GCP Recommendation Actions

If properly configured, InsightCloudSec can harvest GCP Recommendations as a resource (found under Identity & Management on the Resources page). Supported Recommendation subtypes (see below) can be acted upon from within InsightCloudSec, with the results/resolution being propagated to GCP for easier principal management. InsightCloudSec supports applying recommendations for both Organizations and Projects.

Currently supported Recommender subtypes are:

REMOVE_ROLE
REMOVE_ROLE_STORAGE_BUCKET
REPLACE_ROLE
REPLACE_ROLE_STORAGE_BUCKET
SERVICE_AGENT_WITH_DEFAULT_ROLE
SERVICE_AGENT_WITHOUT_DEFAULT_ROLE

Prerequisites

Before you can apply recommendations in InsightCloudSec, you'll need the following:

• Permissions to view, apply, and dismiss recommendations in GCP
  • The required permissions should be added to the InsightCloudSec role you created during GCP - Onboarding
  • Review GCP's Recommendations documentation for more information
• Domain Admin permissions within InsightCloudSec

Using GCP Recommendation Actions

Once the InsightCloudSec role associated with the GCP Project/Organization has appropriate permissions, you can apply recommendations from the Resources page.

1. Login to InsightCloudSec and navigate to the Resources page.

2. Click "Identity & Management", then click "Recommendation". Note: Click the hyperlink in the "Affected Resource Name" column to open the properties for that resource.

3. Click the Resource Properties icon (next to the checkbox) for the Recommendation you wish to address. Note: Ensure the Subtype column contains a supported subtype.

4. Click "Actions", then click "Apply recommendation".

5. Click "Submit" to confirm the application. This will propagate the change to the relevant GCP account, and the recommendation will be accepted. The relevant changes will be made based on that recommendation for that Principal.