Google Cloud shows up in the Safeguard docs as a compliance connector, a registry source, a scan target and a delivery option for events. This guide lists each one and stays within what the docs say.
What it is
- Connector: Google Cloud Platform (OAuth and API token, automated evidence collection) and Google Cloud Storage (OAuth and API token, automated evidence collection). Google Cloud Operations and Google Security Command Center are connection records with an API token.
- Registry: the container image list on the Integrations page names GCP Cloud Source alongside Amazon ECR, Docker Hub and OCI Registry.
- Cloud Scan: a CLI scan of cloud configuration posture for AWS, Azure and GCP, run on infrastructure you own.
- Events: webhook events can go directly to GCP Pub/Sub.
How to use it
For the connector, the catalog says each connection uses OAuth consent or an API token and links to a per-connector setup page. I could not confirm roles or scopes from the docs, so ask your Safeguard admin for the setup reference and grant read access only.
For images, open Integrations, filter to Container Image and click Connect on the card. The workflow is the same as for any source: configure access, review, connect, then check Projects.
For events, create a subscription on the Webhooks page. Delivery is at least once, with 11 attempts over 24 hours, and undelivered events can be replayed from a dead-letter queue. Deduplicate by event ID.
Quick check
Which Google Cloud entries collect evidence automatically?
Google Cloud Platform and Google Cloud Storage. Cloud Operations and Security Command Center are connection records.
