> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getunblocked.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Cloud MCP

> Connect Google Cloud to Unblocked MCP with Workload Identity Federation

Use this integration to let Unblocked access selected Google Cloud MCP services through Workload Identity Federation. Unblocked does not need a Google service-account key or other long-lived Google credential.

Choose one of these setup options:

* [Terraform](#option-1-terraform)
* [gcloud CLI](#option-2-gcloud-cli)
* [Google Cloud Console](#option-3-google-cloud-console)

## Unblocked configuration values

| Value                  | Setting                                                                               |
| ---------------------- | ------------------------------------------------------------------------------------- |
| AWS account            | **029574882031** (production)                                                         |
| AWS broker role        | **UnblockedGcpCustomerAccess**                                                        |
| Service account        | **unblocked-gcp-access**                                                              |
| Workload Identity Pool | **unblocked-gcp-access-pool**                                                         |
| AWS provider           | **unblocked-gcp-access**                                                              |
| Native MCP services    | **compute.googleapis.com**, **logging.googleapis.com**, **monitoring.googleapis.com** |

You may rename the Google-side resources, including the service account, Workload Identity Pool, and AWS provider, to match your naming conventions. The Unblocked AWS account ID and broker role are fixed values supplied by Unblocked. Do not change them.

At the end of each setup option, you will have these two values to enter in the Google Cloud MCP connection form in Unblocked:

* `service_account_email`, for example `unblocked-gcp-access@PROJECT_ID.iam.gserviceaccount.com`
* `aws_workload_identity_provider`, in this format: `projects/{projectNumber}/locations/global/workloadIdentityPools/{poolId}/providers/{providerId}`

## Option 1: Terraform

Use Terraform when you manage Google Cloud with Terraform. The module exposes both values Unblocked needs as outputs. The identity applying the configuration must be able to enable APIs, create service accounts and Workload Identity Federation resources, and manage project IAM.

The module is available at [terraform-google-cloud-integration](https://github.com/unblocked/terraform-google-cloud-integration).

Create `main.tf` with the following configuration. Replace `CUSTOMER_PROJECT_ID` with your Google Cloud project ID.

```hcl theme={null}
terraform {
  required_version = ">= 1.5.0"

  required_providers {
    google = {
      source  = "hashicorp/google"
      version = ">= 6.46.0"
    }
  }
}

provider "google" {
  project = var.project_id
}

variable "project_id" {
  type = string
}

module "gcp_mcp" {
  source = "git::https://github.com/unblocked/terraform-google-cloud-integration.git?ref=v0.1.0"

  project_id               = var.project_id
  manage_required_services = true

  native_mcp_service_account_id           = "unblocked-gcp-access"
  native_mcp_service_account_display_name = "Unblocked access to GCP MCP"

  native_mcp_allowed_services = [
    "compute.googleapis.com",
    "logging.googleapis.com",
    "monitoring.googleapis.com",
  ]

  native_mcp_roles = [
    "roles/logging.viewer",
    "roles/monitoring.viewer",
    "roles/serviceusage.serviceUsageConsumer",
    "roles/viewer",
  ]

  aws_account = {
    account_id = "029574882031"
    role_names = ["UnblockedGcpCustomerAccess"]
  }
}

output "unblocked_service_account_email" {
  value       = module.gcp_mcp.service_account_email
  description = "Service account email to provide to Unblocked."
}

output "unblocked_aws_workload_identity_provider" {
  value       = module.gcp_mcp.aws_workload_identity_provider
  description = "WIF provider resource name to provide to Unblocked."
}
```

Run:

```bash theme={null}
terraform init
terraform plan -var='project_id=CUSTOMER_PROJECT_ID'
terraform apply -var='project_id=CUSTOMER_PROJECT_ID'

terraform output -raw unblocked_service_account_email
terraform output -raw unblocked_aws_workload_identity_provider
```

Enter both output values in Unblocked. They contain no service-account key or long-lived Google credential.

## Option 2: gcloud CLI

Run these commands from a local terminal authenticated with gcloud as a Google project administrator, or from Google Cloud Shell. Replace `CUSTOMER_PROJECT_ID` only.

