सार्वजनिक गाइड

Deploy the Cloud Scanner on GCP

Scan GCP project posture with Prowler via a serverless Cloud Run Job triggered by Cloud Scheduler. One Terraform apply deploys to any number of projects and regions. लक्षित पाठक: Cloud engineers, security engineers, platform teams. सामान्य सेटअप समय: 5 minutes.

quickstart

इसका उपयोग करें यदि

Scan GCP project posture with Prowler via a serverless Cloud Run Job triggered by Cloud Scheduler. One Terraform apply deploys to any number of projects and regions.

लक्षित दर्शक: Cloud engineers, security engineers, platform teamsविशिष्ट समय: 5 minutes

शुरू करने से पहले

  • Install Terraform ≥ 1.7: brew install terraform
  • Authenticate: gcloud auth application-default login
  • Create an ingestion API key in Settings → API Keys with Ingestion scope.

त्वरित मार्ग

एक प्रारंभिक सेटअप कॉपी करें, इसे अपने परिवेश में चलाएं, फिर गहन रोलआउट विवरण के लिए यहां वापस आएं।

Demonstration only

This configuration is designed for ease of use. To deploy scanner clients at scale, please plan your deployment architecture accordingly or contact us for enterprise best practices.

Get the source bundle

Download the exact source files referenced on this page, or run the one-command installer to write them locally before following the deployment steps.

GCP cloud scanner source

Creates the Terraform module under `deploy/gcp-cloud-scanner/` and prefills the current platform API URL so the Cloud Run deployment commands on this page work unchanged.

deploy/gcp-cloud-scanner/
bash
BLACKSHIELD_CLOUD_IMAGE=public.ecr.aws/blackshield-security/cloud-scanner:1.0.12 \
BLACKSHIELD_SITE_URL=https://blackshield.chaplau.com \
BLACKSHIELD_API_URL=https://api.blackshield.chaplau.com \
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/gcp-cloud-scanner.sh)
cd deploy/gcp-cloud-scanner
Download source

यह चलाएँ

Deploy to multiple GCP projects (two commands)

bash
# Bootstrap the local source bundle first
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/gcp-cloud-scanner.sh)

cd deploy/gcp-cloud-scanner

# Authenticate
gcloud auth application-default login

# Deploy all targets defined in main.tf locals.targets
TF_VAR_blackshield_api_key=sp_xxxx \
terraform init && terraform apply -auto-approve

# View deployed resources
terraform output -json cloud_run_job_names
terraform output -json scheduler_job_names

Trigger manual execution + stream logs

bash
# Trigger a one-off scan
gcloud run jobs execute blackshield-cloud-scanner \
  --project my-prod-project \
  --region us-central1

# Stream execution logs
gcloud logging read \
  'resource.type="cloud_run_job" AND resource.labels.job_name="blackshield-cloud-scanner"' \
  --project my-prod-project \
  --limit 50 \
  --format "table(timestamp,textPayload)"

समझें और कस्टमाइज़ करें

जब आप रोलआउट को अनुकूलित करना चाहते हैं, स्वामित्व को मान्य करना चाहते हैं या परिनियोजन का सुरक्षित रूप से विस्तार करना चाहते हैं, तो नीचे दिए गए चरणों का उपयोग करें।

1

चरण 1

Prerequisites and authentication

Install Terraform, authenticate with gcloud, and set your API key.

  • Install Terraform ≥ 1.7: brew install terraform
  • Authenticate: gcloud auth application-default login
  • Create an Ingestion API key in Settings → API Keys.
  • Set TF_VAR_blackshield_api_key=sp_xxxx in your environment.

सफलता कैसी दिखती है

Set TF_VAR_blackshield_api_key=sp_xxxx in your environment.

Open API Keys · साइन-इन आवश्यक
2

चरण 2

Configure targets and deploy

Edit the targets map in main.tf, then apply to deploy all project+region pairs at once.

  • Bootstrap the local source bundle first. It prefills `BLACKSHIELD_API_URL` from the deployed platform and writes the Terraform module to `deploy/gcp-cloud-scanner/`.
  • Edit deploy/gcp-cloud-scanner/main.tf — add your project IDs and regions to locals.targets.
  • Run: cd deploy/gcp-cloud-scanner && terraform init && terraform apply -auto-approve
  • Terraform creates: service account, Secret Manager secret, Cloud Run Job, Cloud Scheduler, and enables required APIs.
  • Each project+region pair is an independent deployment unit.

सफलता कैसी दिखती है

Each project+region pair is an independent deployment unit.

All Deployment Guides
3

चरण 3

Verify and monitor

Trigger a manual job execution and confirm findings arrive in the platform.

  • Trigger manually: gcloud run jobs execute blackshield-cloud-scanner --project my-project --region us-central1
  • Stream logs: gcloud logging read 'resource.labels.job_name=blackshield-cloud-scanner' --project my-project
  • Confirm findings appear in the platform with scanner=cloud.
  • Check terraform output for all deployed job and scheduler names.

सफलता कैसी दिखती है

Check terraform output for all deployed job and scheduler names.

View Findings · साइन-इन आवश्यक

सफलता कैसी दिखती है

  • terraform apply completes with no errors and outputs Cloud Run Job and Scheduler names.
  • Manual job execution succeeds: gcloud run jobs execute blackshield-cloud-scanner
  • Cloud posture findings appear in the platform Findings view within 30 minutes.

जारी रखें

Keep your rollout moving with the next recommended step.

अपनी पहली फाइंडिंग्स इनजेस्ट करें
Deploy the Cloud Scanner on GCP | BlackShield Docs