> ## Documentation Index
> Fetch the complete documentation index at: https://docs.clarion.cantina.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# GCP Cloud Logging

> Send Google Cloud audit logs to Clarion with one monitor per GCP project.

GCP Cloud Logging monitors ingest Google Cloud audit logs through Pub/Sub push delivery. Each monitor is scoped to one GCP project, so webhook delivery, OIDC verification, and signal rules stay bound to that project.

## Setup options

Use **guided setup** when possible. Clarion will create or update the Pub/Sub topic, log sink, push subscription, OIDC signer, and IAM grants for the selected project.

Use **manual setup** when you need to provision GCP resources yourself. Clarion will show the monitor webhook URL and ask you to save the Pub/Sub subscription resource plus the OIDC service account metadata.

## Runtime credentials

Before agent tools can investigate issues from GCP, configure runtime credentials on the GCP integration page. These credentials authenticate Clarion's outbound GCP API calls.

The runtime credential project is separate from the monitored project. Add a GCP Cloud Logging monitor for each project you want to ingest, then grant the runtime service account the required roles in that target project.

Guided setup uses **Keyless via Workload Identity Federation** by default when Clarion's central GCP bridge is configured. This creates or reuses the `clarion-agent` service account and grants Clarion's central bridge service account permission to impersonate it, storing only non-secret metadata (no private key). Use **JSON service account key** mode only for local development or fallback.

## Guided setup

1. Go to **Integrations > GCP**.
2. Connect runtime credentials if they are not already configured. Guided setup will prefer keyless WIF on Vercel.
3. Add a **GCP Cloud Logging** monitor.
4. Choose **Run guided setup**.
5. Select the GCP project to monitor.
6. Approve the setup steps and save the monitor.

Clarion seeds a curated managed Admin Activity signal-rule set for the monitor, including IAM, logging, storage, KMS, Secret Manager, GKE, Cloud Run, Cloud Functions, Cloud SQL, and network/perimeter detections. The catch-all template remains available for explicit testing or heavily pre-filtered sinks, but it is not enabled by default.

## Manual setup

1. Create or open a **GCP Cloud Logging** monitor in Clarion.
2. Copy the monitor webhook URL.
3. In Google Cloud, route Cloud Logging entries to a Pub/Sub topic with a log sink.
4. Grant the log sink writer identity `roles/pubsub.publisher` on the topic.
5. Create a Pub/Sub push subscription that targets the monitor webhook URL.
6. Enable OIDC authentication on the push subscription.
7. Save these values on the monitor:
   * GCP project ID
   * Pub/Sub subscription resource
   * OIDC service account email
   * OIDC client ID, if configured

The OIDC token audience must match the webhook URL shown by Clarion.

## Multiple projects

Create one active GCP Cloud Logging monitor per workspace/project pair. Reuse the same runtime credentials, then run guided setup or apply manual IAM grants for each target project.