloads being scanned; make sure those regions are allowed                   |
| `constraints/compute.trustedImageProjects`           | Restricts which image projects a VM can boot from                                            | The scanner VM boots a stock Ubuntu LTS image from Google's public image project; make sure it's in your allowed list, or the trusted-image check catches this during onboarding |
| VPC Service Controls perimeters                      | Can restrict which projects and APIs are reachable across a perimeter boundary               | If a workload project sits inside a VPC-SC perimeter, add an ingress rule for the tenant service account, or include the scanning project in the same perimeter                  |

None of these need to be pre-configured for scanning to work: they only matter if your organization already enforces them. The onboarding script's preflight checks report which ones apply to your organization and what to change, so a failure here is loud and specific rather than a silent skipped scan.

***

## Who should run onboarding

The same **Organization Admin** (or equivalent) access the base GCP integration needs is sufficient to run the script or apply the Terraform template, and workload scanning adds only the billing permission above, not a different admin role.

***

## Next step

* [Getting started](/guides/integrations/gcp/workload-scanning/getting-started)