Integrating with Google Cloud Platform (GCP) to Collect Evidence

You can set up Azure collectors to automatically collect evidence. Adding a collector will connect Azure with an evidence task so that evidence collection can begin. For information on managing your collector, see Managing Collectors .

This article covers the third-party systems listed below:

  • Google Cloud Storage (GCS)

  • Google Cloud Compute Engine

  • Google Cloud Firewall

  • Google Cloud Functions

  • Google Cloud IAM

  • Google Cloud Logging

  • Google Cloud Monitoring

  • Google Cloud SQL

To set up and activate collectors

Collectors are integrations that are set up to pull evidence from third-party systems. To integrate OneTrust with a third-party system, you must set up the credentials that OneTrust will use to connect to the system. You have the ability to create a new credential when setting up the collector.

  1. On the Compliance Automation menu, select Setup > Evidence Integrations.
    The Evidence Integrations screen appears.

  2. Click on the Google system that will be set up to collect evidence.
    The Integration Details screen appears.
    Note:

    You can select any Google integration.

  3. Click the Add Collector button.
    The Set Up Collector modal appears.
    Note:

    The collectors shown within this modal are unique to the services available for each third party system.



  4. Select the service that will collect evidence and click the Continue button.
  5. Complete the fields in the Add Details tab. For more information, see Add Details Screen Reference.
  6. Click the Continue button.
  7. Complete the fields in the Define Evidence Collection tab. For more information, see Define Evidence Collection Screen Reference.
  8. Click the Continue button.
  9. Review the information for the collector.

    Click the Previous button to edit the evidence collection details.

  10. Click the Activate Collector button to save and activate the collector. The collector's status will appear on the Integration Details screen. For information on managing your collector, see Managing Collectors .
    Note:

    This is the only location where you can activate the collector. This is to ensure the collector is not activated by mistake.



    Click the Cancel button to save the collector without activating it.

Add Details Screen Reference



Step

Field

Description

Add Details

Collector Name

Enter a unique and descriptive name for the collector that will be used to create the integration. This name will help you identify the collector in future interactions.

Note:

Once you advance to the next screen, you cannot change the collector name.

Collector Assignee Email

Enter the email address that will receive notifications related to this collector. Create a distribution list if you would like to notify multiple users.

Email notifications are sent in the following situations:

  • The collector has been assigned to you and activated.

  • Evidence has been successfully captured.

  • Errors were found while capturing evidence automatically.

Choose Credentials

Select Credential

Select the existing credential you would like to use to share data securely. The collector will use credentials to access and gather data from the desired source.

You can create a new credential by clicking the Add new credential option. The Add new credential modal will appear.

Note:

You can also create a new credential in the Integrations menu. Once the new credential is created, it will appear as a saved credential. For more information, see Configuring Integration Credentials.

Credential Name

Enter a name to identify the credentials.

Note:

This field and all fields below only appear when you select the Add new credential option.

Description

Enter a description of the credentials.

Access Token URL

The field will be auto-populated with https://oauth2.googleapis.com/token.

Private Key

Enter the private key generated and downloaded to your computer after creating a new service account. For more information, see the Access Requirements section.

A private key allows you to authenticate as the service account.

Tip:

The private key should be copied and pasted without including the double quotes.

JWT Claims:

Audience ("aud")

The field will be auto-populated with https://oauth2.googleapis.com/token.

JWT Claims:

Issuer ("iss")

Enter the client ID.

The JWT Claims: Issuer identifies the principal that issued the JWT. This can be a user, organization, or service. The "iss" claim is used to prevent JWT token abuse and to provide details about the context in which the JWT was issued.

Tip:

The JWT Claims: Issuer should be copied and pasted without including the double quotes.

JWT Claims:

Expiration Time ("exp")

The field will be auto-populated with 3600. The expiration claim will be calculated as the supplied number of seconds from token creation.

JWT Claims:

Include Issued At ("iat")

Enable this setting to include an iat claim set to time stamp of token creation.

Save Credential

Click the Save Credential button to create and save the new credential.

Note:

If the credential is unable to collect evidence, you will need to select or create another credential.

Test Credential

Click the Test Credential button to test the credentials ability to collect evidence.

Define Evidence Collection Screen Reference



Step

Field

Description

Select Evidence Tasks

Evidence Task List

Select one or more evidence tasks for this collector. You can filter the evidence tasks list by recommended, all evidence tasks, and selected tasks.

Assign Collection Intervals

Collection Interval

Select a collection interval to determine how often this collector will sync and collect evidence. The collection interval will apply to all selected evidence tasks.

Tip:

OneTrust recommends you choose the most frequent option.

For example, if the evidence tasks you selected have a frequency of Monthly, Quarterly, and Yearly - you should choose Monthly for your collection interval.

Time of Day

Select the time of day that evidence will be collected. All times are in UTC.

Day of the Week

Select the day of the week that evidence will be collected.

Note:

This option only appears if the Weekly collection interval is selected.

Day of the Month

Select the day of the month that evidence will be collected.

Note:

This option only appears if the Monthly, Quarterly, or Biannually collection interval is selected.

Interval Start Month

Select the month when evidence will start being collected. This will set the cadence of evidence collection.

Note:

This option only appears if the Quarterly or Biannually collection interval is selected.

Date and Time of Day

Select the date and time that evidence will be collected. All times are in UTC.

Note:

This option only appears if the Yearly collection interval is selected.

Access Requirements

You can create a new service account and role in order to generate a private key and give OneTrust access to collect evidence. By completing this process, the private key will be created and then automatically saved to your computer via the Downloads folder.

To Create a New Service Account and Generate a Private Key

  1. Log into the Google Cloud Platform. The Google Cloud screen appears.



    Note:

    Once you log into the Google Cloud Platform, you should already be on the correct project. To select a new project, click your organization name to the right of the Google Cloud logo. On the pop-up modal, select the All tab and choose a projected listed for your organization.



  2. On the Google Cloud menu, select IAM & Admin > Service Accounts. The Service accounts list screen appears.



  3. Click + Create Service Account.

  4. Enter a name in the Service Account Name field.



    Note:

    This action will automatically generate a Service Account ID.

  5. Click the Create And Continue button.

  6. Click the Done button. The Service accounts list screen appears.

  7. Search for the name of the service account you just created.



  8. Click the link in the Email column. The Service Account Details screen appears.



  9. Select the Keys tab.

  10. Click the Add Key button and select Create new key. The Create private key modal appears.



  11. Select JSON.

  12. Click Create. The private key will be created and then automatically saved to your computer via the Downloads folder.

To Create a New Role

  1. On the IAM & Admin menu, select Roles. The Roles list screen appears.



  2. Click + Create Role.

  3. Enter a title for the role. For example, you can name the role Evidence Collection.



  4. Click + Add Permissions. The Add Permissions modal appears.



  5. Download the OneTrust GCP Permissions file.

  6. Use the search field on the Add Permissions modal to locate and check the box for each permission listed in the OneTrust GCP Permissions file.

    Note:

    The OneTrust GCP Permissions file provides the permissions that must be added to the role to allow OneTrust to access your GCP environment and collect evidence to support security controls. The link to the OneTrust GCP Permissions file referenced in this step will take you to the Documentation Repo in myOneTrust where you can view and download the list of permissions.

  7. Click the Add button.