Integrating Google Cloud Platform with ShadowMap

ShadowMap supports a secure, read-only integration with Google Cloud Platform (GCP) to automatically discover and monitor cloud-based internet-exposed assets. This integration enables ShadowMap to ingest authoritative inventory and networking data from GCP, ensuring accurate and continuously updated external attack surface coverage.

This guide walks you through creating a GCP Service Account with least-privileged permissions and configuring ShadowMap to use it.

Step 1: Create a GCP Service Account

1. Sign in to the Google Cloud Console.

2. Select the appropriate Project (or create a dedicated project if required).

3. Navigate to IAM & Admin → Service Accounts.

4. Click Create Service Account.

5. Provide:

   • Service account name: shadowmap-integration (example)

   • Description: Read-only asset discovery for ShadowMap

6. Click Create and continue.

Step 2: Assign Read-Only IAM Roles

Assign the following read-only roles to the service account to allow asset and network discovery.

• Viewer (roles/viewer)

• Compute Viewer (roles/compute.viewer)

• DNS Reader (roles/dns.reader)

• Storage Viewer (roles/storage.viewer)

These roles allow ShadowMap to enumerate compute resources, networking components, DNS zones, and storage endpoints without modification privileges.

After assigning roles, click Done.

Step 3: Create a Service Account Key

1. Open the newly created service account.

2. Go to the Keys tab.

3. Click Add Key → Create new key.

4. Select JSON format.

5. Click Create.

A JSON key file will be downloaded. This file contains the credentials ShadowMap will use to authenticate with GCP.

Step 4: Configure GCP in ShadowMap

1. Log in to your ShadowMap dashboard.

2. Navigate to Settings → Cloud Sources.

3. Select Google Cloud Platform.

4. Click Create New Configuration.

5. Provide:

   • Configuration Name

   • GCP Project ID

   • Service Account JSON key (uploaded or pasted, depending on UI)

6. Click Create Source to enable the integration.

Once enabled, ShadowMap will begin ingesting GCP data automatically.

How GCP Data is Used in ShadowMap

After the integration is active, ShadowMap retrieves and correlates GCP asset and network data to enrich your external attack surface inventory.

Compute & Public Infrastructure

• Compute Engine VM instances

• Associated external IP addresses

• Instance metadata relevant to exposure analysis

Network & Exposure Mapping

• VPC networks

• Forwarding rules and public load balancers

• Cloud Load Balancing public endpoints

• Mapping of internet-facing services to backend infrastructure

DNS & Sub-Domain Discovery

• Cloud DNS managed zones

• DNS record sets (A, AAAA, CNAME, etc.)

• Automatic discovery of sub-domains associated with GCP-hosted services

Storage & Internet Accessible Services

• Cloud Storage buckets

• Public bucket endpoints and URLs (where applicable)

• Correlation of storage exposure with DNS and IP intelligence

These elements are then:

• Continuously monitored for changes.

• Automatically included in ShadowMap's scanning engine.

• Evaluated for vulnerabilities, misconfigurations, and threats.