Google Cloud MCP

terraform {
  required_version = ">= 1.5.0"

  required_providers {
    google = {
      source  = "hashicorp/google"
      version = ">= 6.46.0"
    }
  }
}

provider "google" {
  project = var.project_id
}

variable "project_id" {
  type = string
}

module "gcp_mcp" {
  source = "git::https://github.com/unblocked/terraform-google-cloud-integration.git?ref=v0.1.0"

  project_id               = var.project_id
  manage_required_services = true

  native_mcp_service_account_id           = "unblocked-gcp-access"
  native_mcp_service_account_display_name = "Unblocked access to GCP MCP"

  native_mcp_allowed_services = [
    "compute.googleapis.com",
    "logging.googleapis.com",
    "monitoring.googleapis.com",
  ]

  native_mcp_roles = [
    "roles/logging.viewer",
    "roles/monitoring.viewer",
    "roles/serviceusage.serviceUsageConsumer",
    "roles/viewer",
  ]

  aws_account = {
    account_id = "029574882031"
    role_names = ["UnblockedGcpCustomerAccess"]
  }
}

output "unblocked_service_account_email" {
  value       = module.gcp_mcp.service_account_email
  description = "Service account email to provide to Unblocked."
}

output "unblocked_aws_workload_identity_provider" {
  value       = module.gcp_mcp.aws_workload_identity_provider
  description = "WIF provider resource name to provide to Unblocked."
}

terraform init
terraform plan -var='project_id=CUSTOMER_PROJECT_ID'
terraform apply -var='project_id=CUSTOMER_PROJECT_ID'

terraform output -raw unblocked_service_account_email
terraform output -raw unblocked_aws_workload_identity_provider

export PROJECT_ID="CUSTOMER_PROJECT_ID"
export AWS_ACCOUNT_ID="029574882031"
export BROKER_ROLE="UnblockedGcpCustomerAccess"
export SA_ID="unblocked-gcp-access"
export POOL_ID="unblocked-gcp-access-pool"
export PROVIDER_ID="unblocked-gcp-access"

# Set the active project and derive its project number and the service-account email.
gcloud config set project "$PROJECT_ID"
export PROJECT_NUMBER="$(gcloud projects describe "$PROJECT_ID" --format='value(projectNumber)')"
export SA_EMAIL="${SA_ID}@${PROJECT_ID}.iam.gserviceaccount.com"

# Enable the APIs needed for federation and the native MCP services.
gcloud services enable \
  iam.googleapis.com \
  iamcredentials.googleapis.com \
  sts.googleapis.com \
  compute.googleapis.com \
  logging.googleapis.com \
  monitoring.googleapis.com \
  --project="$PROJECT_ID"

# Create the service account Unblocked will impersonate.
gcloud iam service-accounts create "$SA_ID" \
  --display-name="Unblocked access to GCP MCP" \
  --project="$PROJECT_ID"

# Grant the service account read-only access to project data.
for ROLE in \
  roles/logging.viewer \
  roles/monitoring.viewer \
  roles/serviceusage.serviceUsageConsumer \
  roles/viewer
do
  gcloud projects add-iam-policy-binding "$PROJECT_ID" \
    --member="serviceAccount:$SA_EMAIL" \
    --role="$ROLE"
done

# Grant MCP Tool User, restricted to the approved native MCP services.
gcloud projects add-iam-policy-binding "$PROJECT_ID" \
  --member="serviceAccount:$SA_EMAIL" \
  --role="roles/mcp.toolUser" \
  --condition="title=native-mcp-services-only,description=Restrict MCP calls to approved services,expression=resource.service == 'compute.googleapis.com' || resource.service == 'logging.googleapis.com' || resource.service == 'monitoring.googleapis.com'"

# Create the Workload Identity Pool that will trust AWS.
gcloud iam workload-identity-pools create "$POOL_ID" \
  --location="global" \
  --display-name="Unblocked GCP MCP access" \
  --project="$PROJECT_ID"

# Add the AWS provider, trusting only the Unblocked account and broker role.
gcloud iam workload-identity-pools providers create-aws "$PROVIDER_ID" \
  --location="global" \
  --workload-identity-pool="$POOL_ID" \
  --account-id="$AWS_ACCOUNT_ID" \
  --attribute-mapping="google.subject=assertion.arn,attribute.account=assertion.account" \
  --attribute-condition="assertion.account == '$AWS_ACCOUNT_ID' && assertion.arn.startsWith('arn:aws:sts::$AWS_ACCOUNT_ID:assumed-role/$BROKER_ROLE/')" \
  --project="$PROJECT_ID"

# Let the federated AWS identities impersonate the service account.
gcloud iam service-accounts add-iam-policy-binding "$SA_EMAIL" \
  --role="roles/iam.workloadIdentityUser" \
  --member="principalSet://iam.googleapis.com/projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/$POOL_ID/attribute.account/$AWS_ACCOUNT_ID" \
  --project="$PROJECT_ID"

# Print the two values to send to Unblocked.
echo "service_account_email:          $SA_EMAIL"
echo "aws_workload_identity_provider: projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/$POOL_ID/providers/$PROVIDER_ID"

gcloud iam service-accounts describe "$SA_EMAIL" --project="$PROJECT_ID"

gcloud iam workload-identity-pools describe "$POOL_ID" \
  --location="global" \
  --project="$PROJECT_ID"

gcloud iam workload-identity-pools providers describe "$PROVIDER_ID" \
  --workload-identity-pool="$POOL_ID" \
  --location="global" \
  --project="$PROJECT_ID"