GCP Project Level Onboarding Guide

This guide explains how to onboard a GCP Project into the Matters platform using the Project access scope.

As part of the setup, you will need to download and run a Terraform template provided by Matters.

The provided Terraform template (gcp_project_onboarding.tf and gcp_project_onboarding.tfvars) will:

• Enable the required Google Cloud APIs in the target project

• Create a custom IAM role at the Project level

• Assign the required permissions to that custom role

• Bind the role to an existing Service Account

Prerequisites

Before starting, ensure the following:

1. You have Matters Super Admin access.

2. You have access to the target GCP project with permissions to:

   • Enable APIs (serviceusage.services.enable)

   • Create project-level custom roles

   • Create IAM bindings at project level

3. You will run Terraform from Google Cloud Shell (recommended) or any environment authenticated to the project.

Terraform Enables Following Google APIs

Terraform script enables below listed APIs automatically using google_project_service.

Note: The script sets disable_on_destroy = false, so APIs will not be disabled if Terraform resources are destroyed.

Step 1 Configure Integration in Matters Console

• Log in to the Matters Console as a Super Admin.

• Navigate to:

  Integrations → Cloud → Google Cloud

  (URL: https://app.matters.ai/data-security/integrations?type=cloud.

  If you use a dedicated tenant, replace app with your tenant name.)

• Click Connect on the GCP integration card.

• Provide:

  • Integration Name

  • Access Level Scope → Project

• Enter:

  • Project ID

• Click Continue Setup.

Step 2: Download and Extract the Terraform Script

1. Click on the Google Cloud Shell hyperlink to log in to the GCP Admin account.

2. In the next step on the Matters Dashboard, click Download Script.

Step 3: Open Google Cloud Shell

1. In the GCP Management Console, click SSH (top-right corner) to activate Cloud Shell.

2. Authorize access when prompted. Cloud Shell will now be ready for Terraform execution.

Step 4: Upload the Terraform Folder to Cloud Shell

1. In Cloud Shell, click the Upload option.

2. Select the extracted folder from your system and click on upload.

3. Once upload is complete, navigate into the folder:

   cd <folder_name>

4. Confirm files exist:

ls

You should see gcp_org_onboarding.tf and gcp_org_onboarding.tfvars.

Step 5: Run Terraform to Create Required Resources

1. In Cloud Shell, navigate to the folder where the files were uploaded and execute the following command (you may also copy this command from the Matters Dashboard):

terraform init && terraform apply -auto-approve -var-file="gcp_org_onboarding.tfvars"

2. After Terraform completes successfully:

   Click Validate in the Matters Console. Matters will verify access and permissions.

Step 6: Integration Complete

You will see “Integration Successful” message once Integration is complete

Once the account is successfully integrated, all supported data stores across the selected GCP account will be automatically discovered in the Matters dashboard.

After discovery, you can click on the data store selectively and can run scans on specific data stores to identify and classify sensitive entities as per your requirements. This allows you to focus on relevant resources and efficiently manage sensitive data across your organization.

Understanding What the Terraform Script Configures (Project Scope)

1) Enables Required APIs (Project Level)

The script enables required APIs in the project via:

• google_project_service.required_apis

• It loops through a list of APIs and enables each one.

• It does not disable APIs on destroy (disable_on_destroy = false).

2) Custom IAM Role Creation (Project Level)

Terraform creates a custom IAM role at the Project level:

• Role title: Matters Integration Role

• Role ID: from role_id in tfvars

• Stage: GA

• Permissions: a curated set used for discovery / inventory / limited export across:

  • BigQuery

  • Cloud Storage

  • Cloud SQL

  • Cloud KMS

  • Dataform

  • Dataplex

  • Resource Manager (project + IAM policy visibility)

IAM Permissions Included in the Custom Role (Project Template)

Below is the permission set used by the project onboarding Terraform