Connect Google Cloud

Connect Google Cloud so an agent can use the gcloud CLI with credentials from Pulumi ESC.

Choose the service account

Use a service account with access to the projects and resources the agent needs. Grant only the actions required for its work. See Design access around the job for guidance on credential scope and lifecycle.

Prepare an ESC environment

Use the Google Cloud login provider to get a temporary access token. Under environmentVariables, export its accessToken output as CLOUDSDK_AUTH_ACCESS_TOKEN. Set CLOUDSDK_CORE_PROJECT to the project ID the agent should use. The login provider’s example shows the complete gcloud configuration.

The agent also needs permission to open the environment.

Connect the environment

With permission to manage organization integrations (org_integrations:update):

1. Open your organization’s Agent settings > Integrations > CLI tools.
2. Under Available, choose Google Cloud and select Connect.
3. Enter a Name and select the ESC environment that supplies the credentials.
4. In Notes (optional), describe when the agent should use this connection.
5. Select Connect.

Give the connection a name that identifies its purpose, such as staging-google-cloud. Include the project ID and any region or zone restrictions in its notes.

Use the connection

In the task, name the connection and identify the project and resources the agent should work with. See Tasks and collaboration to assign work and review the results.