# Google Cloud + Lutril: setup guide

> Lutril needs one service account carrying one organization-level custom role to inventory every Google Cloud service account and key, tell you when each was last used, and let you disable the dormant ones. No stack of predefined roles: the custom role below is the complete permission list, verified by creating it. Lutril never deletes service accounts, never creates, rotates or deletes keys, and never edits IAM policies.

Source: https://www.lutril.com/integrations/gcp
Category: Infrastructure
Auth: service_account
Last verified: 2026-08-25

---

## Setup

1. [object Object]
2. [object Object]
3. [object Object]
4. [object Object]
5. [object Object]
6. In Lutril, open Settings, then Integrations, then Google Cloud. Paste the Service Account JSON. Set the Organization ID for an organization-wide scan (recommended) or a Project ID to scan a single project. Keep the stale key threshold at 90 days unless your policy says otherwise. Turn the Impersonation lens on to list who can impersonate each service account; it costs one extra IAM read per account.
7. Open Non-Human Identities and click Refresh. The sync runs in the background and takes a few minutes on large organizations; the page reports any missing API or permission as a warning. Last used showing Unknown everywhere means Policy Analyzer is not enabled in the Lutril project or its permissions are missing. Projects marked Not synced lack the resourcemanager permissions. Disable failing with a permission error means the role lacks iam.serviceAccounts.disable. Rate limits (429) are retried automatically and previously known data is kept.

## Access requested

- Inventory: iam.serviceAccounts.list, iam.serviceAccounts.get, iam.serviceAccounts.getIamPolicy, iam.serviceAccountKeys.list, resourcemanager.organizations.get, resourcemanager.folders.get, resourcemanager.folders.list, resourcemanager.projects.get, resourcemanager.projects.list, resourcemanager.projects.getIamPolicy
- Organization-wide search: cloudasset.assets.searchAllResources, cloudasset.assets.searchAllIamPolicies
- Dormancy (last authentication): policyanalyzer.serviceAccountLastAuthenticationActivities.query, policyanalyzer.serviceAccountKeyLastAuthenticationActivities.query, serviceusage.services.use
- Remediation (optional): iam.serviceAccounts.disable, iam.serviceAccounts.enable. Without them the inventory still works and the Disable button reports a permission error.
- Just-in-time grants (optional): resourcemanager.projects.setIamPolicy. Used only to add and remove one time-boxed binding per approved access request.
- Last used values come from Policy Analyzer, which aggregates authentications per day (Pacific time). Google states results may not include very recent authentication events; a lag of several days is common. Google also does not track requests authenticated with bound API keys, Cloud Storage HMAC keys, or Google APIs outside Cloud (for example Workspace domain-wide delegation, as used by GAM): such accounts can show as never used while active. This is why Lutril treats no observed authentication as a warning signal, never as proof of non-use.

## References

- [Google Cloud documentation](https://docs.cloud.google.com/iam/docs/creating-custom-roles)
- [Google Cloud console](https://console.cloud.google.com/iam-admin/serviceaccounts)
- [Service account keys](https://docs.cloud.google.com/iam/docs/keys-create-delete)
- [Policy Analyzer: service account authentication activity](https://docs.cloud.google.com/policy-intelligence/docs/activity-analyzer-service-account-authentication)
- [Cloud Asset Inventory search](https://docs.cloud.google.com/asset-inventory/docs/searching-resources)