Google Cloud#

Collects Cloud Monitoring metrics, asset inventory and billing data using a service account key.

Create a service account#

export PROJECT_ID="your-project-id"

gcloud iam service-accounts create observeiq-readonly \
  --display-name="ObserveIQ read only" --project="$PROJECT_ID"

for ROLE in roles/monitoring.viewer roles/cloudasset.viewer roles/browser; do
  gcloud projects add-iam-policy-binding "$PROJECT_ID" \
    --member="serviceAccount:observeiq-readonly@$PROJECT_ID.iam.gserviceaccount.com" \
    --role="$ROLE"
done

gcloud iam service-accounts keys create observeiq-key.json \
  --iam-account="observeiq-readonly@$PROJECT_ID.iam.gserviceaccount.com"

Roles#

Role	Needed for
`roles/monitoring.viewer`	Metrics from Cloud Monitoring
`roles/cloudasset.viewer`	Resource inventory
`roles/browser`	Project metadata
`roles/billing.viewer`	Spend, assigned at billing account level

Enable the APIs#

gcloud services enable monitoring.googleapis.com cloudasset.googleapis.com \
  cloudresourcemanager.googleapis.com --project="$PROJECT_ID"

Note

A missing API is the most common cause of an integration that connects but returns no data. Cloud Asset API in particular is often not enabled by default on older projects.

Add the integration#

Integrations → Google Cloud → Add account. Paste the entire contents of observeiq-key.json into the service account key field, and enter the project ID.

Warning

Delete the local key file once it is stored. It grants read access to your project to anyone who has it.

rm observeiq-key.json

Choose services#

Compute Engine: instance CPU, memory, disk and network
Google Kubernetes Engine: cluster and node metrics. For workload detail, also install the Kubernetes agent in the cluster
Cloud SQL: connections, CPU, storage, replication lag
Cloud Storage: request counts, bytes, object counts
Cloud Run and Cloud Functions: request counts, latency, instance counts
Load balancing: request rate, latency, backend errors
Pub/Sub: publish and subscribe rates, oldest unacknowledged message age

Billing#

Billing data comes from the billing account rather than the project. Grant roles/billing.viewer at the billing account, then enable billing collection in the integration:

gcloud beta billing accounts add-iam-policy-binding YOUR_BILLING_ACCOUNT_ID \
  --member="serviceAccount:observeiq-readonly@$PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/billing.viewer"

Spend then appears in Cost Explorer.

Multiple projects#

Add each project as its own integration. To cover many projects with one service account, grant the roles at folder or organisation level and add the projects individually in ObserveIQ, reusing the same key.

Verify#

Open Cloud → Explorer and filter to Google Cloud. If nothing appears, check in order: the Cloud Asset API is enabled, the service account has cloudasset.viewer, and the project ID is correct rather than the project number.