Skip to main content
Wirespeed integrates with Google Cloud Security Command Center (SCC) to collect security findings from your Google Cloud organization.

​
Prerequisites

  • Access to a Google Cloud organization
  • Google Cloud Security Command Center enabled in your organization
  • Organization-level permissions to grant Security Command Center Admin Viewer (roles/securitycenter.adminViewer)
  • One of the following authentication options:
    • A service account key in JSON format
    • A Workload Identity Federation pool/provider configured for Wirespeed’s AWS role

​
Setup Instructions

Choose one authentication method: Service account key or Workload Identity Federation.

​
Option A: Service Account Key

​
Step 1: Create a Service Account in a Project

  1. Navigate to the Google Cloud Console
  2. Select a Project from the project dropdown (top left) - this can be any project within your organization
  3. Go to IAM & Admin > Service Accounts
  4. Click Create Service Account
  5. Enter a service account name (e.g., wirespeed-scc-integration)
  6. Enter a description (e.g., Service account for Wirespeed SCC integration)
  7. Click Create and Continue
  8. Skip the optional grant project roles step (or skip for now)
  9. Click Done

​
Step 2: Generate and Download the Service Account Key

  1. In the Service Accounts list, click on the service account you just created
  2. Go to the Keys tab
  3. Click Add Key > Create new key
  4. Select JSON as the key type
  5. Click Create
  6. The JSON key file will download automatically
    • Keep this file secure - it contains credentials to access your organization’s security data
  7. Open the JSON file with a text editor and copy the entire contents

​
Step 3: Grant Organization-Level Permissions

  1. Navigate to your Organization level (click the organization name in the top left dropdown)
  2. Go to IAM & Admin > IAM
  3. Click Grant Access
  4. In the New principals field, enter the service account email (found in the JSON key as client_email)
  5. Click the Select a role dropdown and search for and select the following roles:
    • Security Command Center Admin Viewer (roles/securitycenter.adminViewer)
  6. Click Save
The service account must be granted roles at the Organization level (not the project level) to access findings across all projects within your organization.

​
Step 4: Find Your Organization ID

  1. In the Google Cloud Console, go to IAM & Admin > Settings
  2. Find the Organization ID field at the top
  3. Copy this ID

​
Step 5: Configure Wirespeed

  1. Log in to Wirespeed and navigate to Integrations > Add Integration
  2. Select Google Security Center
  3. Enter the following information:
    • Organization ID: The organization ID from Step 4
    • Service Account Key: The complete JSON contents from Step 2
  4. Click Save
Wirespeed will begin collecting detections from your Google Cloud Security Command Center.
On first sync, Wirespeed fetches up to the newest 5,000 findings.

​
Option B: Workload Identity Federation

Use Workload Identity Federation if you want Wirespeed to authenticate without storing a long-lived Google service account key. This integration supports direct federated access from Wirespeed’s AWS role. Do not configure service account impersonation for this integration.

​
Step 1: Create a Workload Identity Pool

  1. In the Google Cloud Console, go to IAM & Admin > Workload Identity Federation.
  2. Click Create pool.
  3. Enter a pool name, for example wirespeed.
  4. Click Continue.

​
Step 2: Add an AWS Provider

  1. Select AWS as the provider type.
  2. Enter a provider name, for example wirespeed-aws.
  3. Enter Wirespeed’s AWS account ID: 194722417411
  4. Configure the attribute mappings:
    • google.subject=assertion.arn
    • attribute.account=assertion.account
    • attribute.aws_role=assertion.arn.extract('assumed-role/{role_name}/')
  5. Configure the attribute condition: assertion.account=='194722417411'
  6. Save the provider.

​
Step 3: Grant Security Command Center Access

  1. Navigate to your Organization level in the Google Cloud Console.
  2. Go to IAM & Admin > IAM.
  3. Click Grant Access.
  4. In the New principals field, enter the principal set for Wirespeed’s AWS role:
    • principalSet://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/attribute.aws_role/wirespeed-gcp
  5. Replace PROJECT_NUMBER with the Google Cloud project number that contains the workload identity pool.
  6. Replace POOL_ID with the workload identity pool ID, for example wirespeed.
  7. Select Security Command Center Admin Viewer (roles/securitycenter.adminViewer).
  8. Click Save.
This role must be granted at the Organization level to access findings across all projects within your organization.

​
Step 4: Download the Credential Configuration

  1. Go back to IAM & Admin > Workload Identity Federation.
  2. Open the workload identity pool and provider you created for Wirespeed.
  3. Click Download config.
  4. Choose the direct federated identity configuration for the AWS provider.
  5. Download the Google credential configuration JSON.
Do not select service account impersonation. The JSON should have type: "external_account" and must not include service_account_impersonation_url.

​
Step 5: Find Your Organization ID

  1. In the Google Cloud Console, go to IAM & Admin > Settings.
  2. Find the Organization ID field at the top.
  3. Copy this ID.

​
Step 6: Configure Wirespeed

  1. Log in to Wirespeed and navigate to Integrations > Add Integration.
  2. Select Google Security Center.
  3. Select Workload Identity Federation as the authentication method.
  4. Enter the following information:
    • Organization ID: The organization ID from Step 5
    • Workload identity configuration: The complete Google credential configuration JSON from Step 4
  5. Click Save.
Wirespeed will begin collecting detections from your Google Cloud Security Command Center.