<Note>
  In Google Cloud Shell, open the customer project in Google Cloud Console and click **Activate Cloud Shell**. Confirm that the active account is a project administrator with `gcloud auth list --filter=status:ACTIVE`. Do not run `gcloud auth application-default login`; Cloud Shell already uses the signed-in Google identity for gcloud commands.
</Note>

```bash theme={null}
export PROJECT_ID="CUSTOMER_PROJECT_ID"
export AWS_ACCOUNT_ID="029574882031"
export BROKER_ROLE="UnblockedGcpCustomerAccess"
export SA_ID="unblocked-gcp-access"
export POOL_ID="unblocked-gcp-access-pool"
export PROVIDER_ID="unblocked-gcp-access"

# Set the active project and derive its project number and the service-account email.
gcloud config set project "$PROJECT_ID"
export PROJECT_NUMBER="$(gcloud projects describe "$PROJECT_ID" --format='value(projectNumber)')"
export SA_EMAIL="${SA_ID}@${PROJECT_ID}.iam.gserviceaccount.com"

# Enable the APIs needed for federation and the native MCP services.
gcloud services enable \
  iam.googleapis.com \
  iamcredentials.googleapis.com \
  sts.googleapis.com \
  compute.googleapis.com \
  logging.googleapis.com \
  monitoring.googleapis.com \
  --project="$PROJECT_ID"

# Create the service account Unblocked will impersonate.
gcloud iam service-accounts create "$SA_ID" \
  --display-name="Unblocked access to GCP MCP" \
  --project="$PROJECT_ID"

# Grant the service account read-only access to project data.
for ROLE in \
  roles/logging.viewer \
  roles/monitoring.viewer \
  roles/serviceusage.serviceUsageConsumer \
  roles/viewer
do
  gcloud projects add-iam-policy-binding "$PROJECT_ID" \
    --member="serviceAccount:$SA_EMAIL" \
    --role="$ROLE"
done

# Grant MCP Tool User, restricted to the approved native MCP services.
gcloud projects add-iam-policy-binding "$PROJECT_ID" \
  --member="serviceAccount:$SA_EMAIL" \
  --role="roles/mcp.toolUser" \
  --condition="title=native-mcp-services-only,description=Restrict MCP calls to approved services,expression=resource.service == 'compute.googleapis.com' || resource.service == 'logging.googleapis.com' || resource.service == 'monitoring.googleapis.com'"

# Create the Workload Identity Pool that will trust AWS.
gcloud iam workload-identity-pools create "$POOL_ID" \
  --location="global" \
  --display-name="Unblocked GCP MCP access" \
  --project="$PROJECT_ID"

# Add the AWS provider, trusting only the Unblocked account and broker role.
gcloud iam workload-identity-pools providers create-aws "$PROVIDER_ID" \
  --location="global" \
  --workload-identity-pool="$POOL_ID" \
  --account-id="$AWS_ACCOUNT_ID" \
  --attribute-mapping="google.subject=assertion.arn,attribute.account=assertion.account" \
  --attribute-condition="assertion.account == '$AWS_ACCOUNT_ID' && assertion.arn.startsWith('arn:aws:sts::$AWS_ACCOUNT_ID:assumed-role/$BROKER_ROLE/')" \
  --project="$PROJECT_ID"

# Let the federated AWS identities impersonate the service account.
gcloud iam service-accounts add-iam-policy-binding "$SA_EMAIL" \
  --role="roles/iam.workloadIdentityUser" \
  --member="principalSet://iam.googleapis.com/projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/$POOL_ID/attribute.account/$AWS_ACCOUNT_ID" \
  --project="$PROJECT_ID"

# Print the two values to send to Unblocked.
echo "service_account_email:          $SA_EMAIL"
echo "aws_workload_identity_provider: projects/$PROJECT_NUMBER/locations/global/workloadIdentityPools/$POOL_ID/providers/$PROVIDER_ID"
```

Enter the two printed values in Unblocked. They contain no service-account key or long-lived Google credential.

## Option 3: Google Cloud Console

The steps below use production AWS account `029574882031`.

<Steps>
  <Step title="Select the customer project">
    Select the customer project in Google Cloud Console.
  </Step>

  <Step title="Enable required APIs">
    Open **APIs & Services** › **Library**. Enable IAM API, IAM Service Account Credentials API, Security Token Service API, Compute Engine API, Cloud Logging API, and Cloud Monitoring API.
  </Step>

  <Step title="Create the service account">
    Open **IAM & Admin** › **Service Accounts**. Create `unblocked-gcp-access`.
  </Step>

  <Step title="Grant read-only project access">
    Open **IAM & Admin** › **IAM**. Grant the service account Logs Viewer, Monitoring Viewer, Service Usage Consumer, and Viewer.
  </Step>

  <Step title="Grant MCP Tool User access">
    Add a separate **MCP Tool User** grant for the service account. Add an IAM condition named `native-mcp-services-only` with this expression:

    ```text theme={null}
    resource.service == 'compute.googleapis.com' ||
    resource.service == 'logging.googleapis.com' ||
    resource.service == 'monitoring.googleapis.com'
    ```
  </Step>

  <Step title="Create the Workload Identity Pool and provider">
    Open **IAM & Admin** › **Workload Identity Federation**. Create pool `unblocked-gcp-access-pool`, then add an AWS provider named `unblocked-gcp-access` for AWS account `029574882031`.
  </Step>

  <Step title="Configure provider mappings and condition">
    Configure the provider mappings and condition exactly as shown:

    ```text theme={null}
    google.subject = assertion.arn
    attribute.account = assertion.account

    assertion.account == '029574882031' &&
    assertion.arn.startsWith(
      'arn:aws:sts::029574882031:assumed-role/UnblockedGcpCustomerAccess/'
    )
    ```
  </Step>

  <Step title="Grant Workload Identity User access">
    Grant the provider access to impersonate `unblocked-gcp-access` using **Workload Identity User**. Select the principal set whose `attribute.account` equals `029574882031`.
  </Step>

  <Step title="Collect the values for Unblocked">
    Collect these two values:

    * `service_account_email`: `unblocked-gcp-access@PROJECT_ID.iam.gserviceaccount.com`, shown on the Service Accounts page.
    * `aws_workload_identity_provider`: the provider resource name shown on the Workload Identity Federation provider page, in this format: `projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/unblocked-gcp-access-pool/providers/unblocked-gcp-access`.

    Enter both values in the Google Cloud MCP connection form in Unblocked.
  </Step>
</Steps>

## Connect in Unblocked

After configuring Google Cloud, connect the project in Unblocked.

<Steps>
  <Step title="Open Google Cloud MCP settings">
    In the Unblocked sidebar, click **Settings**, then **Data Sources**, then **Connect another data source**, and select Google Cloud MCP.
  </Step>

  <Step title="Enter the two WIF values">
    Enter the `service_account_email` and full `aws_workload_identity_provider` resource name from your Google Cloud setup. Click **Connect**.
  </Step>

  <Step title="Select MCP services">
    After connecting, select the Google Cloud MCP services that Unblocked can query. Select **Compute**, **Logging**, and **Monitoring**, or only the services you need, then save your settings. All read-only tools from selected services are enabled automatically.
  </Step>
</Steps>

## Quick verification

Confirm that the service account, pool, and provider exist:

```bash theme={null}
gcloud iam service-accounts describe "$SA_EMAIL" --project="$PROJECT_ID"

gcloud iam workload-identity-pools describe "$POOL_ID" \
  --location="global" \
  --project="$PROJECT_ID"

gcloud iam workload-identity-pools providers describe "$PROVIDER_ID" \
  --workload-identity-pool="$POOL_ID" \
  --location="global" \
  --project="$PROJECT_ID"
```

An end-to-end WIF test must run with an AWS session for `UnblockedGcpCustomerAccess`. Personal Google ADC does not test the AWS-to-Google federation path.